crypto-recon-detector

name	crypto-recon-detector
description	Scans downloaded JS files to determine if target is Web2, Web3, or Hybrid. Routes to appropriate specialist set. Must run before analysis specialists. Called by thefound and crypto-recon-orchestrator.

Crypto Recon — Web Type Detector

Purpose

Before running crypto specialists, determine what KIND of web app this is. Web2 and Web3 have completely different crypto patterns, libraries, and signing flows. Wrong specialist set = missed findings.

When to Run

Always — runs as Phase 0 after deobfuscation, before any specialist.

Detection Method

Run:

python tools/detect_type.py output/[domain]/

Scans all JS in output/[domain]/ (preferring deobf/beautified if available).

---

Web3 Signal Catalog

HIGH Confidence Signals (1 = likely Web3)

Wallet Providers:

window\.ethereum
ethereum\.request
ethereum\.enable\(\)
eth_requestAccounts
eth_sendTransaction
eth_signTypedData_v[134]
personal_sign
wallet_switchEthereumChain
MetaMask
WalletConnect
WalletConnectV2
CoinbaseWallet
RainbowKit
web3modal
ConnectKit

Web3 Libraries:

require\(['"]ethers['"]\)
from ['"]ethers['"]
require\(['"]web3['"]\)
from ['"]web3['"]
require\(['"]wagmi['"]\)
from ['"]wagmi['"]
require\(['"]viem['"]\)
from ['"]viem['"]
require\(['"]@solana/web3\.js['"]\)
require\(['"]tronweb['"]\)
require\(['"]starknet['"]\)
require\(['"]@near-sdk-js['"]\)
require\(['"]@mysten/sui\.js['"]\)
ethers\.providers
ethers\.Contract
ethers\.Wallet
new Web3\(

Signing Methods:

signMessage\(
signTypedData\(
_signTypedData\(
eth_sign
personal_sign
signTransaction\(
sendTransaction\(
\.sign\(.*privateKey
wallet\.sign
signer\.sign

ABI Patterns:

encodeFunctionData\(
encodeABI\(
decodeFunctionResult\(
\.interface\.
new ethers\.utils\.Interface\(
new Interface\(
abi:\s*\[
\"type\":\s*\"function\"
\"inputs\":\s*\[
internalType

EIP-712:

signTypedData
TypedDataEncoder
_TypedDataEncoder
EIP712
eip712
EIP-712
domainSeparator
DOMAIN_SEPARATOR
hashStruct\(
encodeType\(
encodeData\(
primaryType

Blockchain Primitives:

keccak256\(
solidityKeccak256\(
solidityPacked\(
soliditySha3\(
toUtf8Bytes\(
hexlify\(
arrayify\(
getAddress\(
isAddress\(
parseUnits\(
formatUnits\(
BigNumber\.from\(

Contract Addresses (0x + 40 hex):

0x[0-9a-fA-F]{40}

Chain/Network IDs:

chainId\s*[:=]\s*\d+
networkId\s*[:=]\s*\d+
mainnet|goerli|sepolia|polygon|arbitrum|optimism|bsc|avalanche

Token Standards:

ERC20|ERC721|ERC1155|ERC4626
approve\(.*amount
transfer\(.*to.*amount
transferFrom\(
balanceOf\(
ownerOf\(
tokenURI\(

MEDIUM Confidence Signals

wallet|Wallet
blockchain|Blockchain
crypto\.getRandomValues\(    ← also in Web2
mnemonic|Mnemonic
privateKey|private_key
publicKey|public_key
nft|NFT|collectible
defi|DeFi|dex|DEX|swap
liquidity|staking|yield

---

Scoring Algorithm

score = 0
for each HIGH signal found in any JS file:
    score += 3
for each MEDIUM signal found:
    score += 1
for each contract address (0x40hex) found:
    score += 2

if score >= 9:   → WEB3
if score >= 4:   → HYBRID (has both Web2 API signing AND Web3 wallet)
if score < 4:    → WEB2

---

Output

{
  "type": "WEB3",           // WEB2 | WEB3 | HYBRID
  "confidence": "HIGH",     // HIGH | MEDIUM | LOW
  "score": 24,
  "high_signals_found": [
    "window.ethereum",
    "ethers.Contract",
    "eth_signTypedData_v4",
    "keccak256",
    "TypedDataEncoder"
  ],
  "libraries_detected": ["ethers.js", "wagmi", "WalletConnect"],
  "contract_addresses": ["0xA0b86991c6218b36c1d19D4..."],
  "chains_detected": ["mainnet", "polygon"],
  "notes": "EIP-712 signing detected — likely DeFi or NFT marketplace"
}

---

Routing Decision

If WEB2:

→ Route to standard 10 specialists (hash, symmetric, asymmetric, mac, kdf, encoding, signing, jwt-oauth, libraries, custom)

If WEB3:

→ Route to crypto-recon-web3 (primary) → Also run: crypto-recon-hash, crypto-recon-encoding, crypto-recon-libraries, crypto-recon-custom → Skip: crypto-recon-symmetric, crypto-recon-kdf (rarely relevant in pure Web3)

If HYBRID:

→ Run ALL specialists (Web2 set + crypto-recon-web3) → Common in: DEX frontends with API backend, GameFi with both REST API + chain interaction

---

Report to Orchestrator

=== TYPE DETECTION RESULT ===
Target:      https://app.uniswap.org/
Type:        WEB3 (HIGH confidence, score=24)
Libraries:   ethers.js v5, wagmi, WalletConnect v2
Chains:      Ethereum mainnet, Polygon, Arbitrum
EIP-712:     YES — TypedDataEncoder found in chunks/abc123.js

Routing to: crypto-recon-web3 + hash + encoding + libraries + custom

Key files to analyze first:
  chunks/abc123.js    ← TypedDataEncoder, signTypedData
  index-xxx.js        ← wallet connection, eth_requestAccounts
  vendor-xxx.js       ← ethers.js bundle