Exchange Wallet Screening

import { ThreatClient, Chain } from '@webacy-xyz/sdk';

const client = new ThreatClient({
  apiKey: process.env.WEBACY_API_KEY,
  defaultChain: Chain.ETH,
});

// Deposit screening
async function screenDeposit(address: string, chain: Chain) {
  // Step 1: Sanctions (must block)
  const sanctions = await client.addresses.checkSanctioned(address, { chain });
  if (sanctions.is_sanctioned) {
    return {
      action: 'BLOCK',
      reason: 'Sanctioned address',
      report: true
    };
  }

  // Step 2: Risk analysis
  const risk = await client.addresses.analyze(address, { chain });

  if (risk.overallRisk >= 80) {
    return {
      action: 'BLOCK',
      reason: 'Extremely high risk',
      riskScore: risk.overallRisk,
      issues: risk.issues
    };
  }

  if (risk.overallRisk >= 50) {
    return {
      action: 'REVIEW',
      reason: 'High risk - manual review required',
      riskScore: risk.overallRisk,
      issues: risk.issues
    };
  }

  return {
    action: 'ACCEPT',
    riskScore: risk.overallRisk
  };
}

// Withdrawal screening
async function screenWithdrawal(destination: string, chain: Chain) {
  // Step 1: Sanctions
  const sanctions = await client.addresses.checkSanctioned(destination, { chain });
  if (sanctions.is_sanctioned) {
    return {
      action: 'BLOCK',
      reason: 'Cannot withdraw to sanctioned address'
    };
  }

  // Step 2: Address poisoning
  const poisoning = await client.addresses.checkPoisoning(destination, { chain });
  if (poisoning.is_poisoned) {
    return {
      action: 'WARN',
      reason: 'Possible address poisoning attack detected',
      requireConfirmation: true,
      message: 'Please verify this is the correct address. It appears similar to addresses that have been used in phishing attacks.'
    };
  }

  // Step 3: Risk analysis
  const risk = await client.addresses.analyze(destination, { chain });
  if (risk.overallRisk >= 50) {
    return {
      action: 'FLAG',
      reason: 'High risk destination',
      riskScore: risk.overallRisk,
      showWarning: true
    };
  }

  return { action: 'PROCEED' };
}