Hourly baseline vs fixed threshold
Most contract alerts start with a fixed number: "alert if there are more than 500 transfers an hour". The number is picked once, by feel, and then it misleads in two directions.
- At peak hours it is noisy. Normal daytime traffic crosses it, the team gets used to the alert and mutes it.
- At night it is silent. At 3 a.m. the contract usually does 40 transfers an hour. A burst to 400 is ten times the normal level, and still below 500.
The same happens with drops. A threshold low enough to catch a dead contract at noon fires every night on normal quiet.
What an hourly baseline is
An hourly baseline compares each hour with the same hour on previous days. SmartAlert takes the metric's values for that hour over the previous days and uses their median as the norm. It also takes the typical deviation: the median distance of those values from the norm. The rule fires when the current hour is further from the norm than a set number of typical deviations.
Medians, not averages, are used on purpose: one past incident or one airdrop day does not shift the norm.
| Fixed threshold | Hourly baseline | |
|---|---|---|
| What you set | A number | A direction and a sensitivity |
| Follows the time of day | No | Yes |
| Follows growth over months | No, goes stale | Yes, recalculated on every check |
| Needs history | No | About 5 days |
| Best for | Events that should never happen, and amounts | Counts and volumes that rise and fall through the day |
- Fixed threshold
- A number
- Hourly baseline
- A direction and a sensitivity
- Fixed threshold
- No
- Hourly baseline
- Yes
- Fixed threshold
- No, goes stale
- Hourly baseline
- Yes, recalculated on every check
- Fixed threshold
- No
- Hourly baseline
- About 5 days
- Fixed threshold
- Events that should never happen, and amounts
- Hourly baseline
- Counts and volumes that rise and fall through the day
The settings
Compare with
the same hour on previous days; the same hour and weekday, for contracts with a weekly rhythm; or the previous equal period.
Fire when the value is
above the norm, below the norm, or either way. "Below" catches a contract that went quiet: a broken frontend, a stuck keeper, a paused bridge.
Sensitivity
high, medium (default) or low.
Your own limit for a single hour
Click an hour on the chart and set a stricter or looser limit just for it. The other hours follow the norm.
Until there is enough history, the app says "Norm unavailable" and shows the date it will appear. It never fills the gap with a made-up number. A contract that has existed for weeks has its history already: SmartAlert collects it when you add the address.
Check it on history before you turn it on
A baseline you can't see is a black box. Before you enable the rule, SmartAlert draws the last 30 days: the metric, the norm band, and a mark at every point where the rule would have fired. If it would have fired twelve times last week on normal traffic, you see it now, not at night.
You can also give the target: "no more than 2 firings a week". SmartAlert finds the sensitivity that meets it on the history and shows the result on the same chart.
When a fixed threshold is the right choice
A baseline is not always better.
Events that should never happen
ownership transferred, proxy upgraded, role granted, Safe owners changed. Any single occurrence is the alert. Use "any event".
Amounts in dollars
a transfer above $50,000, a treasury below $100,000. The limit comes from your business, not from history.
Brand-new contracts
with no history yet. Start with a fixed threshold and switch when the norm appears.
Rare, irregular activity
, such as a governance contract with a few calls a week. There is no daily rhythm to learn.
A good setup uses both: fixed rules for admin events and amounts, a baseline for activity counts and volumes.
Common baseline rules
- Transfer spike: transfers per hour far above the norm for this hour.
- Swap spike: swaps in a DEX pool far above the norm.
- Contract went quiet: activity far below the norm.
FAQ
How much history does the norm need?
About 5 days for "same hour on previous days". A contract older than that works at once, because SmartAlert reads its past events when you add it.
Will an attack "teach" the baseline that it is normal?
One unusual hour barely moves a median. A sustained change over many days will become the new norm, which is why the alert fires at the start of the change, not at the end.
Can I use a baseline on the Free plan?
Yes, with "same hour on previous days". Some comparison options are marked Pro in the form.
Try it on your own contract
An address is enough. The first 14 days get Pro limits, and rules are checked on history before they go live.