Wallet safety infrastructure for Web3

01

Abstract

Pavoriz is a security layer that sits between a person and the decentralised applications they use. It brings what is known about a dApp, an address or a project to the moment somebody is about to sign, and gives them a way to take back permissions they have already given.

The platform is a web application, a companion browser extension, a multi chain approval scanner, a threat intelligence pipeline and two Solidity contracts. It spans 70 chains across nine ecosystems.

02

The problem

Every interaction with a dApp asks a wallet to hand a contract a standing permission. Those permissions do not expire, and they pile up across every chain a person has ever used. Most people hold dozens of live approvals to contracts they cannot name.

The failure is not that people make bad decisions. The information needed to make a good one is spread across block explorers, security feeds, incident databases and calldata nobody can read, and none of it is in front of somebody when they press Confirm.

03

The platform

Pavoriz answers four questions that today take four separate products:

• What has this wallet already given away, and what does it put at risk? (the Revoke console)
• Is this dApp safe to use right now, while I am on it? (Pavoriz Shield)
• Is this address or website already known to be dangerous? (threat intelligence)
• Is this project what it claims to be? (the Project Trust Check)

04

Revoke console

Reads a wallet's live token approvals across 65 chains, names the contracts holding them, and sends the transaction that takes them back.

• Value at risk is the smaller of the allowance and the balance, priced from a live feed. A spender can only take what is there.
• Revoking runs in four ordered steps: build the calldata, switch to the right chain, simulate, then send. A call that would revert fails before the wallet is asked.
• ERC-20 allowances, single NFT approvals and operator approvals are kept apart, because they are three different calls.

05

Pavoriz Shield

A Manifest V3 browser extension that protects a session while it is happening.

• Always on protection: launching a dApp through Pavoriz enrols it, so a later direct visit arms the Shield on its own.
• Every wallet request is graded before it reaches the wallet, with an allow and block prompt carrying the Pavoriz mark.
• A revoke is offered the moment an approval is granted, while the person is still looking at the screen.
• Only the host leaves the browser, never the path or the query, and only for hosts already under the Shield.

06

Auto revoke

Lets Pavoriz send the transaction that clears a dangerous approval without asking for a signature when it fires. One mechanism per ecosystem, each chosen so that a total compromise of Pavoriz achieves nothing beyond cancelling approvals somebody wanted cancelled.

07

Threat intelligence

Four public blocklists fetched from their publishers on a schedule, an incident index, and a victim graph Pavoriz builds itself by reading drainer activity directly off chain logs.

08

Project Trust Check

Paste a project's website, its contract address, or both. Pavoriz gathers what is publicly there from fifteen sources and grades it across four groups: the contract, the website, the identity history, and what the project claims against what was found.

Confidence is reported separately from the score, so how much could be read is never confused with how good the answer was. A check that could not run is removed from both sides of the score rather than counted as zero.

09

Contract design

Both contracts follow one principle: the aim is not a contract nobody can break, it is one where breaking it completely gets the attacker something worthless.

• SpotlightEscrow, on BNB Chain at 0xd8349cf26ddbe37350cf75bd5d8c14a64b42815d, holds placement payments until a decision moves them: settled on approval, refunded on rejection. The server key cannot name a destination or withdraw.
• PavorizRevoker compiles to 2,736 bytes with no DELEGATECALL, no SELFDESTRUCT, no CREATE and no storage at all. It deploys to one canonical address on every chain.

10

The $PAVO token

PAVO is the utility token for the Pavoriz platform. The product already has a place for it: the Pavo fee on automatic revokes and the gas tank are priced in dollars and collected in a token an administrator chooses, starting with a stablecoin and moving to PAVO once that is a decision worth making.

• Paying for protection: auto revoke fees and gas tank top ups.
• Governance: a proposal board for holders, kept separate from the monthly dApp vote.

11

Design principles

• Nothing invented is presented as measured. A dApp nobody has opened reads Not measured rather than showing a number.
• A failed read is never a clean result. A check that could not run says so, and a feed that shrinks by half is refused rather than trusted.
• Every measurement is a script that can be re-run, not a constant somebody typed once.

12

Where it goes

• Distribution: publish the Shield to the Chrome and Firefox stores, cover off chain signatures, and notify people when a new approval appears on a wallet they watch.
• The data as a product: address reputation, then a keyed public API over the threat, exploit and approval data.
• Reach: WalletConnect, then a Pavoriz mobile browser with the Shield built in, carrying alerts, the Revoke console, the directory and the trust check.
• Depth: a security audit of both contracts, auto revoke in production, then the token and governance.