What I Built

Wallet Firewall is a pre-signing transaction security layer for EVM wallets.

Every day, people lose funds because they blindly sign transactions they don't understand. A MetaMask popup shows a scary hex string, and the user just clicks "Confirm."

Wallet Firewall solves this, before you sign, it decodes the transaction, checks the contract, and scores the risk. It returns one of three verdicts: SAFE, REVIEW, or BLOCK. Each verdict comes with a plain-language explanation, so you know exactly why a transaction is dangerous before your funds leave your wallet.

Code

superwavvy / Wallet-Firewall

Deterministic risk engine for EVM transactions. Know what you're signing before you sign it.

🧱 Wallet Firewall

Know what you're signing before you sign it.

A deterministic security layer that analyzes EVM transactions before the user signs them. Decodes, simulates, scores, and explains — with a verdict of SAFE, REVIEW, or BLOCK.

What It Does

Stage	Description
Decode	Extracts function selectors and maps them to signatures
Intel	Fetches bytecode, balance, nonce of the target address
Simulate	Runs `eth_call` to catch reverts before signing
Score	Deterministic risk engine (0-100) with hard blocks
Explain	LLM translates findings to plain English (never overrides verdict)
Gate	Disables the sign button when verdict is BLOCK

Screenshots

Standard ETH transfer — scored SAFE (5/100).

Multicall detected — scored REVIEW (30/100).

Unlimited ERC20 approval — hard blocked (100/100).

ERC20 approval — flagged for review.

Architecture

Wallet -> Transaction -> Decoder -> Contract Intel -> Simulation
   -> Asset/Permission Analysis -> Deterministic Risk Engine
   -> AI Explanation -> SAFE /

…

View on GitHub

How I Built It

The stack is Next.js, wagmi, viem, and TypeScript.

The AI Part: Security tools cannot rely on LLMs to make final decisions, because LLMs hallucinate and are non-deterministic. Wallet Firewall uses a deterministic risk engine (hardcoded HARD_BLOCK signals and a 0-100 scoring system) to give the final say.

The Groq LLM is only used for the explanation layer. Once the deterministic engine flags a transaction, the LLM translates the bytecode and state changes into plain English so the user understands the threat. AI explains; the deterministic engine decides.

Why Does Open Innovation Matter?

Open-source AI and open protocols made this possible because EVM (Ethereum) is an open standard, I can use viem and wagmi to decode raw calldata without paying for a closed enterprise API.

For the AI layer, using Groq (which runs open-weight models like gpt-oss-120b) allowed me to build this on a mobile phone in Termux without blowing through a massive API budget. A closed, expensive API would have made a free/indie security tool impossible to build.

DEV Community

Wallet Firewall: A Pre-Signing Security Layer for EVM Wallets