How to Evaluate Onchain Monitoring Vendors: A Scorecard

By Ashkan KhamsehpourPublished November 11, 20269 min read

Quick answer. Map the vendor's detections to your own contracts, roles and dependencies. Replay labeled attacks and benign changes to measure misses and false positives. Confirm who can pause and who answers at 3am, verify each chain by address, then score with evidence and knockouts.

Watch: How to Evaluate Onchain Monitoring Vendors: A Scorecard 1:44

Video transcript

Monitoring vendors publish chain counts and features. Each is a claim to test before you sign. Guardian publishes this scorecard and sells managed monitoring.

Hypernative, for example, advertises 75-plus chains. That is self-reported, so verify coverage by deployment address.

Start from your estate, not the feature list. Ask for a named detection on each privileged role, upgrade path, multisig, oracle and bridge, and abnormal outflow.

In Guardian's public RAAC audit, a liquidation event reported zero collateral after the collateral moved. Rated Low and resolved, it shows why event-only monitors can record the wrong amount.

Vendor false positive rates need a denominator. Replay a labeled set of attacks, benign admin changes and RPC failures on a fork. Record precision, recall and time to detect.

Detection without authority is a notification. Can the vendor page staff, submit a pre-authorized transaction, pause through a scoped role, or block before execution? Who acts at three in the morning?

Weight five areas out of 100. Score each test two if proven on your estate, one if documented, zero if only claimed. Knockouts override any total.

Score in-house and managed options on the same sheet. Guardian Managed Security pairs custom contract monitoring with round-the-clock engineer response. Ask Guardian for that evidence too.

Read the full article for every sub-test and evidence request, or talk to Guardian about Managed Security.

Why Score Vendors

Monitoring vendors publish chain counts, risk types and response features. Each is a claim you can test before you sign.

Vendor figures are self-reported. Hypernative, for example, advertises monitoring across 75+ chains and 300+ risk types. Hypernative

Guardian publishes this scorecard and sells Managed Security, a managed monitoring and response service. Guardian

Our smart contract monitoring tools comparison ranks named products. This article gives the method to score any vendor, including ones that list leaves out.

For institutional risk teams, ADGM FSRA's Consultation Paper No. 5 of 2026 is proposed guidance for ADGM Authorised Persons and Recognised Bodies that engage with DeFi. Comments close November 30, 2026. ADGM FSRA

The draft says firms using third-party monitoring tools should understand their methodology, coverage and limitations, and interpret outputs rather than rely on raw alerts. A scorecard puts that understanding in writing.

Our guide to ADGM's draft monitoring guidance maps its monitoring areas.

Detection Coverage

Start from your estate, not the vendor's feature list. Inventory every contract, role, multisig, dependency and offchain asset you need watched.

Ask the vendor to map a named detection to each item, on your addresses.

Know where each detection runs. Post-block alerts report what already landed; pre-execution screening can stop a transaction first.

Forta Firewall, for example, screens transactions before sequencer inclusion, using simulations and detection models. It protects you only on rollups that integrate it. Forta

Score custom rules for your own logic, not only generic exploit signatures. OpenZeppelin Monitor, for instance, watches the onchain conditions you configure. OpenZeppelin

For what each signal means, see what onchain monitoring watches. Then check the vendor covers each one:

Privileged roles, ownership transfers and admin key changes
Proxy upgrades, timelock queues and changes to timelock delays
Multisig signer, threshold, module and guard changes
Oracle feeds, bridges and integrated protocols you depend on
Governance proposals, votes and use of emergency powers
Abnormal outflows from vaults, treasuries and hot wallets
Mempool or pre-execution activity, where the chain exposes it
Signing paths and offchain assets: domains, DNS, cloud and code host

Alert Quality and False Positives

Hypernative advertises a false-positive rate below 0.001%. A rate means little without its denominator: ask what was counted, over which period, on which contracts. Hypernative

Add an event versus state test. In Guardian's public audit of RAAC's core contracts, the LiquidationFinalized event reported zero ERC20 collateral after the collateral was transferred. Guardian

Guardian rated it Low, with no direct fund loss shown, and the report lists it as resolved. Before the fix, indexers and monitors reading only the event would have recorded the wrong amount.

Replay a similar case on a fork. A strong vendor compares events with storage and token transfers, and alerts on the mismatch.

Build your own labeled replay set. Include true attacks, benign admin changes and chain or RPC failures.

Run it against each vendor on a fork or historical blocks. Record results in the same format for all of them:

Precision: the share of alerts that were real
Recall: the share of labeled attacks that raised an alert
Time to detect, from the first malicious transaction
Duplicate alerts per incident
Suppression rules, and who can change them
Evidence per alert: transaction, decoded call, state diff and severity reason

Response and Pause Authority

Detection without authority is a notification. Score what the vendor can actually do when an alert fires.

