Once a provider is active for your organization, Fordefi screens each transaction with it and displays the findings alongside those from Fordefi's own risk engine.
Screening results appear wherever transaction risks appear:
- Transaction creation: In the browser extension and in the web console, before you create the transaction. See Understand alerts and warnings.
- Review swap: On the Review Swap screen in the web console.
- Transaction details: In the Risks tab of the transaction details panel, in the web console and in the mobile app.
- Transaction history: Recorded with the transaction, so approvers and reviewers see the same risks that the initiator saw.
Every risk displays:
- Source: Whether the risk came from Fordefi's risk engine or from a provider, with the provider's logo.
- Severity: The severity as the provider itself reports it, so that what you see in Fordefi matches what you see in the provider's own dashboard and logs.
- Title: A short name for the risk.
- Description: A fuller explanation of what was found.
Risks are ordered by severity, highest first.
Each provider uses its own severity vocabulary. Fordefi displays the provider's value and maps it to one of its two risk levels, which determine how the risk is presented:
| Provider | Provider severity | Displayed as | Fordefi risk level |
|---|---|---|---|
| Blockaid | Malicious | Malicious | High — red, full-page warning |
| Blockaid | Warning | Warning | Low — yellow banner |
| Hypernative | deny | Deny | High — red, full-page warning |
| Hypernative | warn | Warn | Low — yellow banner |
High-severity risks block the transaction screen and color it red; you can cancel the transaction or proceed at your own risk. Low-severity risks appear in a yellow banner. This is the same behavior as for Fordefi's own risks.
Results that a provider considers clean — Blockaid Benign, Hypernative accept and autoAccept — do not generate risks.
| Situation | What you see | Effect on policy |
|---|---|---|
| The chain type is not supported by the provider | Shown as not screened, without an alert | The Risk condition does not match, and policy evaluation continues to the next rule |
| The provider returned an unsupported-chain error, for example on an unsupported EVM chain | Shown as not screened, without an alert | The Risk condition does not match, and policy evaluation continues to the next rule |
| The provider timed out or returned a malformed response | Shown clearly as a timeout or error | The result is indeterminate, and Fordefi falls back to the default policy rule |
| Provider error | Shown clearly as an error | The result is indeterminate, and Fordefi falls back to the default policy rule |
Because an unavailable provider falls back to the default policy rule, we recommend setting a strict default rule, such as requiring multiple approvers.
For each provider that screened the transaction, Fordefi also stores the relevant part of the provider's raw response and displays it as formatted JSON. Use it when you need the provider's own identifiers — for example a Hypernative assessment ID or a Blockaid feature ID — to look the screening up on the provider's platform. See Transaction screening in the API for the fields included.
Learn more: