If you have ever stared at a MetaMask popup showing a string of hexadecimal gibberish and just clicked "Confirm" out of fear or fatigue, you are the target audience for Wallet Firewall. This new pre-signing security layer for EVM wallets, built by developer superwavvy, intercepts transactions before they hit the blockchain. Instead of letting users guess what a function selector means, the tool decodes the payload, simulates the execution, and assigns a deterministic risk score. It forces a verdict of SAFE, REVIEW, or BLOCK, ensuring that you know exactly why a transaction is dangerous before your funds vanish.

Architecture and Deterministic Safety

The core philosophy here is that AI should explain, not decide. Wallet Firewall uses a deterministic risk engine with hardcoded HARD_BLOCK signals and a 0-100 scoring system to make the final call. This is crucial for security tools, where non-deterministic LLM hallucinations could lead to catastrophic false negatives. The system employs a six-stage pipeline: Decode, Intel, Simulate, Score, Explain, and Gate. It fetches contract bytecode and nonce data, runs an eth_call simulation to catch reverts early, and only then uses an LLM to translate the technical findings into plain English. If the verdict is BLOCK, the sign button is physically disabled, preventing the mistake entirely.

Built on Open Standards and Termux

What makes this project particularly interesting for indie builders is its stack and development environment. The application is built with Next.js, wagmi, viem, and TypeScript, leveraging the open nature of EVM to decode raw calldata without relying on expensive, closed-source enterprise APIs. The developer built the entire project on an Android device using Termux, utilizing AI agents as pair programmers to handle tasks like debugging Webpack vs. Turbopack errors on ARM64. For the AI explanation layer, the tool uses Groq to run open-weight models like gpt-oss-120b, keeping costs low enough to remain a free or indie-friendly security tool.

Key Takeaways

  • The tool provides three clear verdicts: SAFE, REVIEW, or BLOCK, with plain-language explanations for each.
  • Risk scoring is deterministic (0-100) to avoid LLM hallucinations in critical security decisions.
  • Unlimited ERC20 approvals are hard-blocked with a score of 100/100, addressing a common drain vector.
  • The entire stack was developed on a mobile phone using Termux and AI agents, proving indie scalability.

The Bottom Line

Blind signing is a UX failure that has cost the ecosystem billions, and Wallet Firewall proves that deterministic simulation is the only way to fix it. Stop trusting your gut and start trusting the eth_call.