Cowrie Research

blowfish-primary-sources-2026-05-14

2 min read

Blowfish primary sources

Reviewed: 2026-05-14 UTC

Core product framing

  • https://blowfish.xyz/
    • Frames Blowfish as proactive defense for web3 wallets and a complete trust & safety platform.
    • Homepage says the product covers both Dapp Security and Transaction Security, supports 10+ chains, and aggregates risk signals from 10+ sources.
    • The public site is the clearest high-level source that Blowfish is targeting wallet operators and signing UX, not just publishing a phishing list.

Local blocklist distribution and wallet-side policy

  • https://raw.githubusercontent.com/blowfishxyz/blocklist/main/README.md
    • Documents the local blocklist library, including fetching a blocklist object and bloom filter, rescanning domains locally, and persisting state in extension / mobile / Node environments.
    • Recommends blocklist refreshes every 5 minutes and explains bloom-filter hash tracking plus a 24-hour default TTL.
    • Exposes the most important policy controls: priority blocklists, priority allowlists, ordinary blocklists/allowlists, and user-local allowDomainLocally overrides.
    • This repo is the strongest primary source for understanding that Blowfish’s real control surface is partly in distribution, freshness, and override logic.

Integrator privacy and deployment model

  • https://github.com/blowfishxyz/simple-proxy
    • The README explains a reverse-proxy image that can hide user IP addresses from Blowfish and keep API keys out of client apps.
    • Also makes rate limiting and header injection explicit, which is useful for understanding how wallets can operationalize Blowfish without fully centralizing request metadata at the provider.

Official code surface and product decomposition

  • https://github.com/blowfishxyz
    • The org page shows the official public repos, including blocklist, simple-proxy, and the open-sourced frontend code.
    • Useful as the canonical handle for the project’s open-source surface.
  • https://raw.githubusercontent.com/blowfishxyz/blowfish-frontend-monorepo/main/README.md
    • Marks Blowfish Protect as deprecated but open sourced.
    • Reveals the earlier frontend stack as separate apps/packages: extension, extension backend, landing page, transaction portal, API client, hooks, shared UI, and utilities.
    • Helpful for separating API product, browser-extension UX, and proxy/backend mediation rather than flattening Blowfish into one hosted service label.

Main takeaways from this pass

  • Blowfish is best modeled as wallet trust-and-safety middleware, not just a blacklist.
  • The main control surfaces are domain/dapp classification, signing simulation, blocklist-distribution policy, and proxy-mediated privacy.
  • The local blocklist repo matters because it shows that integrators can partially internalize the risk-policy layer instead of fully outsourcing every lookup.
  • The proxy repo matters because it reveals a second-order privacy and API-custody issue that many wallet-security products leave implicit.
  • Blowfish is a good comparison point for Wallet Guard, WalletConnect Verify, Blockaid-style APIs, and other signing-risk / origin-risk products because it separates signal ingestion, local enforcement, and user-facing decision support.

Graph View