Enhance your wallets' security with Blockaid

Portal’s React Native SDK integrates with Blockaid to provide real-time security scanning for transactions, addresses, tokens, and URLs. This integration helps detect malicious activity, phishing attempts, scam tokens, and suspicious interactions before users sign or submit transactions.

Overview

The Blockaid integration enables you to:

Scan transactions before signing or submission (EVM, Solana, Tron)
Scan addresses for known malicious actors or compromised contracts
Validate tokens to detect scams or security risks
Verify URLs to prevent phishing attacks

Prerequisites

Before using Blockaid security scanning, ensure you have:

A properly initialized Portal client
Blockaid integration enabled in your Portal Dashboard (see Blockaid Integration)

Scanning EVM Transactions

Use scanEVMTx to analyze Ethereum transactions before signing or broadcasting them. This method scans EVM transactions for malicious contract interactions, risky approvals, phishing attempts, and other on-chain security threats.

import Portal from '@portal-hq/core'

async function scanEvmTransaction(portal: Portal) {
  const response = await portal.security.blockaid.scanEVMTx({
    chain: 'eip155:1',
    data: {
      from: '0x7C01728004d3F2370C1BBC36a4Ad680fE6FE8729',
      to: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
      data: '0x095ea7b3...',
      value: '0x0',
      gas: '0x2dc6c0',
      gasPrice: '0x2dc6c0',
    },
  })

  console.log('Blockaid EVM scan response:', response)
}

Scanning Solana Transactions

Use scanSolanaTx to analyze Solana transactions before signing. This method detects malicious program invocations, suspicious token movements, and other Solana-specific risks.

import Portal from '@portal-hq/core'

async function scanSolanaTransaction(portal: Portal) {
  const response = await portal.security.blockaid.scanSolanaTx({
    chain: 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
    account_address: 'BBQUMqaFELxTFh8r1xSttYMHX6ZKzLWhsmGod2vuxgEc',
    encoding: 'base64',
    method: 'signAndSendTransaction',
    options: ['simulation', 'validation'],
    transactions: [
      'AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAQADCQkVR3SiiKbW0l4c3NBsEn6+zn1o0YsyypPwN0GUhg4K5HK0Tb5GckDLYW+MsovQASt5EZ3bSH3nluRJAE69H61w0BRUDTrpYQcXosUun6/z2BROkRoH/1bL7KLU9s4lCav6k3ZZgV6qeZFwu4pu89WoIGaqUxG4C93XwVmmDy81v8qBaCSP4/UZfdo3q1bud/W+ixymkH8IMe0laQZYrSx4Uhyxec67hYm1VqLV7JTSSYaC/fm7KvWtZOSRzEFT2gMGRm/lIRcy/+ytunLDm+e8jOW7xfcSayxDmzpAAAAAT4tlY/P4mFG1wDJl0ektVggHiZf73lTlHBVJ3fK0nDoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANG5fPtlMEOI/eXV7aPDlpcdLUKm8L3VoW6k/oJlCNLaBQYABQLARQQABgAJAwYAAAAAAAAABzwACQoLCwgyMzQMNQ0ONjcPEDg5EgETFBUWOhEXGBkaGxwdHh8gISI7IyQlJicCKCkqKywtAwQuLzAxPBFVCg8JAQcHBgYBAAAAAwHwCgYBExUbBgICAAAPAwIAAAYBISMoEQQBGQAPAwIAAAYBLjA2DwMCAAAGAgIAAAAIBgYICAADAQkGCQUFBgACBQAEBwEAAAgCAAUMAgAAADwaAAAAAAAABgAFBGDMBQAEPPm21Wu6wrmHu23/ZFNIumpp+ADooZjd4JQgvjnBxkUJAgEDBqWqCgmmCAUIBwu1tp+gcP/+Ri3C1tRXUbPdgqo6rVsj/qnqC959wTdC/mRARysLz9HS09TW19jZ2tsC1QYsNrdxMcm5Nq5FXZrM0IXpEA+ApFa+pz/JvkLz0+2vnwuztLW2t7i5uru8vgAPvBv8VUeRwDy9yD1NHIH5Ji6ZA+zrmpHejKOz4MP8SwrKy8zNzs/S09TVAdY=',
    ],
  })

  console.log('Blockaid Solana scan response:', response)
}

Scanning Tron Transactions

Use scanTronTx to analyze Tron transactions before signing. This method detects malicious smart contract interactions, suspicious token movements, and other Tron-specific security risks.

