SSkilltecabyclaudinhocode
Enviar skill
← Voltar para o catálogo

defi-onchain-analytics

Dados e Análise

Use when profiling wallets, analyzing protocols or pools, inspecting token metrics, evaluating DEX liquidity or LP/vault performance, reading smart contract state, resolving proxy contracts and unknown interfaces, tracing exploit fund flows, or investigating on-chain incidents on EVM chains (Ethereum, Arbitrum, Base, BSC, Polygon, Katana). Make sure to use this skill whenever the user mentions on-

1estrelas
Ver no GitHub ↗Autor: Omnis-LabsLicença: MIT

DeFi On-Chain Analytics

Core Principle: 「先固定資料可信度與上下文,再做最小足夠的讀取,之後才做歸因與敘事。」 First fix data confidence and context, then do minimum sufficient reads, then do attribution and narrative.

Every analysis session serves this hierarchy: confidence > efficiency > interpretation.

Two-Layer Architecture

Every step is tagged with its required tier:

TierTagRequiresFree public RPC?
A[CORE]Standard JSON-RPCYes
B[ARCHIVE]Historical state >128 blocksRarely
C[TRACE]debug/trace namespace (Geth archive or Erigon)No
D[ENRICH]External source (Etherscan API, Sourcify, 4byte)Yes but not RPC

Default = Tier A only. Higher tiers are opt-in. If unavailable, disclose the gap — never silently skip.

Looped Workflow

Real investigations evolve — discovery changes the question. The workflow supports iteration, not just linear execution.

digraph phases {
  rankdir=LR;
  P0 [label="Phase 0\nScoping" shape=box style=filled fillcolor="#ffcccc"];
  P1 [label="Phase 1\nDiscovery" shape=box];
  P2 [label="Phase 2\nCollection" shape=box];
  P3 [label="Phase 3\nInterpretation" shape=box];
  P4 [label="Phase 4\nSanity Check" shape=box];
  P5 [label="Phase 5\nSynthesis" shape=box];
  Rescope [label="Rescope?" shape=diamond style=filled fillcolor="#ffffcc"];
  P0 -> P1 -> P2 -> P3 -> Rescope;
  Rescope -> P0 [label="new question\nemerged" style=dashed];
  Rescope -> P4 -> P5 [label="no"];
}

Why no skipping phases: Phase 0 prevents wasted RPC calls on wrong targets or wrong chains. A single eth_getLogs to the wrong address can eat your entire rate limit. Lock scope first, then query.

Scope Amendment (Re-entry)

When Phase 3 interpretation reveals a new analytical question that changes the objective, the investigation loops back to Phase 0 in amendment mode. Without strict rules, this loop degenerates into "ask again" — so the state machine below governs every re-entry.

Valid rescope triggers:

TriggerExample
New unit of analysis discoveredInvestigating a vault → found the strategy contract is the real subject
Objective fundamentally changedStarted with "is this vault profitable?" → discovered potential exploit
Chain expansion neededFund flow leads to a bridge contract → need to trace on source chain

NOT a rescope (handle in-phase):

SituationInstead
Need more data on same targetContinue Phase 2 — add queries
Found unknown contract during analysisLoad contract-inspection.md via cascade trigger
Confidence too low on a findingApply Layer 5 (Confidence Deepening) — don't restart

Carry-forward rules: On rescope, the following are preserved unchanged unless explicitly overridden:

  • Chain, anchor policy, anchor block, capability tier, RPC endpoint
  • All existing evidence register entries
  • All pattern files already loaded

Only these fields may change: target, objective, unit of analysis, hypothesis, timeframe, additional pattern files.

Completion criteria per mode:

ModeDone when
🔍 ForensicRoot cause attributed with claim type + all fund hops traced to terminus or gap disclosed
📊 Due DiligenceAll decision-critical metrics computed + gaps flagged
📈 MonitoringCurrent state snapshot complete + health indicators evaluated
🏗️ Protocol AssessmentKey metrics + risk dimensions scored
🛡️ SecurityAdmin/upgrade/custody risk assessed + findings severity-ranked
🔭 ExploratorySurvey breadth covers user's question + open questions listed

Hard cap: Max 3 scope amendments per session. Beyond that, synthesize what you have and list remaining questions as Open Questions in Phase 5.


