Transaction policy gaps in onchain operations: what teams miss

TL;DR: Policy-based allowlists and manual review alone cannot catch all malicious transaction behaviour in MPC workspaces, even when more than 75 policy rules and 100+ recipients are in place, according to Blockaid's analysis of Midas. The gap is between permission checking and threat detection, and that distinction matters as onchain operations scale.

Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “Inside the Midas Tokenization Engine: Live Security for Strategy Execution with Blockaid”.

By the numbers:

• Blockaid's Cosigner now secures 100% of Midas contracts, indicating full contract coverage for signing-time validation.
• Fordefi's setup included more than 75 policy rules, over 100 recipients, and more than 200 approved assets.

Key questions

Q: What breaks when allowlists are the only control for onchain transactions?

A: Allowlists prove that a transaction matches pre-set permissions, but they do not prove the transaction is safe at runtime.

Q: Why do approved onchain transactions still create security risk?

A: Because approval checks are static, while transaction risk is dynamic.

Q: How can security teams tell whether transaction governance is working?

A: Look for two signals: unsafe actions being blocked before signature, and benign actions passing with minimal manual review.

Practitioner guidance

• Implement signing-time transaction simulation Validate every high-risk onchain transaction at the moment of signing so the system evaluates what the action will actually do, not just who approved it.
• Separate policy enforcement from threat detection Keep allowlists and role rules, but add a second control that inspects transaction behaviour, counterparties, and decoded simulation results.
• Continuously monitor ecosystem dependencies Track the DeFi protocols, assets, and counterparties that a strategy touches so protocol exploits or depegs are detected before they cascade into losses.

Bottom line: Policy-based allowlists reduce obvious misuse, but they do not prove that an approved onchain transaction is safe at runtime.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →