Tenderly Alerting Setup: Smart Contract Monitoring and Alerts

A production contract without monitoring is risky. You learn about issues from Twitter, not from an alert.

One DeFi protocol lost $50k due to an unnoticed flash loan attack — after setting up Tenderly Alerting, they receive a Telegram notification within 2 seconds. Our team of 5 Web3 engineers helps you configure Tenderly Alerting in 1.5 hours on average. We have 5+ years in Web3 and have completed over 20 contract monitoring projects. We guarantee that no anomalous withdrawal or owner change goes unnoticed.

Tenderly solves the key challenge: informing your team about on-chain changes without building your own indexer. The setup cost is $500, which is less than one hour of a DevOps engineer's time. Infrastructure savings compared to a custom indexer can reach 70%. You pay only for configuration — the Tenderly service itself is billed separately, but its cost is offset by the first prevented incident.

How Tenderly simplifies smart contract monitoring

You receive alerts for specific contract events, storage variable changes, transactions above a threshold, calls to specific functions, and failed transactions. No need to write your own indexer. The main trigger types are:

Consider a real-world case: for a vault contract (ERC-4626), we configured alerts on the Withdraw event with amount > $10k, on setAdmin calls, on vault balance changes exceeding 1% per block, and on gas spikes above 200 gwei. As a result, the team learns about risks instantly — for example, an attempted oracle manipulation or unauthorized access. Such a configuration takes no more than 2 hours, including testing.

Tenderly Alerting can be set up 10 times faster than writing a custom indexer on The Graph. For critical events, we use Telegram or PagerDuty with immediate delivery; for informational ones, a Slack channel.

What's included in the setup

• Adding contracts (ABI + address + network) to Tenderly
• Configuring triggers according to your business logic: thresholds, functions, events
• Integrating notification channels: Telegram, Slack, PagerDuty, email, webhook
• Setting up webhooks for custom processing (auto-pause, database logging)
• Testing and documentation for your team
• Recommendations for optimizing alerts and avoiding false positives (we filter out up to 95% of noise)

Setup steps

1. Add your contract to Tenderly (ABI + address + network)
2. Go to Alerts → Add Alert → select trigger type
3. Configure filters (e.g., value > 100000e6 for USDC)
4. Choose destination: Slack, Telegram, PagerDuty, webhook, email

For critical events (pause, owner change, anomalous withdrawals) — Telegram/PagerDuty with immediate delivery. For informational ones (regular transactions, protocol events) — a Slack channel for the team.

Comparison of notification channels

Webhook integration

Tenderly can send a webhook POST request with transaction details. This enables custom logic: auto-pause the contract on anomaly, log to database, send enriched notifications.

{
  "id": "alert_id",
  "contract": "0x...",
  "network": "1",
  "transaction": {
    "hash": "0x...",
    "from": "0x...",
    "value": "1000000000000000000"
  },
  "trigger": "successful_transaction"
}

Limitations

Tenderly is a managed service. For full control and data privacy, consider alternatives: a custom indexer on The Graph, Goldsky, or OpenZeppelin Defender Sentinel (more flexible trigger engine). For most projects, Tenderly Alerting offers the best balance of setup speed and functionality. Basic monitoring setup takes 1 business day, including team documentation.

Contact us to discuss your project — we will assess the complexity and propose the optimal solution. Order Tenderly Alerting setup and eliminate the risk of missing a critical event. With 5+ years of Web3 experience and over 20 projects, we ensure reliable monitoring. Get a free consultation on monitoring.

Smart Contract Development

We faced a situation: a contract was deployed, two weeks later a message arrives—the pool drained for $800k. Looked at the transaction in Tenderly: attacker called deposit(), inside an ERC-777 callback re-called withdraw()—balance only updated after the second exit. Classic reentrancy, but not via ETH transfer—through an ERC-777 hook. ReentrancyGuard was only on withdraw().

Such cases are not rare. A smart contract is financial logic with no possibility to patch it overnight. Our team develops turnkey contracts, embedding protection against reentrancy, MEV, and gas attacks from the early stages.

