Smart Contract Monitoring: Forta & OpenZeppelin Defender
You've deployed smart contracts, passed audits, but you realize: zero-day vulnerabilities appear every day. Reentrancy, flash loan attacks, oracle manipulations — monthly losses in DeFi exceed $100M, according to analytics. Audits check known bugs but don't protect against new attacks after deployment. The solution is active real-time smart contract monitoring that detects threats and blocks them before liquidity is stolen. The most effective combination is Forta Network and OpenZeppelin Defender.
We set up smart contract monitoring on Forta and Defender. Forta is a decentralized anomaly detection network: it analyzes every transaction and finds suspicious patterns using ML models and rules. Defender is a management platform that executes actions: pauses contracts, revokes permissions, sends alerts to Telegram/Slack/email. Together they form an automatic security circuit that works without human intervention.
Which attacks do we track?
-
Reentrancy. Forta catches multiple
calls to the same contract in one transaction. Defender immediately callspause()via Autotask. Typical case: attacks on protocols with old code after EIP-150. - Oracle manipulation. An abnormal change in Chainlink price (jump >20% in one block) triggers an alert and temporary blocking of dependent operations. For example, we set up protection for an AMM pool with $5M TVL where such a bot prevented a potential drain of $1.2M. For another protocol with $10M TVL, we prevented a reentrancy attack that could have taken $2M.
-
MEV and flash loans. Custom bots recognize patterns of sandwich attacks and liquidity draining by analyzing call sequences. We also monitor mass
approves — if there are more than 10 in a block, it's a sign of an attack.
How Forta and Defender work together
Forta detects faster (1-2 seconds) but cannot automatically respond. Defender is slower (up to a minute with polling) but can execute actions: pause, revoke, transfer. We connect them: Forta sends an alert to Defender via webhook, and Defender launches an Autotask that blocks the attack. Response time is no more than 10 seconds, which is critical for protecting liquidity.
Turnkey setup process
Setup goes through five stages:
- Contract analysis: We study the code, identify critical functions (withdraw, mint, transferOwnership). We create an attack map.
- Forta bot configuration: Deploy ready-made bots (reentrancy-counter) and write custom ones for your protocol.
- Defender integration: Connect contracts, configure Admin and Relay, write Autotasks in JS for pausing or revoking permissions.
- Testing: Simulate attacks on testnet using Foundry. Ensure detection and response work without false positives.
- Launch and training: Move configuration to mainnet, hand over access, hold two training sessions for your team.
| Stage | Description | Estimated Time |
|---|---|---|
| Contract analysis | Study code, identify critical functions, create attack map | 1-2 days |
| Forta bot configuration | Deploy ready-made bots and write custom ones | 1-3 days |
| Defender integration | Connect contracts, configure Admin/Relay, write Autotasks | 1-2 days |
| Testing | Simulate attacks on testnet with Foundry | 1-2 days |
| Launch and training | Deploy to mainnet, hand over access, train team | 1 day |
Response scenario comparison
| Attack | Detection | Response | Response Time |
|---|---|---|---|
| Reentrancy | Multiple calls | Autotask calls pause() | <5 seconds |
| Flash loan drain | Liquidity anomalies | Pool locking, alert | <10 seconds |
| Oracle manipulation | Price jump >20% | Temporary freeze of operations | <10 seconds |
| Mass approve | >10 approve per block | Revoke permissions, alert | <5 seconds |
| Access control attack | Unauthorized call to sensitive function | Revoke role, pause contract | <5 seconds |
Example custom Forta bot
const { ethers } = require('ethers'); const THRESHOLD = 10; async function handleTransaction(txEvent) { const approves = txEvent.filterLog('Approval(address,address,uint256)'); if (approves.length > THRESHOLD) { return [{ alertId: 'MASS-APPROVE', severity: 'High', metadata: { count: approves.length.toString() } }]; } return []; } Technical details of Defender Autotask configuration
We use Defender Autotasks with an "Event" trigger on Paused() or Withdraw(). The Autotask calls pause() via a Relayer with a gas limit of 200k. The result is logged in the Defender Dashboard.
What's included in the service
- Documentation of all bots, triggers, and actions.
- Dashboards in Forta Explorer and Defender Admin.
- RBAC access for your team.
- 2 weeks of post-launch support.
- 95% detection guarantee for attacks with response under 10 seconds.
- Gas fee monitoring — alert on abnormal transaction costs.
Timeline and pricing
Standard setup for one contract (up to 10 functions, one network) takes 5 to 10 business days. For complex projects with cross-chain monitoring, we calculate the timeline individually. The cost is fixed after analyzing your contracts. If false positives or missed attacks occur in the first month, we adjust the bots for free.
Contact us for a detailed estimate — we will assess your project in one day. We can show configuration examples for protocols with TVL over $10M. Our team has 10+ years in blockchain security, and each engineer has personally written Forta bots and configured Defender in production. Order monitoring setup now.