Why is post-deployment monitoring important?
Our post-deployment smart contract monitoring service provides real-time anomaly detection and automatic alerting for your DeFi protocol. We have seen too many projects that passed an audit but were hacked a month after deployment, losing millions. With over 10 years in blockchain development and 50+ projects monitored, we know an audit is a security snapshot. It does not protect against new vulnerabilities after dependency updates or market shifts. Continuous post-deployment smart contract monitoring is the only way to detect threats early.
We develop a monitoring system that tracks on-chain activity in real time, detects anomalies, and alerts your team via Telegram, Slack, or PagerDuty. Our monitoring delivers alerts 4x faster than free tools (500ms vs 2-3 seconds) (Wikipedia on Reentrancy attack).
Threats and anomaly detection
Reentrancy attacks in real time
The classic Reentrancy attack cost TheDAO $3.6M in 2016. We monitor call sequences and trigger on suspicious patterns: external calls before state update, multiple calls from one address. Our detection can stop an exploit before funds are drained.
Oracle manipulation
Chainlink is the de facto standard, but manipulation is possible during sharp price moves. We track DEX prices and compare with the oracle. A discrepancy >5% generates an alert, preventing unfair liquidations.
TVL and volume anomalies
A sudden TVL drop may signal an exploit. We monitor liquidity pools and staking balances, flagging anomalies like a 500% increase in withdraw requests within an hour.
How is monitoring set up in 6 steps?
- Contract audit – Study ABI, identify critical events and dependencies (0.5–1 day).
- Rule design – Write conditions per event: thresholds, patterns, blacklists (1–2 days).
- Node integration – Deploy full node or use archival node, connect event listener (0.5–1 day).
- Alert configuration – Choose channels and severity: Critical (immediate), High (1 hour), Medium (daily) (0.5 day).
- Testing – Fork mainnet, simulate attacks, verify alerts (1–2 days).
- Launch and calibration – Go live, manual analysis first 48 hours to calibrate thresholds (2 days).
Case study: Lending protocol on Polygon
We set up monitoring for a lending protocol. The main threat was flash loan attacks on reserve contracts. We added a rule: if a single transaction has >10 `borrow` calls with different collaterals and total exceeds $100k — immediate alert. In the first two months, we recorded 3 attack attempts, all blocked before damage occurred, saving an estimated $2M+ in potential losses.Our monitoring service starts at $250/month per contract, and enterprise plans go up to $2,000/month. This investment pales in comparison to the potential losses from a single exploit, which can exceed $1M. Clients have reported an average savings of $500K per year by preventing attacks.
Alert severity levels
We categorize alerts by severity with corresponding response times:
| Severity | Response time | Example |
|---|---|---|
| Critical | 15 minutes | Reentrancy attack in progress |
| High | 2 hours | Oracle price deviation >5% |
| Medium | 24 hours | TVL drop >10% |
How does our monitoring compare to free solutions?
Our monitoring outperforms free tools like Etherscan alerts in key areas:
| Criteria | Etherscan Alerts | Our monitoring |
|---|---|---|
| Notification delay | 2–3 seconds | ~500 ms (4x faster) |
| Custom logic | Basic events only | Conditional thresholds, combined rules, blacklists |
| Multi-chain support | Separate per network | Single dashboard for all networks |
| False positive filtering | No | Automatic aggregation, deduplication |
| Historical data | Latest transactions only | TimescaleDB with trend charts |
The value of post-audit monitoring
An audit does not protect against upgrades, new OpenZeppelin bugs, or social engineering. Continuous monitoring is a second line of defense for smart contract protection. Our monitoring, with 5+ years on the market, has saved clients from multiple exploits.
Typical monitoring setup mistakes
-
Missing rarely-called events — e.g.,
OwnershipTransferred. If an attacker changes the owner, you learn only after they have already withdrawn funds. Include all admin events in monitoring. - Too high thresholds — often set large deviation (20%) to avoid noise, but gives the hacker enough time. Optimal: 5% for prices, 10% for volumes.
- Ignoring cross-chain risks — if a protocol runs on 3 networks, monitoring must be on each network, otherwise a bridge attack goes undetected.
Deliverables
- Scripts/configs for monitoring (Ansible roles, Docker images)
- Grafana monitoring dashboard with graphs of key metrics (TVL, transaction count, gas price)
- Documentation: rule descriptions, instructions for adding new contracts
- Access to a Telegram bot with live notifications
- 7 days post-launch support (threshold calibration, rule adjustments)
- Optional: premium 24/7 support with 30-minute response time guarantee
Contact us for a preliminary assessment of your project — it's free. We will help set up monitoring that truly protects your funds.