Skip to content
CERQAVAJoin waitlist
Coming soonEVM first

Know what you sign.

CERQAVA is the pre-signing security API we're building for wallets and dApps. It decodes every transaction, checks who's on the other side, previews the outcome — and tells you exactly what it couldn't verify.

One email when the beta opens. Nothing else.

  • Never touches your keys
  • Evidence for every finding
  • Wallet-agnostic API
  • Unlimited ERC-20 approvals
  • NFT operator grants
  • Known malicious spenders
  • Phishing origins
  • Hidden token outflows
  • Permit & Permit2 signatures
  • EIP-712 typed data
  • EIP-7702 delegations
  • Unknown calldata

The problem

Wallets ask people to sign things they can't read. One line of calldata can quietly hand a stranger unlimited access to your tokens. You deserve to see that before you sign — not after.

How it works

From hex to human — in one API call.

Send an unsigned transaction. Get back what it does, who it touches, what it is predicted to change — and how much of that was actually verified.

01

Decode

Calldata becomes a readable action — who gets what, and how much. Unknown selectors stay unknown. Never guessed.

POST /v1/scans/evm/transaction

transaction.data

0x095ea7b30000000000000000000000003333333333333333333333333333333333333333ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

schema 1.0.0 · ruleset 1.0.0Decode

02

Reputation

Targets, spenders and origins are matched against reviewed threat intelligence. Every flag carries its source and evidence.

POST /v1/scans/evm/transaction

transaction.data

0x095ea7b30000000000000000000000003333333333333333333333333333333333333333ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

schema 1.0.0 · ruleset 1.0.0Reputation

03

Simulate

Balance and allowance changes are previewed at a pinned block. A prediction at a known state — and labelled as one.

POST /v1/scans/evm/transaction

transaction.data

0x095ea7b30000000000000000000000003333333333333333333333333333333333333333ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

schema 1.0.0 · ruleset 1.0.0Simulate

04

Verdict

Findings, evidence and per-analyzer coverage. If a check failed, you see it — an empty report is never dressed up as “safe”.

POST /v1/scans/evm/transaction

transaction.data

0x095ea7b30000000000000000000000003333333333333333333333333333333333333333ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

schema 1.0.0 · ruleset 1.0.0Verdict

Principles

Honest by design. Built for people who read the fine print.

Security tools fail quietly when they pretend to know more than they do. CERQAVA is built around the opposite idea.

01 · No fake “safe”

There is no green checkmark here.

Four verdicts, each with a precise meaning. An empty findings list with incomplete coverage is reported as exactly that.

Nothing matched in the checks that completed. Not a guarantee — and we never say it is.

02 · Zero custody

Never touches your keys.

  • No seed phrases or private keys
  • No signing, no broadcasting
  • Unsigned payloads only

03 · Evidence

Receipts, not vibes.

Every finding names its rule, version, source and review state.

{
  "ruleId": "EVM_KNOWN_MALICIOUS_SPENDER",
  "severity": "critical",
  "evidence": {
    "source": "reviewed-feed",
    "status": "confirmed",
    "lastReviewed": "2026-…"
  }
}

04 · Coverage

See what wasn’t checked.

Each analyzer reports its own status. Feed down? RPC slow? It shows.

decodingcompleted
reputationpartial
simulationtimed_out

status → completed_with_limitations

05 · Reproducible

Versioned everything.

Findings tie back to a rule version and ruleset revision, tested against labelled benign and malicious fixtures.

schemav1.0.0
rulesetv1.0.0
analyzerv1.0.0

06 · API-first

One endpoint. Any wallet. Any dApp.

Vendor-independent by design — no privileged integration with any single wallet. A stable, versioned JSON schema your team can build policy on.

request · preview
curl -X POST $CERQAVA_API/v1/scans/evm/transaction \
  -H "Authorization: Bearer $API_KEY" \
  -d '{ "chainId": 1, "transaction": { … } }'

Roadmap

EVM first. Measured before it's promised.

Each chain and each detector ships only after it has been tested against labelled fixtures. Support is never claimed just because the RPC looks similar.

  1. M1Building now

    EVM decoder & explainable rules

    Native, ERC-20, ERC-721 and ERC-1155 transfers and approvals on Ethereum. Unknown calls are reported as unknown.

  2. M2Next

    Threat intelligence with provenance

    Licensed, reviewed sources. Every flag carries its source, review state and expiry — with a path to appeal.

  3. M3Next

    Trace-backed simulation

    Predicted balance, token and allowance changes at a pinned block, with the engine and its limits on record.

  4. M4Planned

    Signature risk

    EIP-712 typed data, EIP-2612 permits and Permit2 — scoped versus broad permissions, deadlines and spenders.

  5. M5Planned

    Private beta

    API keys, quotas, docs and a TypeScript SDK for a small group of wallet and dApp teams.

  6. M6Later

    Beyond EVM

    Solana instructions and Bitcoin PSBTs — each chain with its own compatibility matrix and fixture suite.

Private beta · waitlist open

Sign with your eyes open.

We're opening CERQAVA to a small group of wallet and dApp teams first. Leave your email and we'll reach out when the private beta is ready.

One email when the beta opens. Nothing else.