Phase 0: Scoping Gate — Active Consultation

This phase is a guided conversation, NOT a passive form. Read references/scoping-guide.md for detailed consultation techniques, depth/angle options, field-by-field asking guidance, and anti-patterns. Silently assuming scope details is the #1 cause of wasted RPC calls. Surface your assumptions as explicit questions.

Analysis Modes

TriggerModeEmphasis
Suspicious activity / incident🔍 ForensicFund flows, timeline, counterparties
Investment / trading decision📊 Due DiligenceRisk, PnL, position health
Portfolio / position monitoring📈 MonitoringCurrent state, health indicators
Protocol evaluation / comparison🏗️ Protocol AssessmentTVL, risk params, governance
Security review / audit prep🛡️ SecurityAdmin keys, upgrades, custody
General curiosity / learning🔭 ExploratoryBroad survey, teach as you go

If the user's request clearly maps to one mode, propose it rather than asking from scratch.

Required Fields

#FieldRequired?Default
1TargetYes
2ChainYes
3ObjectiveYes
4Unit of analysisYes
5HypothesisNo"Exploratory"
6TimeframeNoPer depth choice
7Expected outputNo"Structured findings + narrative"
8Data source policyNoraw RPC only
9Anchor policyNosafe if supported
10Capability tierAutoProbe-based
11RPC endpointAutoFrom references/rpc-endpoints.ts

Unit of analysis — Declare what object is being analyzed: wallet / contract / vault / pool / protocol / token. This prevents scope drift by making the analytical focus explicit. When the unit changes mid-investigation, that's a scope amendment trigger.

Anchor Policy Options

PolicyfromBlocktoBlockUse Case
safesafe tagDefault. Finalized, no reorg risk.
pinnedspecific hexspecific hexReproducible snapshot at known block.
latestlatest tagReal-time data, accepts reorg risk.
historical-scan0 or contract creation blocksafeFull-chain event scanning. Each event gets its own timestamp via eth_getBlockByNumber. Use adaptive chunking (see references/rpc-field-guide.md Section 5).

Decision Dependencies

Some conditions — not just missing data sources — can flip the analytical conclusion entirely:

ConditionImpactWithout Checking
External rewards (Merkl, Angle, etc.)LP/vault alpha reversalRaw alpha appears negative when net return is positive
Vesting schedule + unlock eventsSupply shockCirculating supply appears stable when unlocks are imminent
Oracle staleness + backup fallbackProtocol health misjudgedProtocol appears healthy when oracle is stale
Provider endpoint inconsistencyData conflictTwo endpoints return different logs for the same range — analysis built on partial data
Proxy upgraded during scan windowABI/layout mismatchEvents decoded with wrong ABI; storage reads return garbage for blocks after upgrade
Unresolved bridge legIncomplete fund flowFunds appear to vanish at bridge contract; actual destination chain not traced
Token/share conversion uncertaintyValue miscalculationVault share counted as underlying token; 1 share ≠ 1 token
Partial eth_getLogs coverageSilent truncationProvider hit result cap but returned no error; event history appears complete but is missing entries

If any decision-critical condition is unverified, flag it as: ⚠️ DECISION-CRITICAL GAP: [condition] unverified. Conclusion may reverse.

Blind Spot Disclosure

Before confirming, proactively flag what the analysis CANNOT see. See references/scoping-guide.md for templates.

Confirmation Gate

Present a structured summary before proceeding. Skipping confirmation

Como adicionar

/plugin marketplace add Omnis-Labs/defi-onchain-analytics

O comando exato pode variar conforme o repositório. Confira o README no GitHub.

Comentários · Nenhum comentário

Entre para comentar. Entrar

  • Ainda não há comentários. Seja o primeiro.