serverless.yml

service: defender-as-code-test-project
configValidationMode: error
frameworkVersion: '3'

provider:
  name: defender
  stage: ${opt:stage, 'dev'}
  stackName: 'mystack'
  # SSOT: use this template as a single source of truth.
  # This will delete Defender resources (with the exception of Relayers) not found in this template upon deployment.
  ssot: false

custom:
  config: ${file(secrets.${self:provider.stage}.yml)}

defender:
  key: ${self:custom.config.keys.api}
  secret: ${self:custom.config.keys.secret}

resources:
  actions:
    action-example-1:
      name: 'Hello world from serverless'
      path: './actions/hello-world'
      # optional
      relayer: ${self:resources.relayers.relayer-3}
      trigger:
        type: 'schedule' # or webhook
        # optional if not cron
        frequency: 1500
        # optional
        cron: null
      paused: false
    action-example-2:
      name: 'Hello world from serverless 2'
      path: './actions/hello-world'
      trigger:
        type: 'schedule'
        cron: '0 */12 * * *'
      paused: false
    action-example-3:
      name: 'Hello world from serverless 3'
      path: './actions/hello-world'
      trigger:
        type: 'webhook'
      paused: false
      environment-variables:
        hello: 'world!'
    action-example-4: '516dfd2f-9715-47d4-bcdf-d1f9a7b4d80d'

  policies:
    policy-1:
      # optional
      gas-price-cap: 1000
      # optional
      whitelist-receivers:
        - '0x0f06aB75c7DD497981b75CD82F6566e3a5CAd8f2'
      # optional
      eip1559-pricing: true
      private-transactions: 'flashbots-fast'

  secrets:
    # optional - global secrets are not affected by stackName changes
    global:
      foo: ${self:custom.config.secrets.foo}
      hello: ${self:custom.config.secrets.hello}
      test: ${self:custom.config.secrets.test}
    # optional - stack secrets (formatted as <stackname>_<secretkey>)
    stack:
      test: ${self:custom.config.secrets.test}

  contracts:
    contract-1:
      name: 'Demo-Flash'
      address: '0xA91382E82fB676d4c935E601305E5253b3829dCD'
      network: 'mainnet'
      # optional
      abi: ${file(./abis/demoflash.json.abi)}
      # optional
      nat-spec: null
    contract-2: 'sepolia-0x62034459131329bE4349A9cc322B03c63806Aa11'

  relayers:
    relayer-1:
      name: 'Test Relayer 1'
      network: 'sepolia'
      min-balance: 1000
      # optional
      policy: ${self:resources.policies.policy-1}
      api-keys:
        - key1
    relayer-2:
      name: 'Test Relayer 2'
      network: 'mainnet'
      min-balance: 1000
      # optional (make sure relayer-1 is above current relayer)
      address-from-relayer: ${self:resources.relayers.relayer-1}
      # optional
      policy: ${self:resources.policies.policy-1}
    relayer-3: 'bcb659c6-7e11-4d37-a15b-0fa9f3d3442c' # relayerId referenced from Defender
    relayer-4:
      name: 'Test Relayer 4'
      network: 'mainnet'
      min-balance: 1000
      address-from-relayer: ${self:resources.relayers.relayer-3}
      # optional
      policy: ${self:resources.policies.policy-1}

  relayer-groups:
    relayer-group-1:
      name: 'Sepolia Relayer Group'
      network: 'sepolia'
      min-balance: 1000
      # optional
      relayers: 2
      # optional
      policy: ${self:resources.policies.policy-1}
      # optional
      api-keys:
        - key1
      # optional
      notification-channels:
        notification-ids:
          - ${self:resources.notifications.webhook-1} # only webhooks are allowed here
        events:
          - 'pending'
          
  notifications:
    email-1:
      type: 'email'
      name: 'CTO Email'
      config:
        emails:
          - ${self:custom.config.notifications.cto-email}
      paused: false
    slack-1:
      type: 'slack'
      name: 'Workspace Slack'
      config:
        url: ${self:custom.config.notifications.slack}
      paused: false
    webhook-1:
      type: 'webhook'
      name: 'Alert Webhook'
      config:
        url:
          - ${self:custom.config.notifications.webhook}
      paused: false

  monitors:
    # unique resource name
    block-example:
      name: 'Block Example'
      type: 'BLOCK'
      network: 'sepolia'
      risk-category: 'TECHNICAL' # optional
      # optional - either contracts OR addresses should be defined
      contracts: 
        - ${self:resources.contracts.contract-2}
      # optional - will default to first contract in contracts if not defined
      abi: ${file(./abis/erc721.json.abi)}
      # optional
      alert-threshold:
        amount: 2
        window-seconds: 3600
      # optional
      paused: false
      # optional
      action-condition: ${self:resources.actions.action-example-4}
      # optional
      action-trigger: null
      # optional
      confirm-level: 1 # or 'safe' or 'finalized'
      notify-config:
        timeout: 0 # optional
        message: null # optional
        channels:
          - ${self:resources.notifications.email-1}
      # optional
      conditions:
        event:
          - signature: 'OwnershipTransferred(address,address)'
            expression: 'previousOwner=0x0f06aB75c7DD497981b75CD82F6566e3a5CAd8f2' # optional
        function:
          - signature: 'renounceOwnership()'
            expression: null # optional
        transaction: 'gasPrice > 0' # optional expression
    forta-example:
      name: 'Forta Example'
      type: 'FORTA'
      # optional
      alert-threshold:
        amount: 2
        window-seconds: 3600
      # optional
      paused: false
      # optional
      action-condition: ${self:resources.actions.action-example-1}
      # optional
      action-trigger: null
      notify-config:
        timeout: 0 # optional
        message: null # optional
        channels: [] # optional
      # optional
      conditions:
        min-scanner-count: 1
        severity: 2 # optional (unknown=0, info=1, low=2, medium=3, high=4, critical=5)
        # optional
        alert-ids:
          - '0x1ef2600454e8ed808cc0411a4d653679cc7a1b73d320388cee1e0fc0412490a3'
      # optional
      forta-node-id: '123'
      # optional if addresses is defined
      agent-ids:
        - '0x8fe07f1a4d33b30be2387293f052c273660c829e9a6965cf7e8d485bcb871083'
      # optional
      forta-last-processed-time: null

  forked-networks:
    mainnet-fork:
      name: mainnet-fork # restricted to alphanumeric characters and dashes (no whitespaces)
      supported-network: mainnet # must be of type SupportedNetwork
      rpc-url: https://rpc.phalcon.xyz/rpc_123
      # optional
      block-explorer-url: https://scan.phalcon.xyz/fork_123
      # optional
      api-key: null

  private-networks:
    my-network:
      name: my-private-network # restricted to alphanumeric characters and dashes (no whitespaces)
      rpc-url: https://rpc.kaleido.io/
      # optional
      block-explorer-url: null
      # optional
      api-key: null
      configuration:
        symbol: ETH
        # optional
        safe-contracts:
          master: '0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552'
          proxy-factory: '0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2'
          multi-send-call-only: '0x40A2aCCbd92BCA938b02010E17A5b8929b49130D'
          create-call: '0x762fcF49C5EF21510755191BbeD6AA2a702f0348'
        # optional
        subgraph-url: null
        # optional
        eips:
          isEIP1559: true

plugins:
  - '@openzeppelin/defender-as-code'