Fusion x Blockaid: Bringing Onchain Threat Monitoring to Fusion Vaults
Fusion has begun integrating Blockaid across its vault stack. Blockaid is the onchain security platform behind names such as Coinbase, MetaMask, Uniswap and Robinhood.
Monitoring and post-transaction analysis are live now for a selection of Fusion ecosystem vaults. Proactive detection is in development, and coverage is set to expand to further vaults over time.
All of it runs alongside the monitoring the Fusion team already performs, adding an external layer to the checks that sit around every vault.
What this covers
Blockaid runs detection across the largest network of web3 interfaces, which means its models see threat patterns as they emerge.
Coverage spans the full transaction lifecycle, from pre-transaction analysis through to post-transaction investigation.
On Fusion, the post-transaction side is live first: a record of what happened, when, and what it touched, which is what an operator needs after an event and what institutional diligence asks to see.
Proactive detection follows, and is currently in development.
How detections are routed
Detections surface to the Fusion team. When one appears material to a specific vault, the team raises it with that operator through an established communication channel.
This supplements an operator’s own monitoring. Operators remain responsible for their vaults, their configuration, and operational response.
Security is our number one priority for Fusion vaults. We are continually expanding the layers and tools around Fusion vault infrastructure, and Blockaid is a strategic addition, bringing the same technology that secures Coinbase Wallet and MetaMask, and now Robinhood Chain. It gives teams building on Fusion a battle-tested layer of monitoring for their own clients.
CEO, IPOR LabsUnderstanding the Blockaid coverage
Onchain Monitoring is Blockaid’s platform for watching smart contracts, infrastructure, and privileged accounts in production. It tracks the assets in scope, detects exploits and unexpected changes as they appear onchain, and gives responders a decoded view of what was called, by whom, and where value moved.
For vaults in scope, Blockaid adds a layer of monitoring on top of what a vault already carries: an extra set of signals, and a named platform watching the infrastructure. Coverage expands over time.
It is one layer among several. Curators shape the strategies, the Fusion team runs its own vault infrastructure checks, and Blockaid augments the coverage with onchain threat detection and monitoring.
An operator who wants to go further can contract Blockaid directly, for a dedicated feed, custom detection rules, or a guardian role on their vault that can pause activity or block a timelocked action automatically.
The security layers already in place
A vault deployed through the Fusion factory is an instance of shared infrastructure, configured by the operator who deploys it. The layers below cover different parts of that picture.
The audited components every vault inherits. External audits by BlockSec (February 2025) and Protofire (August 2024) cover the core protocol: the vault contract, base fuses, managers and libraries, access management, price oracle middleware, prehooks, context manager and withdraw manager. Every vault built through the factory is assembled from that scope.
AI-assisted audit passes across the stack. Wake Arena, Ackee Blockchain’s AI auditing tool, was run across nearly all fuses and the vault core in December 2025. MixBytes and Cantina/Apex were run across the factory, fuses and managers in March 2026, benchmarked against a branch seeded with known issues, then verified line by line against the production branch in July 2026.
Formal verification of redeem accounting. LFG Labs delivered a formal verification in Lean 4 of the vault’s public redeem path, proving mathematically that redemptions preserve price-per-share and never dilute remaining holders.
New features and fuses before they ship. Each change requires test coverage and peer review, plus an internal audit pass using tooling IPOR Labs built for smart contract analysis, which questions operation ordering and implicit assumptions line by line and detects state inconsistencies where an operation mutates coupled state without updating what depends on it.
Deployed instances. Verification beyond source code: that deployed code matches audited versions, that vault configuration, role permissions and module settings are what they claim to be, and that market configurations, limits and risk parameters on active strategies hold.
Internal monitoring and alerting. Vault configuration, share price behaviour and market limits are tracked by internal tooling, with automated alerts routed to the team.
Bug bounty. Running continuously on Immunefi.
More at: docs.ipor.io/build-on-fusion/developer-guide/security-and-audits
About Fusion
Developed by IPOR Labs AG (Zug, Switzerland), Fusion is the onchain vault infrastructure built for institutional-grade onchain yield strategies. Its modular architecture provides deterministic risk enforcement, per-client vault isolation, compliance-friendly configuration, and flexible setup through composable modules called Fuses, integrated with established DeFi protocols.
