Watcher
Your wallet gets one more chance before suspicious withdrawals become irreversible.
Demo
About
Watcher is a self-custody security protocol for EVM wallets that detects suspicious withdrawal behavior and creates a reaction window before funds leave the wallet. Every withdrawal is evaluated on-chain against behavioral security rules. Large withdrawals, probe transaction patterns, and slow-drain attacks are automatically placed into a Security Queue instead of executing immediately. During the delay window, users can cancel the withdrawal, activate Containment Mode to freeze the vault, or instantly recover funds to a pre-registered Trusted Recovery Address. The smart contract itself enforces security.
How it's made
Watcher is built in Solidity, with the protocol deployed on Ethereum Sepolia. The core architecture is a per-user smart vault that maintains isolated balances, pending withdrawals, recovery addresses, and security state for every wallet. The Security Engine evaluates each withdrawal against the behavioral rules. Recovery features are implemented entirely on-chain. Trusted Recovery Address changes require a delayed confirmation flow, while Containment Mode freezes vault activity and cancels pending withdrawals when activated. Watcher also supports optional Ledger hardware authorization using OpenZeppelin ECDSA signature verification, requiring a valid hardware wallet signature before executing flagged withdrawals. The protocol includes tests covering attack scenarios, edge cases, and state transitions, along with integration tests validating the complete recovery workflow.