- Use
signRawMessageBytesfor unparsed raw signing requests. - Use
signTransactionBytesfor parsed raw signing requests. - Use
tron_signTransactionortron_sendTransactionfor the RPC transaction method the policy applies to.
signTransactionBytes, tron_sendTransaction, and tron_signTransaction all use transaction bytes that
evaluate tron_transaction or tron_trigger_smart_contract_data conditions.
The decision to use a TransferContract or a TriggerSmartContract fields on Tron depends on the asset you are moving and whether you are interacting with a smart contract.
- Use a
TransferContractwhen you are performing a simple, direct transfer of native TRX between two standard accounts. - Use a
TriggerSmartContractwhen you are interacting with any smart contract, which is necessary for transferring TRC-20 tokens and calling any function on a smart contract.
Allowlist a specific TransferContract to_address
- RPC methods
- Raw signing
Use
tron_signTransaction and tron_sendTransaction for structured Tron RPC transaction requests.{
"version": "1.0",
"name": "RPC TransferContract to_address",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific TransferContract to_address",
"method": "tron_signTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "eq",
"value": "TBia4uHnb3oSSZm5isP284cA7Np1v15Vhi"
}
],
"action": "ALLOW"
},
{
"name": "Allow specific TransferContract to_address",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "eq",
"value": "TBia4uHnb3oSSZm5isP284cA7Np1v15Vhi"
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "TransferContract to_address",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific TransferContract to_address",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "eq",
"value": "TBia4uHnb3oSSZm5isP284cA7Np1v15Vhi"
}
],
"action": "ALLOW"
}
]
}
Configure a max TransferContract amount (TRX)
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC TransferContract amount",
"chain_type": "tron",
"rules": [
{
"name": "TransferContract amount maximum",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.amount",
"operator": "lt",
"value": "10000000"
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "TransferContract amount",
"chain_type": "tron",
"rules": [
{
"name": "TransferContract amount maximum",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.amount",
"operator": "lt",
"value": "10000000"
}
],
"action": "ALLOW"
}
]
}
Configure a max TriggerSmartContract call_value (TRX)
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC TriggerSmartContract call_value",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract call_value",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.call_value",
"operator": "lt",
"value": "10000000"
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "TriggerSmartContract contract address",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract call_value",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.call_value",
"operator": "lt",
"value": "10000000"
}
],
"action": "ALLOW"
}
]
}
Disallow a certain TriggerSmartContract token_id (TRC-10)
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC TriggerSmartContract token id",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract token_id",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.token_id",
"operator": "eq",
"value": "1000100"
}
],
"action": "DENY"
}
]
}
{
"version": "1.0",
"name": "TriggerSmartContract token id",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract token_id",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.token_id",
"operator": "eq",
"value": "1000100"
}
],
"action": "DENY"
}
]
}
Configure a max TriggerSmartContract call_token_value (TRC-10)
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC TriggerSmartContract call_token_value",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract call_token_value",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.call_token_value",
"operator": "lt",
"value": "10000000"
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "TriggerSmartContract call_token_value",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract call_token_value",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.call_token_value",
"operator": "lt",
"value": "10000000"
}
],
"action": "ALLOW"
}
]
}
Allow a TRC-20 transfer with ABI decoding
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC TRC-20 transfer with ABI",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific TRC-20 recipient",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.contract_address",
"operator": "eq",
"value": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
},
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transfer.to",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs",
"abi": [
{
"name": "transfer",
"type": "function",
"inputs": [{"name": "to", "type": "address"}]
}
]
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "TRC-20 transfer with ABI",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific TRC-20 recipient",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.contract_address",
"operator": "eq",
"value": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
},
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transfer.to",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs",
"abi": [
{
"name": "transfer",
"type": "function",
"inputs": [{"name": "to", "type": "address"}]
}
]
}
],
"action": "ALLOW"
}
]
}
Allow a certain owner address to transfer TRC20 token
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC TriggerSmartContract with ABI",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract transferFrom._from",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transferFrom._from",
"operator": "eq",
"value": "THscQ8SwfcD7tdts9cnMxTnH2hwvpX3ujy",
"abi": [
{
"type": "function",
"name": "transferFrom",
"inputs": [
{
"name": "_from",
"type": "address"
},
{
"name": "_to",
"type": "address"
},
{
"name": "_value",
"type": "uint256"
}
],
"outputs": [
{
"type": "bool"
}
],
"stateMutability": "nonpayable"
}
]
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "TriggerSmartContract with ABI",
"chain_type": "tron",
"rules": [
{
"name": "TriggerSmartContract transferFrom._from",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transferFrom._from",
"operator": "eq",
"value": "THscQ8SwfcD7tdts9cnMxTnH2hwvpX3ujy",
"abi": [
{
"type": "function",
"name": "transferFrom",
"inputs": [
{
"name": "_from",
"type": "address"
},
{
"name": "_to",
"type": "address"
},
{
"name": "_value",
"type": "uint256"
}
],
"outputs": [
{
"type": "bool"
}
],
"stateMutability": "nonpayable"
}
]
}
],
"action": "ALLOW"
}
]
}
Allow transfers to a specific address with a specific contract address
This is an example of mixing TriggerSmartContract and ABI configurations.