scanTronTx is only supported on Tron mainnet (tron:mainnet). Passing a testnet chain identifier such as tron:shasta or tron:nile will throw an error.

async function scanTronTransaction(portal: Portal) {
  const response = await portal.security.blockaid.scanTronTx({
    chain: 'tron:mainnet',
    account_address: 'TKhJBwsH7hvegxrUHW4oHT5t1BUDds2UG4',
    data: {
      from: 'TKhJBwsH7hvegxrUHW4oHT5t1BUDds2UG4',
      to: 'TMacq4TDUw5q8NFBwmbY4RLXvzvG5JTkvi',
      data: '0xa9059cbb000000000000000000000041...',
      value: '0x0',
    },
    options: ['simulation', 'validation'],
  })

  console.log('Blockaid Tron scan response:', response)
}

The request object maps to the following fields:

Field	Type	Required	Description
`chain`	`string`	Yes	Must be `tron:mainnet`
`account_address`	`string`	No	Sender’s Tron address (Base58 format, starts with `T`)
`data.from`	`string`	No	Sender address (Base58 format)
`data.to`	`string`	No	Recipient address (Base58 format)
`data.data`	`string`	No	Encoded contract call data (hex)
`data.value`	`string`	No	Amount of TRX to transfer (hex)
`metadata`	`object`	No	Dapp or non-dapp context for the transaction
`options`	`string[]`	No	Analysis types to run: `'simulation'`, `'validation'`, or both

Handling scan responses

Every Blockaid scan method resolves with the Blockaid result nested under data.rawResponse. For transaction scans, the result includes a validation object containing a result_type field. The possible values are:

Value	Meaning
`Benign`	No threats detected — safe to proceed
`Warning`	Potential risk — consider prompting the user before signing
`Malicious`	Known threat — block the transaction
`Error`	Blockaid couldn’t validate the transaction — the result is unverified, so don’t treat it as safe

validation and simulation are only present when Blockaid returns them. Treat a missing validation like Error: the transaction is unverified, so don’t treat it as safe. When a simulation fails, simulation.status is 'Error', simulation.error describes the failure, and fields such as account_summary and assets_diffs are omitted.

EVM and Tron

For EVM and Tron, validation is at the top level of data.rawResponse:

import Portal from '@portal-hq/core'

async function handleEvmOrTronScanResponse(portal: Portal) {
  const response = await portal.security.blockaid.scanEVMTx({
    // or scanTronTx({ ... })
    chain: 'eip155:1',
    data: {
      from: '0x7C01728004d3F2370C1BBC36a4Ad680fE6FE8729',
      to: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
      data: '0x095ea7b3...',
    },
  })

  const validation = response.data?.rawResponse?.validation

  if (!validation) {
    // No verdict was returned, so treat the transaction as unverified
    console.error('Blockaid did not return a validation result')
    return
  }

  if (validation.result_type === 'Malicious') {
    console.error('Transaction flagged as malicious:', validation)
    return
  }

  if (validation.result_type === 'Error') {
    // The transaction couldn't be validated, so don't treat it as safe
    console.error('Transaction could not be validated:', validation.error)
    return
  }

  if (validation.result_type === 'Warning') {
    // Optionally prompt the user to confirm before proceeding
  }