Hypernative advertises automated pauses and other responses. Ask how a false positive that pauses your protocol is reversed, and how fast. Hypernative

Then name the person who acts at 3am. Ask for the rota, time zones and backups, not a support inbox.

Each delegated role is a key to guard, and a pre-signed transaction is itself a key: limit it to a pause, never admin transfers or fund moves. Our emergency pause design guide covers pause scope and who should unpause.

If the responder is a managed team, our guide to Web3 MDR sets out what its SLA should define.

Who holds each key, role or Safe module the vendor uses?
Which actions run automatically, and who approved them in writing?
When was the pause path last run on a fork?
Who can unpause, and how long does it take?
What is the escalation order, and how is a signer reached overnight?

Authority level	What it does	Evidence to ask for
Page only	Alerts your on-call staff	Paging test, escalation list, acknowledgment times
Pre-authorized transaction	Submits a transaction you approved in advance	Pause-only scope, expiry, fork test, revocation path
Scoped pause role	Pauses through a narrow role or Safe module	Role address, pause scope, fork test, unpause path
Pre-execution block	Flags or blocks a transaction before it lands	Integration on your chain, policy, override process

Chain and Asset Coverage

Verify coverage by deployment address, not by chain logo. Detections and actions can differ from one chain to the next.

OpenZeppelin Monitor names EVM networks, Stellar and Solana, with Midnight partially supported. Hypernative describes monitoring across all major L1 and L2 networks 'with consistent detection, alerting, and response coverage'; ask it to show that on each chain you run. OpenZeppelin, Hypernative

Score resilience in the same pass. OpenZeppelin's repository warns that performance depends on network congestion and RPC reliability, and documents missed-block recovery limits.

Ask every vendor for uptime, block-head lag, RPC provider diversity and replay limits, with the date of its last failover test. For a self-hosted tool, cut an RPC on purpose and watch what happens.

Check the exit path: your rules and alert history should export in a format you can run elsewhere.

ADGM's draft asks firms to record each provider's resilience and substitutability. ADGM FSRA

Every deployment address, on every chain you run
Token standards you hold or issue
Bridge and oracle dependencies on each chain
Finality assumptions and reorg handling
Which detections and automated actions work on each chain

The Scorecard

Score each sub-test 0, 1 or 2. Every point needs evidence: a test result, a document or a named person.

Award 2 when tested on your estate with evidence, 1 when documented but untested, and 0 when claimed only or missing.

An area's score is its points earned divided by points possible, times its weight.

Apply knockouts before comparing totals. A high score cannot offset a knockout.

Score in-house and managed options on the same sheet. A self-hosted tool scores zero on response until your own rota is named.

Write the evidence into the contract: scope, SLA, delegated authority, escalation contacts and termination. Our vendor due diligence questionnaire covers the wider company review.

Area	Weight (of 100)	Sub-tests	Knockout
Detection coverage	30	Estate mapping, custom rules, pre-execution coverage	No detection on a critical contract
Alert quality	20	Precision, recall, time to detect, alert evidence, event versus state test	Refuses a replay test
Response and 3am model	25	Authority level, named responder, fork-tested pause	No named responder or untested pause authority
Chain and asset coverage	15	Addresses, dependencies, finality on each chain	Missing a critical chain
Resilience and portability	10	Uptime, RPC failover, replay limits, export	No export of rules or alerts

Where Guardian Fits

Guardian states Managed Security monitors contracts on every block, with customized monitors, and lists exploit contracts caught and paused onchain. Ask which authority level and role that pausing uses on your contracts. Guardian

Offchain, Sentry watches domains, DNS, certificates, cloud and code host. When something fires, a Guardian engineer responds, around the clock.

Its security operations team reviews every multisig transaction before it is signed. Score it on the same sheet, and ask Guardian for the same evidence.

Frequently Asked Questions

Is a self-hosted monitor a cheaper alternative to a vendor?

It has no license fee: OpenZeppelin Monitor is open source under AGPL-3.0. You still pay for servers, RPC endpoints and a 24/7 rota, so cost that rota before comparing. OpenZeppelin

Does ADGM's draft guidance require a monitoring vendor?

No. The draft does not require a vendor. Where firms use one, it keeps responsibility with the firm and asks it to record the provider's functions, location and contractual rights. Ask counsel how this applies to you. ADGM FSRA

How should I run a monitoring proof of concept?

Agree pass and fail criteria in writing first. Run it read-only for a fixed period, with no pause role granted. Send one unannounced test page out of hours and time the reply.

Sources

Need someone to act on the 3am alert?

Guardian Managed Security pairs contract monitoring built from your estate with engineer response around the clock. Score it against your shortlist with the same evidence.

Talk to Guardian Explore the service