Function Call Monitor

Get an alert when a specific function is called on a smart contract you watch: an upgrade, a pause, a withdrawal, an ownership transfer.

Some functions should almost never be called. upgradeTo on a proxy, transferOwnership, pause, setOracle, an emergency withdraw: when one of these runs, someone on your team should know within minutes, not when a user reports it.

The Function Call Monitor watches one contract on one chain for transactions that call the function you name, and alerts you when one does. There is nothing to deploy and no ABI to upload: a contract address and a function signature are enough.

How it works

  1. The selector is computed. From a signature such as withdraw(uint256), Chainitor derives the 4-byte function selector that every call to that function starts with.
  2. Every block is read. Each new block of the chain is read once. Transactions sent to your contract whose input data starts with that selector are matches.
  3. You are alerted at your next check. At each check (every minute at the fastest on Pro), any match turns the monitor critical and sends an alert naming the function, the contract and the transaction hash. Email and Telegram alerts also show the caller and the block number.
  4. Recovery is reported. The first check that finds no new calls returns the monitor to healthy and sends a recovery notice; the next call alerts again.

What you configure

  • Chain: Ethereum, Polygon, Arbitrum, Optimism, BNB Chain, Base, Robinhood Chain, or the Ethereum Sepolia, Polygon Amoy, BSC testnet, Arbitrum Sepolia, Optimism Sepolia and Base Sepolia testnets.
  • Contract address: the contract users and operators send transactions to. For an upgradeable contract, that is the proxy.
  • Function signature: the name and parameter types, for example transferOwnership(address).
  • Check interval and alert channels: email, Slack, Telegram, PagerDuty and webhook are on every plan.

Example configurations

Someone calls upgradeTo on your proxy

Monitor type
Function call
Chain
Ethereum
Contract address
0x5555555555555555555555555555555555555555 (your proxy, placeholder)
Function signature
upgradeTo(address)
Check interval
1 minute
Alert channels
Slack #security and email

An upgrade should be rare and planned. Any transaction that calls upgradeTo on the proxy turns the monitor critical and alerts with the transaction hash, so the team can confirm it was theirs.

Withdrawals from a vault

Monitor type
Function call
Chain
Base
Contract address
0x6666666666666666666666666666666666666666 (vault, placeholder)
Function signature
withdraw(uint256)
Check interval
5 minutes
Alert channels
Webhook into your back office

Each check reports the calls to withdraw since the last one. The webhook carries the alert as JSON, so your own system can look up the caller and amount from the transaction hash.

Functions worth watching

  • Upgrades: upgradeTo(address) and upgradeToAndCall(address,bytes) on UUPS and transparent proxies.
  • Ownership and roles: transferOwnership(address), renounceOwnership(), grantRole(bytes32,address).
  • Circuit breakers: pause() and unpause().
  • Configuration: fee, oracle or parameter setters specific to your protocol.
  • Funds movement: withdraw(uint256), sweep(address), emergencyWithdraw().

Function call or event monitor?

A function call monitor sees transactions sent straight to your contract. An event monitor sees the logs your contract emits, which also covers calls made by other contracts, such as a Safe multisig executing an upgrade, and it only fires for calls that succeeded.

If the function emits an event, such as Upgraded(address) or OwnershipTransferred(address,address), an event monitor is usually the more complete signal. Use the function call monitor for functions that emit nothing, or when you want to know about attempts as well as successes.

Limits worth knowing

  • Only top-level transactions to the contract are matched; internal calls are not.
  • One monitor watches one function on one contract. Watch several functions with several monitors.
  • Alerts arrive at your next check after the block is read, not instantly at block time.

Frequently asked questions

What format should the function signature be in?

The function name followed by its parameter types, with no parameter names or spaces, for example withdraw(uint256) or transfer(address,uint256). Chainitor hashes that text to get the 4-byte function selector and compares it with the start of each transaction's input data.

Does it catch calls made through another contract, such as a Safe or a router?

No. The monitor matches transactions sent directly to the contract you entered. When a Safe, a multicall or a router calls your contract during its own transaction, that is an internal call and is not seen. To catch those, watch an event the function emits with an event monitor instead.

Does a reverted call trigger the alert?

Yes. The monitor matches on the transaction's target and input data, so an attempt to call the function counts whether it succeeded or reverted. Pair it with a failed transaction monitor if you need to tell the two apart.

How do I monitor a proxy contract?

Enter the proxy address, since that is where users send their transactions, and the signature of the function as defined in the implementation. The selector is the same whichever contract holds the code.

Which plan includes function call monitors?

The Pro plan and above. Function call monitors read every block of their chain, so they are not part of the Starter plan.

Related monitors and guides

Know when sensitive functions run

Set up a function call monitor on any contract in a couple of minutes. Function call monitors are part of the Pro plan.

Start monitoring free

7-day free trial ā€¢ No immediate charge