  // Safe to proceed with signing
}

Solana

For Solana, validation is nested under data.rawResponse.result:

import Portal from '@portal-hq/core'

async function handleSolanaScanResponse(portal: Portal) {
  const response = await portal.security.blockaid.scanSolanaTx({
    chain: 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
    account_address: 'BBQUMqaFELxTFh8r1xSttYMHX6ZKzLWhsmGod2vuxgEc',
    encoding: 'base64',
    method: 'signAndSendTransaction',
    options: ['simulation', 'validation'],
    transactions: [
      'AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAQADCQk...',
    ],
  })

  const validation = response.data?.rawResponse?.result?.validation

  if (!validation) {
    // No verdict was returned, so treat the transaction as unverified
    console.error('Blockaid did not return a validation result')
    return
  }

  if (validation.result_type === 'Malicious') {
    console.error('Transaction flagged as malicious:', validation)
    return
  }

  if (validation.result_type === 'Error') {
    // The transaction couldn't be validated, so don't treat it as safe
    console.error('Transaction could not be validated:', validation.reason)
    return
  }

  if (validation.result_type === 'Warning') {
    // Optionally prompt the user to confirm before proceeding
  }

  // Safe to proceed with signing
}

Scanning Addresses

Use scanAddress to analyze a single address for known security risks. This method can be used for both EVM and Solana addresses and detects malicious contracts, compromised wallets, sanctioned addresses, and other flagged entities. EVM Address Scan

async function scanEvmAddress(portal: Portal) {
  const response = await portal.security.blockaid.scanAddress({
    chain: 'eip155:1',
    address: '0x31c05d73f2333b5a176cfdbb7c5ef96ec7bb04ac',
  })

  console.log('Blockaid EVM address scan response:', response)
}

Solana Address Scan

async function scanSolanaAddress(portal: Portal) {
  const response = await portal.security.blockaid.scanAddress({
    chain: 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp',
    address: 'BBQUMqaFELxTFh8r1xSttYMHX6ZKzLWhsmGod2vuxgEc',
  })

  console.log('Blockaid Solana address scan response:', response)
}

Scanning Tokens

Use scanTokens to analyze multiple tokens in a single request for known security risks. This method detects scam tokens, honeypots, compromised contracts, and other malicious token behavior.

import Portal from '@portal-hq/core'

async function scanTokens(portal: Portal) {
  const response = await portal.security.blockaid.scanTokens({
    chain: 'eip155:1',
    tokens: [
      '0x66587563e933bbf3974b89156b47bb82b921eb35',
      '0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d',
    ],
  })

  const results = response.data?.rawResponse?.results ?? {}

  for (const [address, token] of Object.entries(results)) {
    console.log(`Token ${address}:`, token.result_type)
  }
}

data.rawResponse.results is an object keyed by token address, not an array. Each entry’s result_type is Benign, Warning, Malicious, or Spam.

Scanning URLs

Use scanURL to detect phishing sites and malicious domains before users navigate to them. This method helps protect users from social engineering attacks and malicious off-chain activity.

import Portal from '@portal-hq/core'

async function scanURL(portal: Portal) {
  const response = await portal.security.blockaid.scanURL({
    url: 'https://ethlen.com',
  })

  const scan = response.data?.rawResponse

  if (scan?.status === 'hit' && scan.is_malicious) {
    console.warn('Malicious URL:', scan.url, scan.attack_types)
  }
}

data.rawResponse.status is 'hit' when Blockaid returns a scan result for the URL, or 'miss' when it has no result. A 'miss' response contains only status, so check for 'hit' before reading result fields such as is_malicious, malicious_score, and attack_types.

Next Steps

Learn about signing transactions
Explore transaction evaluation
Review Portal API methods
Check out the Blockaid Integration setup

Getting Started

SDKs

APIs

Integrations

Resources

Enhance your wallets' security with Blockaid

Overview

Prerequisites

Scanning EVM Transactions

Scanning Solana Transactions

Scanning Tron Transactions

Handling scan responses

EVM and Tron

Solana

Scanning Addresses

Scanning Tokens

Scanning URLs

Next Steps

​Overview

​Prerequisites

​Scanning EVM Transactions

​Scanning Solana Transactions

​Scanning Tron Transactions

​Handling scan responses

​EVM and Tron

​Solana

​Scanning Addresses

​Scanning Tokens

​Scanning URLs

​Next Steps

Overview

Prerequisites

Scanning EVM Transactions

Scanning Solana Transactions

Scanning Tron Transactions

Handling scan responses

EVM and Tron

Solana

Scanning Addresses

Scanning Tokens

Scanning URLs

Next Steps