Contract Watch: know when the contracts you depend on change
Quick Answer
Contract Watch takes a snapshot of an address's security state and compares it every 5 minutes: implementation, admin, owner, pause flag, Safe signers and threshold, EIP-7702 delegation, and balances.
Any difference becomes an email and a dashboard alert with the before and after values. When a proxy is upgraded, we also scan the new code and compare it with the old version.
Free for one address with no setup. Pro watches up to 10 and adds an AI review of new code after every upgrade.
What it checks
These are the changes that come before most admin-key exploits and rug pulls. Each one is read straight from the chain, not from an indexer.
Code upgrades
When an upgradeable proxy points at new code, you get an email, and we fetch the new implementation from Etherscan and scan it. We read the storage slot directly, so an upgrade that skips the Upgraded event still shows up.
Owner and admin changes
owner(), the EIP-1967 proxy admin, and the number of accounts holding the default admin role. Whoever holds these can change the rules, so a move is worth knowing about within minutes.
Safe multisig changes
Signers added or removed, the threshold lowered, a module or guard installed, or the Safe's core code swapped. That last one is the change behind Bybit's $1.5B loss in February 2025.
EIP-7702 delegations
Since Ethereum's Pectra upgrade, an ordinary wallet can hand control to contract code with one signed authorization. We alert when a watched wallet's delegation appears, changes or disappears.
Large balance drops
ETH, BNB or POL plus the major stablecoins and wrapped assets on each chain. You pick the threshold (10–75% in one check), and small moves under about $1–2k never alert.
Pauses
A contract that suddenly pauses is often a team responding to an incident. You hear about it at the same time they do.
How it works
1
Paste an address
A contract, a proxy, a Safe or a plain wallet on Ethereum, BNB Chain, Polygon, Arbitrum or Optimism. We work out which kind it is and take a first snapshot of its state.
2
We compare every 5 minutes
Each check reads the same state again and compares it with the last snapshot. Every check is logged, so the dashboard shows a 24-hour heartbeat proving it actually ran.
3
You get the change, not noise
One email per address per check, with before and after values and a link to the transaction. Balance alerts are capped at one per token per hour so a busy wallet can't bury you.
A real example: Binance 14, October 29–30, 2026
To be clear about what this shows: we didn't catch the Binance drain. We added the wallet as a test hours afterwards. What Contract Watch did record is the kind of change it exists to catch, a hot wallet whose code had been swapped, and the moment that was undone. Times are UTC.
20:20:59Delegation installed
One transaction from the attacker's address carried 50 EIP-7702 authorizations pointing Binance 14 at the attacker's contract 0x63e8…6fae.
The delegation was live for 3 hours 49 minutes. Binance has not published its post-mortem; its interim statements point to a compromised DevOps engineer's laptop and say no private key leaked.
–It checks every 5 minutes. In the Binance case the drain came 3 minutes 24 seconds after the delegation, so a 5-minute check could have alerted just before the money moved or just after.
–Alerts go to email and the dashboard. Slack, Telegram and webhooks aren't built yet.
–The checks are fixed. You can't write custom rules for specific events or function calls the way you can with a self-hosted monitor.
–It tells you, it doesn't act. There are no automatic pauses or transactions.
–Five EVM chains for now. No Solana, Base or other L2s yet.
Plans
Free: 1 address, every check, email alerts, a scan of the code behind it.
Pro: up to 10 addresses, and an AI review of the new code every time a watched contract is upgraded.
No. It tells you when the security-relevant state of an address changes, usually within 5 minutes. Prevention is withdrawal limits, timelocks on upgrades, multisigs with sensible thresholds, and keeping signing keys away from systems that can be compromised. Monitoring is the smoke alarm: it buys you time to act and tells you exactly what changed.
How fast are the alerts?
Checks run every 5 minutes, so a change shows up within about 5 minutes plus email delivery. The email names the change, shows the before and after values, and links the transaction when Etherscan has indexed it.
Which chains does it support?
Ethereum, BNB Chain, Polygon, Arbitrum and Optimism. Balance tracking covers the native coin plus the main stablecoins and wrapped BTC/ETH on each chain.
Can I watch a contract I don't own?
Yes. Everything it reads is public on-chain state. Plenty of people watch the protocols they have deposits in, or the token contracts they hold, so they hear about an upgrade or an ownership change before it shows up on social media.
What happens when a contract is upgraded?
You get an alert right away. Then we fetch the new implementation's verified source from Etherscan, scan it (with an AI review on Pro), and send a second email comparing its findings with the previous version. If the new code isn't verified, we tell you that too, because unreadable new code is a red flag on its own.
Is this a replacement for OpenZeppelin Defender?
Partly. OpenZeppelin retired Defender's hosted service on July 1, 2026. Contract Watch covers the most common monitoring jobs (upgrades, ownership, Safe changes, balances) without anything to host. It doesn't do custom rules, relaying or automated actions. There's a full comparison on our Defender alternative page.
Written by Duron Epps, Founder · Last updated October 2026