How We Develop Smart Contracts Turnkey

We start with business logic audit and stack selection. Solidity 0.8.x is the standard for EVM-compatible chains: Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche C-Chain. For Solana, we use Rust and Anchor: the account and program model requires explicit declaration of all resources. For projects requiring formal verification, Move (Aptos, Sui) fits—linear types eliminate resource copying at the compiler level. Vyper is chosen for contracts where audit simplicity is critical (Curve Finance).

Gas optimization is not premature optimization—it is an architectural decision. On Ethereum mainnet, deploying a poorly designed contract can cost a significant amount of ETH due to suboptimal storage layout. Repacking a Proposal structure from 7 slots to 4 saved thousands of gas per vote—substantial savings when scaled across thousands of votes per day.

Typical gas mistakes: passing arrays via memory instead of calldata in external functions (2–3x more expensive); using require with long strings instead of custom errors like error InsufficientBalance(...). Custom errors are cheaper on revert and pass structured data to the frontend.

Why Smart Contract Audit Is Critical for Security

Audit is not a one-time check—it is a built-in development stage. We use three levels:

1. Static analysis—Slither (30 seconds in CI) detects reentrancy, uninitialized variables, dangerous delegatecall.
2. Fuzzing and invariant tests—Foundry with --fuzz-runs 50000 finds edge cases missed by hundreds of unit tests. Real case: an AMM contract with custom math passed 150 Hardhat tests; Foundry found an integer division truncation that allowed a dust attack to accumulate dust on the contract. Echidna checks invariants ("sum of all balances ≤ totalSupply").
3. Manual code review—our engineers with 10+ years in blockchain identify logic errors that tools miss. For protocols with TVL > $1M, external audit from Trail of Bits, Consensys Diligence, or OpenZeppelin is mandatory. Timeline: 2–4 weeks.

Any upgradeable protocol must have a timelock. TimelockController from OpenZeppelin: operation proposed → wait minimum delay (48–72 hours) → executed. Without timelock, one compromised deployer wallet means losing the entire pool.

What Upgrade Patterns Do We Choose?

Storage collision is the main danger of proxies. Implementation v2 must not add variables before existing ones. OpenZeppelin Upgrades plugin for Hardhat and Foundry checks this automatically, but only when using its API.

How to Protect a Contract from MEV and Front-Running

On Ethereum mainnet, transactions in the mempool are visible to all. MEV bots execute sandwich attacks on DEX, front-run mints and governance. Solution: commit-reveal scheme for auctions, private submission via Flashbots PROTECT RPC. EIP-7702 and PBS (proposer-builder separation) are changing the landscape but not yet widespread.

What Is the Development Process?

1. Analysis—functional specification, call diagram, edge case analysis. Without this, coding starts in vain.
2. Development—Solidity/Rust with tests in parallel. Test → code → refactoring. Use Foundry for fuzz and invariant tests.
3. Internal audit—Slither + Echidna + manual code review. Foundry invariant tests for protocol invariants.
4. External audit—for projects with real money. Timeline: 2–4 weeks.
5. Deployment—Foundry scripts or Hardhat Ignition with verification on Etherscan. Gnosis Safe for ownership transfer immediately after deployment.
6. Monitoring—Tenderly alerts, OpenZeppelin Defender, Forta Network.

What Is Included

• Architecture documentation and contract specification (NatSpec).
• Source code with repository and CI (Slither, Foundry, coverage).
• Deployed contract with verification on blockchain explorer.
• Audit results (internal and external upon request).
• Access to monitoring and management (Gnosis Safe).
• Code warranty: critical bug fixes within one month after deployment.
• Consultation on web integration (wagmi, RainbowKit).

Estimated Timelines

• ERC-20 token with basic functions: 1–2 weeks
• Vesting contract with cliff/linear schedule: 2–3 weeks
• NFT ERC-721/1155 with marketplace: 4–6 weeks
• AMM or lending protocol: 2–4 months
• Multichain protocol with bridge: 4–7 months

Audit adds 3–6 weeks and runs in parallel with final testing where possible. Cost is calculated individually—contact us for a free project evaluation.

Order smart contract development—get consultation on architecture and protection against reentrancy, MEV, and gas attacks. Want to discuss details? Write to us—we will select the optimal stack for your task.