Firewall: Proactive On-Chain Protection With Extractor by Hacken‍

Introducing Firewall, a core protection layer within Extractor by Hacken, designed to help teams detect and stop exploits before real losses occur.

Instead of reacting after funds are drained, Firewall enforces rule-based controls directly on-chain. At its core, Firewall allows teams to define what is allowed, what is restricted, and what should never happen in their contracts.

Key Firewall Capabilities

Firewall operates through modular, rule-based protections, each designed to address a specific risk vector commonly exploited in Web3 attacks. Every rule is enforced on-chain and paired with real-time alerts, so teams can act before the incident.

‍

Allow List (Authorized Access Control)

What it does

The Allow List manages who can interact with your smart contract by maintaining an approved set of addresses. Only addresses explicitly added to the list can call protected functions.

Think of it as a VIP list for your smart contract. If an address isn’t on the list, it doesn’t get through.

What Firewall monitors

• Updates to the allow list (addresses added or removed)
• Interaction attempts from unauthorized addresses

When you get alerts

• When the allow list is updated
• When a non-authorized address attempts to interact with the contract

Why this matters
Allow Lists help you control exactly who can use your contract. This is especially useful for private or staged launches, trusted partner integrations, and admin-only or operator-restricted functionality. Many exploits start with unexpected callers, and this rule limits access to verified, intended actors only.

Withdrawal Limit (TVL Protection)

What it does

Withdrawal Limit rules protect your smart contract by enforcing maximum withdrawal thresholds, limiting how much value can leave the contract under defined conditions. This acts as a hard safety boundary against sudden or abnormal fund outflows.

What Firewall monitors

• Changes to withdrawal limits
• Attempts to withdraw more than allowed
• Enabling or disabling of withdrawal protection

When you get alerts

• When withdrawal rules are updated
• When an excessive withdrawal attempt is blocked
• When withdrawal protection is turned on or off

Why this matters
Withdrawal limits are a first line of defense against attackers trying to drain funds. They reduce the blast radius of an attack and give teams time to react, even if another control is bypassed.

Transfer Limit

What it does
Transfer Limit rules control how much value can move into or out of your contract, based on token, direction, and amount. These limits define what “normal” looks like and prevent unusually large transfers.

What Firewall monitors

• Changes to transfer limits
• Attempts to transfer more than allowed
• Enabling or disabling of transfer protection

When you get alerts

• When transfer limits are modified
• When transfer protection is turned on or off
• When a transfer exceeds the allowed amount

Why this matters
Large or unexpected transfers are often a signal of compromised keys, privilege abuse, or exploitation in progress. Transfer limits slow attackers down and give teams time to detect and stop malicious activity.

Deny List (Blocked Addresses)

What it does

The Deny List maintains a list of addresses that are explicitly blocked from interacting with your contract. Once an address is flagged, Firewall ensures it stays out.

What Firewall monitors

• Updates to the deny list
• Interaction attempts from blocked addresses

When you get alerts

• When addresses are added to or removed from the deny list
• When a denied address attempts to access the contract

Why this matters
After incidents, investigations, or threat intelligence updates, teams need a reliable way to enforce exclusions on-chain. Deny Lists help proactively block known scammers, hackers, or problematic addresses and prevent repeat abuse.

How Firewall Is Integrated

Firewall is not a separate product bolted onto your protocol. It’s designed to integrate directly into smart contracts, with two supported models, and Extractor includes the full Firewall setup as part of the subscription. No additional tooling, infrastructure, or integration overhead is required.

Two Integration Options

Firewall supports two integration models. Inheritance embeds protection directly into the contract, giving native modifiers, lower gas costs, and cleaner syntax, at the cost of tighter coupling and more careful upgrades.

Composition enforces rules via an external Firewall contract, offering looser coupling, easier upgrades, and multi-contract reuse, with slightly higher gas costs. The Inheritance option is usually chosen for core contracts, composition for flexibility.

What Actually Enforces the Rules

Regardless of how Firewall is integrated, it enforces the same four rules through modular extensions covering access control, transfer limits, and withdrawal limits. Each extension manages its own rules per contract, supports adding or removing them individually or in batches, and applies checks via standardized modifiers or calls. A shared role-access layer gates all rule changes, keeping enforcement explicit, scoped, and consistent across contracts.

Granular Rule Control

Every monitored contract can enable or disable specific Firewall rules independently. This per-contract configuration allows you to:

• Apply stricter rules to high-risk contracts while keeping others unrestricted
• Stage security rollouts gradually across your protocol
• Quickly disable specific rules during incident response without affecting others
• Tailor protection to each contract's unique risk profile

Strengthen Your On-Chain Security With Extractor

Firewall turns a small set of clear rules into real, on-chain protection. You enable what you need, define who and what is allowed, and let enforcement run automatically on every relevant call, without redeployments or operational overhead. If you want to see how Extractor by Hacken applies this in practice, try it out and book a free 30-minute demo to see Firewall in action.

‍

‍