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC Allow a specific address with a specific contract",
"chain_type": "tron",
"rules": [
{
"name": "Allow a specific address with a specific contract",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.contract_address",
"operator": "eq",
"value": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
},
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transfer.to",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs",
"abi": [
{
"name": "transfer",
"type": "function",
"inputs": [{"name": "to", "type": "address"}]
}
]
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "Allow a specific address with a specific contract",
"chain_type": "tron",
"rules": [
{
"name": "Allow a specific address with a specific contract",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TriggerSmartContract.contract_address",
"operator": "eq",
"value": "TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t"
},
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transfer.to",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs",
"abi": [
{
"name": "transfer",
"type": "function",
"inputs": [{"name": "to", "type": "address"}]
}
]
}
],
"action": "ALLOW"
}
]
}
Denylist recipients with condition sets
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC Denylist TransferContract to_address",
"chain_type": "tron",
"rules": [
{
"name": "Denylist TransferContract to_address",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "in_condition_set",
"value": "a2p4etpcbj2dltbjfigybi8j"
}
],
"action": "DENY"
}
]
}
{
"version": "1.0",
"name": "Denylist TransferContract to_address",
"chain_type": "tron",
"rules": [
{
"name": "Denylist TransferContract to_address",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "in_condition_set",
"value": "a2p4etpcbj2dltbjfigybi8j"
}
],
"action": "DENY"
}
]
}
Only allow raw signing after a certain start date
UsesignRawMessageBytes for unparsed raw signing requests. signRawMessageBytes rules support
system conditions, but do not support decoded transaction field sources like tron_transaction or
tron_trigger_smart_contract_data.
{
"version": "1.0",
"name": "Only allow raw signing after a certain start date",
"chain_type": "tron",
"rules": [
{
"name": "Only allow raw signing after a certain start date",
"method": "signRawMessageBytes",
"conditions": [
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
Only allow transactions after a certain start date
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC Only allow transactions after a certain start date",
"chain_type": "tron",
"rules": [
{
"name": "Only allow transactions after a certain start date",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "Only allow transactions after a certain start date",
"chain_type": "tron",
"rules": [
{
"name": "Only allow transactions after a certain start date",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
Allow transfers to a specific address after a certain timestamp
This is an example of mixing TransferContract and System configurations.
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC Allow specific address after a certain timestamp",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific address after a certain timestamp",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs"
},
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "Allow specific address after a certain timestamp",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific address after a certain timestamp",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.to_address",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs"
},
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
Allow transfers to a specific address with ABI after a certain timestamp
This is an example of mixing TriggerSmartContract with ABI and System configurations.
- RPC methods
- Raw signing
{
"version": "1.0",
"name": "RPC Allow specific address with ABI after a timestamp",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific address with ABI after a timestamp",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transfer.to",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs",
"abi": [
{
"name": "transfer",
"type": "function",
"inputs": [{"name": "to", "type": "address"}]
}
]
},
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
{
"version": "1.0",
"name": "Allow specific address with ABI after a timestamp",
"chain_type": "tron",
"rules": [
{
"name": "Allow specific address with ABI after a timestamp",
"method": "signTransactionBytes",
"conditions": [
{
"field_source": "tron_trigger_smart_contract_data",
"field": "transfer.to",
"operator": "eq",
"value": "TG3XXyExBkPp9nzdajDZsozEu4BkaSJozs",
"abi": [
{
"name": "transfer",
"type": "function",
"inputs": [{"name": "to", "type": "address"}]
}
]
},
{
"field_source": "system",
"field": "current_unix_timestamp",
"operator": "gt",
"value": "1757304000" // 2025-09-08 00:00:00 UTC in seconds since epoch
}
],
"action": "ALLOW"
}
]
}
Deny all requests
{
"version": "1.0",
"name": "Example policy to deny all requests",
"chain_type": "tron",
"rules": [
{
"name": "Deny all requests",
"method": "*",
"conditions": [],
"action": "DENY"
}
]
}
Anti patterns
Avoid adding rules that may override other rules
{
"version": "1.0",
"name": "Restrict the maximum value of TRX transfers",
"chain_type": "tron",
"rules": [
{
// This rule restricts the value of TRX transfers.
"name": "Restrict TRX transfers to 1 TRX (in sun)",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.amount",
"operator": "lte",
"value": "1000000" // 1 TRX = 1,000,000 sun
}
],
"action": "ALLOW"
},
{
// This rule will override the previous rule by allowing a 5 TRX transfer.
"name": "Restrict TRX transfers to 5 TRX (in sun)",
"method": "tron_sendTransaction",
"conditions": [
{
"field_source": "tron_transaction",
"field": "TransferContract.amount",
"operator": "lte",
"value": "5000000" // 5 TRX = 5,000,000 sun
}
],
"action": "ALLOW"
}
]
}