Overview
If you are wiring this into a wallet, bot, or service, the shape is:
- SDKs do the fast local check before signing.
- The firewall lock enforces the same rule on-chain.
- The registry cell holds the blacklist.
- The CLI is for inspection and update workflows.
If a wallet cell uses the firewall lock, a blacklisted destination should fail whether the application checks it or not.
If you want the practical walk-through, start with How to Use.
Typical flow
Section titled “Typical flow”- Build the unsigned transaction.
- Read the live registry cell data.
- Run the SDK check.
- Sign and broadcast if it passes.
- Let the firewall lock enforce the same rule again on-chain.
What is enforced
Section titled “What is enforced”- Blacklisted
lock_args - Blacklisted
type_argswhen that flag is on - Exact registry dependency matching
- Fail-closed behavior on missing, invalid, or ambiguous registry data
What is not enforced
Section titled “What is not enforced”- Non-address exploit classes
- Addresses that are not in the registry yet
- Governance policy itself outside the update workflow
Where to read next
Section titled “Where to read next”Common entry points
Section titled “Common entry points”ckb-firewall inspectckb-firewall proposeimport { TransactionFirewall } from "@ckb-firewall/sdk";use ckb_transaction_firewall_sdk::check_transaction;