Recipient and contract allowlists

These templates keep an app-owned wallet to addresses you already know: the recipients it pays and the contracts it calls. Replace the placeholder addresses with your own before you publish.

Allow only known recipients

Use this when the wallet should only pay addresses you control or have vetted. The policy denies an ETH transfer on Base to any address outside the list.

Developer Portal
JSON

On your Development key, open Permissions, select the Guardrails tab, and select Add or New Guardrail.
Enter a Guardrail Policy Name. In Networks, clear Ethereum (1), select Base (8453), and select Continue.
Select Transfer ETH, then Add Condition. Keep Recipient address, choose is one of, and enter the addresses separated by commas.
Select Review, then Save Draft, then Activate on the draft.

guardrail-allowed-recipients.json

{
  "id": "base-allowed-recipients",
  "schemaVersion": "permissions.policy.v1",
  "version": "1",
  "selector": {
    "walletType": "EVM",
    "chainId": "8453"
  },
  "rules": [
    {
      "id": "allowed-recipients",
      "effect": "deny",
      "actions": ["transfer_native"],
      "when": {
        "kind": "all",
        "of": [
          { "kind": "compare", "fact": "request.classification", "op": "eq", "value": "native_transfer" },
          {
            "kind": "not",
            "of": {
              "kind": "compare",
              "fact": "request.to",
              "op": "in",
              "value": [
                "0x1111111111111111111111111111111111111111",
                "0x2222222222222222222222222222222222222222"
              ]
            }
          }
        ]
      }
    }
  ],
  "metadata": {
    "productMode": "guardrail",
    "description": "Send ETH on Base only to approved recipients"
  }
}

Signing request	Result
Send ETH to `0x1111…1111`	Signs
Send ETH to an address outside the list	Denied by `allowed-recipients`
Token transfers and contract calls	Not limited by this policy

Test it on your Development key: sign a transfer to a listed address and one to an unlisted address. Only the second is denied.

The rule covers native ETH transfers only. On Solana, Cosmos, Stellar or Sui, choose the Native transfer action in the form and add the same Recipient address condition with addresses in that network’s format.

Allow one function on one contract

Use this when the wallet should only ever call a single protocol function, such as a deposit. The policy denies a contract call on Base unless it calls deposit on the listed contract.

Developer Portal
JSON

On your Development key, open Permissions, select the Guardrails tab, and select Add or New Guardrail.
Enter a Guardrail Policy Name. In Networks, clear Ethereum (1), select Base (8453), and select Continue.
Select Call a contract. Enter the contract in Contract Address and deposit in Function Name. No condition is needed.
Select Review. The Review step warns that no conditions are set, but the contract and function still limit the rule, as the Normalized policy JSON shows. Select Save Draft, then Activate on the draft.

guardrail-allowed-contracts.json

{
  "id": "base-allowed-contract",
  "schemaVersion": "permissions.policy.v1",
  "version": "1",
  "selector": {
    "walletType": "EVM",
    "chainId": "8453"
  },
  "rules": [
    {
      "id": "allowed-contract-call",
      "effect": "deny",
      "actions": ["call_contract"],
      "when": {
        "kind": "all",
        "of": [
          { "kind": "compare", "fact": "request.classification", "op": "eq", "value": "decoded_contract_call" },
          {
            "kind": "any",
            "of": [
              {
                "kind": "compare",
                "fact": "request.contract.address",
                "op": "ne",
                "value": "0x3333333333333333333333333333333333333333"
              },
              { "kind": "compare", "fact": "request.method", "op": "ne", "value": "deposit" }
            ]
          }
        ]
      }
    }
  ],
  "metadata": {
    "productMode": "guardrail",
    "description": "Call only deposit on the approved Base contract"
  }
}

Signing request	Result
Call `deposit` on `0x3333…3333`	Signs
Call another function, or another contract, that Para can decode	Denied by `allowed-contract-call`
A call Para cannot decode	Not limited by this policy

Para reads the contract and function only from calls it can decode with the contract’s ABI. The rule starts with a request.classification check, so a call Para cannot decode does not match it and stays allowed. To deny those calls too, use the next template.

Test it on your Development key: sign a deposit call on the listed contract, then a call to another function. Only the second is denied.

Adding a second Call a contract action in the form does not widen the list. Each action becomes its own rule that denies every call outside its own contract and function, so two actions together deny every decoded call. To list several contracts or functions, use the next template.

Allow listed contracts and functions

Use this when the wallet works with a few contracts and calls Para cannot decode must not slip through. The Developer Portal forms cannot express it, so publish it as JSON.

guardrail-contract-allowlist.json

{
  "id": "base-contract-allowlist",
  "schemaVersion": "permissions.policy.v1",
  "version": "1",
  "selector": {
    "walletType": "EVM",
    "chainId": "8453"
  },
  "rules": [
    {
      "id": "listed-contracts-only",
      "effect": "deny",
      "actions": ["call_contract"],
      "when": {
        "kind": "not",
        "of": {
          "kind": "compare",
          "fact": "request.target",
          "op": "in",
          "value": ["0x3333333333333333333333333333333333333333", "0x4444444444444444444444444444444444444444"]
        }
      }
    },
    {
      "id": "listed-functions-only",
      "effect": "deny",
      "actions": ["call_contract"],
      "when": {
        "kind": "all",
        "of": [
          { "kind": "compare", "fact": "request.classification", "op": "eq", "value": "decoded_contract_call" },
          {
            "kind": "not",
            "of": { "kind": "compare", "fact": "request.method", "op": "in", "value": ["deposit", "withdraw"] }
          }
        ]
      }
    }
  ],
  "metadata": {
    "productMode": "guardrail",
    "description": "Call only listed contracts and functions on Base"
  }
}

The policy has two rules:

listed-contracts-only checks request.target, the contract the transaction calls. Para reads it from every contract call, decoded or not, so a call to any unlisted contract is denied.
listed-functions-only checks the function on calls Para can decode, and denies anything other than deposit or withdraw.

Signing request	Result
Call `deposit` or `withdraw` on a listed contract	Signs
Call any function on an unlisted contract, decoded or not	Denied by `listed-contracts-only`
Call another function that Para can decode on a listed contract	Denied by `listed-functions-only`
A call to a listed contract that Para cannot decode	Signs

Test it on your Development key: sign a call to a listed contract, a call to an unlisted contract, and a call to another function on a listed contract. Only the first signs.

Contract calls are the call_contract action. ERC-20 transfers and approvals, NFT transfers, Safe transactions and deployments are separate actions, so this policy does not limit them. On Solana, Cosmos, Stellar or Sui, the form’s Execution target action pins the program or contract a transaction calls. A Solana transaction that creates the recipient’s associated token account and then sends one TransferChecked to it is a transfer_tokens request, so this policy does not limit it either.

Publish your allowlists

Test recipients and contracts are often not the ones you use in production. Para reviews the policies active on your Development key and applies them to production, so make sure the lists hold your production addresses before you request a production review.

Get Started

Set Up Project

Create and Manage Wallets

Sign and Transact

Add Permissions

Use Pregeneration

Endpoints

Recipient and contract allowlists

Allow only known recipients

Allow one function on one contract

Allow listed contracts and functions

Publish your allowlists

​Allow only known recipients

​Allow one function on one contract

​Allow listed contracts and functions

​Publish your allowlists

Allow only known recipients

Allow one function on one contract

Allow listed contracts and functions

Publish your allowlists