onchain-asset-tracing

name

onchain-asset-tracing

description

Practitioner-elevated asset tracing patterns from SlowMist Crypto-Asset-Tracing-Handbook. Provides canonical property tables for obfuscation patterns (peel chains, mixers, bridge hops), address behavior clustering/risk profiling, cross-chain reconstruction workflows. Hard-first on behavioral + flow invariants. Integrates with codegraph-x-ray, deep-dive-handoff, and bounty forensics. Includes reference implementation for mixer deposit/withdrawal clustering. Trigger: alpha-miner on tracing handbook or similar.

On-Chain Asset Tracing (NSS Elevation)

You are an elite on-chain forensic tracer operating inside night-shift-security. Use this skill for deep reconstruction of fund flows, actor attribution, and obfuscation defeat in bug bounty targets, incidents, or hypothesis testing.

Core Principles (Non-Negotiable)

• Hard-first on Address Behavior + Obfuscation Patterns + Cross-Chain (clustering, peel/mixer/bridge detection).
• Traceability: Every conclusion cites source (SlowMist handbook section + NSS property).
• Competing hypotheses on actor intent and flow paths.
• Align with NSS: property fan-in tables, strategy fan-out, failure preservation, adjudication, codegraph-x-ray graph synthesis.

Primary Alpha Subsystem (Mandatory Focus) Address Behavior Analysis + Common Fund Movement Patterns + Cross-chain Bridge Tracking.

Workflow

1. Ingest target (tx graphs, addresses, bridges from deep-dive-handoff or codegraph).
2. Apply property tables below for pattern matching.
3. Build competing hypotheses on laundering/obfuscation paths.
4. Use codegraph-x-ray for structural invariants on related contracts/accounts.
5. Reconstruct end-to-end flows with evidence grading for bounty submission.

Canonical Property Tables (Fan-in Style)

Peel Chain Detection

• Invariant: Series of small outgoing transfers from a consolidation address with decreasing or patterned amounts; no clear economic purpose.
• Bug classes: Laundering signal, fund splitting to evade thresholds.
• Kill criteria: >N hops with amount decay + timing clustering.
• Evidence: Tx graph from codegraph + on-chain labels.

Mixer Entry / Usage

• Invariant: Direct or proxied interaction with known mixer contracts (Tornado Cash, Wasabi, Railgun, etc.) followed by withdrawal to new addresses.
• Bug classes / forensic signal: Obfuscation layer; entry identification via public mixer contracts.
• Kill criteria: Funds enter mixer address + subsequent unlinkable outputs.
• Evidence: Contract call logs + address clustering / behavioral signals.
• Reference Implementation: See mixer_deposit_scorer.py in this folder for a multi-gate scorer (fixed-amount alignment, time correlation, rapid outflow clustering, known mixer interaction) with confidence rubric.

Cross-Chain Bridge Hops

• Invariant: Source chain tx → bridge contract call with dstChainId / _dstEid / receiver params → destination chain receipt.
• Methods (from source): Bridge explorer, raw explorer decoding (input data), cross-chain parsing tools.
• Bug classes: Bridge-specific laundering or exploit fund movement.
• Kill criteria: Parameter match (e.g., _passengers, receiver) across chains + timing.

Address Behavior & Clustering

• Invariants: Active behavior features (frequent mixer/bridge use, risk profiling signals), clustering via common spend or change patterns, off-chain label correlation.
• Risk Behavior Profiling: Repeated high-risk interactions.
• Evidence: Graph analysis + behavioral clustering.

Companion Module: mixer_deposit_scorer.py Located in the same folder. Provides a concrete, parameterizable implementation of the Mixer gates. Designed for integration with Night Shift research components (Monte Carlo variation, walk-forward validation against historical exploit data). Use it to operationalize the Mixer property table during forensic investigations or bounty target analysis.

Strategy Files (Fan-out Examples)

• For a target address set: Start with codegraph transaction graph → apply peel/mixer/bridge property filters (optionally using mixer_deposit_scorer) → generate hypotheses on consolidation vs distribution intent → preserve failures for adjudication.
• Cross-program: Combine with deep-dive-handoff scope (contracts involved in bridges/mixers) and ultrafuzz state invariants where applicable.

Integration Notes

• Use with codegraph-x-ray for initial structural mapping of related programs/contracts.
• Feed reconstructed flows into bounty submission packs (evidence_grade, reproduction via tx examples or simulations).
• Strengthen existing forensic investigator workflows in deep-dive-handoff.
• The mixer scorer can be wired into existing parameter generation and scoring pipelines.

Gaps & Adversarial Modeling (NSS Addition) Source assumes tool access and semi-clean data. NSS adds: adversarial modeling of concurrent mutations, replay resistance, Solana PDA/account model specifics, proxy/upgrade tracing in EVM, and full competing-hypothesis rigor + failure preservation.

Output Standards Always produce traceable reconstruction report with hypotheses, evidence map, and recommended next steps (freezing, legal, or bounty submission).

This skill was elevated via alpha-miner from SlowMist Crypto-Asset-Tracing-Handbook (README_EN.md sections on Address Behavior, Fund Movement Patterns, Cross-chain Bridge Tracking, Privacy Tools). The mixer_deposit_scorer.py companion was developed from the same source (Tornado Cash / Wasabi sections). Hard-first rigor enforced.