Watch · Detect · Act
Real-time onchain defense
Bulwark watches your contracts, detects threats as they happen, and can pause them on-chain. Monitoring tells you the money left. Defense is the part that stops it.
Google sign-in · onboard a contract in a minute · no card
- ERC-1967 implementation changes 0x4d1a…9c02 → 0xe7bb…0f31
- New implementation is unverified and 4 minutes old
- Deployer funded by an address flagged sanctioned (1 hop)
Three jobs, one system
Most tools stop after the alert. The value is in what happens in the ninety seconds after it.
Watch
Every event, call trace, and balance change on your contracts — plus the ones they depend on, discovered automatically. Off-chain too: governance proposals and front-end integrity.
- 60 detection concepts
- Dependency discovery
- Invariant + anomaly checks
Detect
Findings group into incidents, incidents correlate into campaigns. You get one page per attack with the trace, the actor's funding path, and the contracts they touched — not forty notifications.
- Deduped, correlated incidents
- Attacker campaign clustering
- MTTD / MTTA / MTTR tracked
Act
Pause, trip a circuit breaker, revoke a role. Actions run under a policy you set — auto, veto window, or human approval — and can be proposed into the custody platform your signers already use.
- Pause & circuit-break
- Veto windows
- Fireblocks / Fordefi proposals
Before you sign
See the storage, not just the simulation
A transaction that succeeds in simulation can still be the one that moves an implementation pointer or hands over an owner slot. Bulwark returns the exact pre/post value of every slot the call writes, and raises proxy and admin slots as critical no matter what the function claimed to do.
It runs as the address that will actually call your contract — the timelock, the account contract — so you see the effect instead of an authorization revert. If the diff can't be computed, it says so rather than implying nothing changes.
Deep on the chains that matter
Four chains, covered properly — per-chain workers, per-chain failover, and detection tuned to each. Breadth is easy to add once depth is real.
Wire it into what you already run
Every screen in the product is an API call. Put the verdict in front of your own signing flow, or pipe findings into the tools your team already watches.
curl -X POST https://bulwark-api.arcadia.agency/v0/guard \
-H "Authorization: Bearer bwk_…" \
-d '{"chain_id":1,"to":"0x9f2c…","data":"0x4f1ef286…"}'
{ "decision": "block",
"risk": "critical",
"reasons": ["ERC-1967 implementation slot changes …"] }Transaction guard
allow / review / block before a signature, for a Safe guard, a custody policy, or a wallet.
Address screening
OFAC and intel labels with 1-hop fund-flow exposure, in batch.
Incident webhooks
HMAC-signed, retried, filterable by severity and chain.
Threat feed
Pull or subscribe to the labels and campaigns we see across tenants.
Start watching in a minute
Paste a contract address. Bulwark pulls the ABI, profiles it, finds what it depends on, and recommends the rules worth turning on.