Sample output · Trace

One real run, copied out unedited.

Not an illustration of what a report might look like. This is a Trace that The On-Chain Detective produced against live data, reproduced exactly as it arrived — including everything it declared about the limits of its own work.

Ran: 2026-09-09 20:15 UTC
Subject: 0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9 · ethereum
Question: is this safe
Overall confidence: probable
Ran, found nothing: 3
Could not run: 2

AAVE (ethereum): no findings within the checks that ran, but 2 check(s) could not be performed — see scope before reading this as clear.

Two checks could not be performed

This is the distinction the whole method turns on, and here it is in a real run. Three checks ran and found nothing. Two could not run at all. A screen where those are added together, or where the second kind is left out, reads as clean when it isn't — so the report separates them and leads with the second.

Sanctions list freshness (R7) — The local OFAC mirror was last refreshed 23 days ago.
Community abuse reports (R6) — No CHAINABUSE_API_KEY is configured.

Each gap also states its consequence: designations published in the last 23 days would not be detected, and the subject may have been reported for abuse without this investigation seeing it. The three checks that did run are recorded just as carefully — each one says what it rules out and, separately, what it explicitly does not. “No sanctions finding” rules out this address being designated today; it does not rule out association through an intermediary.

Why a declared gap is not a finding →

The card the agent renders

The Trace for 0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9 · ethereum as a shareable card: scores, flags, the written read, market data and the coverage record.

The agent generates this itself, in the same run. It is not styled to match this site on purpose — it travels on its own, into a thread or a chat, where our design isn't there to frame it.

The deliverable, in full

CLICKING · ON-CHAIN DETECTIVE · TRACE
──────────────────────────────────────────────────────────────────────────────
0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9
evm_address · ethereum · Wed, 09 Sep 2026 20:15:29 GMT
question: is_this_safe · overall confidence: probable

THE READ
AAVE (ethereum): no findings within the checks that ran, but 2 check(s)
could not be performed — see scope before reading this as clear.

The screened token shares its identifier with 2 other tokens across
different chains, which may complicate verification if relying on name or
symbol alone. Two critical checks—sanctions list freshness and community
abuse reports—could not be performed, so this screen does not cover those
risk dimensions. No other findings emerged from the checks that ran, but
the inability to complete those checks means the screening scope is
incomplete.

FINDINGS
[CONTEXT] identity-ambiguity (R2)
The identifier given also matches 2 other token(s) on other chains.
basis: observed · confidence: confirmed · cost to fake: trivial
This investigation covers AAVE at
0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9 on ethereum, selected by
traded activity rather than stated pool depth. Same-symbol impostors on
other chains routinely advertise larger depth than the genuine market,
so a depth-ranked resolution would have picked the wrong asset. If you
meant a different one, supply its contract address.
evidence: c_a1de81b48b92

COVERAGE — READ THIS BEFORE TREATING ANY ABSENCE AS A CLEAN RESULT
On ethereum, this investigation had: market data, contract screening,
sanctions screening. It did not have: community reports, transaction
history, entity attribution — conclusions in those areas were not
available and their absence here is a limit of coverage, not a clean
result. Boundary of this question: Whether the operators intend to act on
the powers they hold. A contract whose owner *can* mint is a structural
risk regardless of whether they have; this reports the capability, not a
prediction of its use.

NOT CHECKED:
○ Sanctions list freshness (R7)
why: The local OFAC mirror was last refreshed 23 days ago.
means: Designations published since then would not be detected.
Refresh before relying on a non-match for compliance purposes.
○ Community abuse reports (R6)
why: No CHAINABUSE_API_KEY is configured.
means: Victim reports were not checked. The subject may have been
reported without this investigation seeing it.

CHECKED AND FOUND NOTHING:
✓ sanctions (R7) — searched: OFAC SDN mirror, matched on the exact address.
rules out: That this specific address is itself currently
designated by OFAC.
does not rule out: Association with a sanctioned entity through
intermediary addresses; designation by an authority not covered by
these lists; or designation after the retrieval time shown.
Tracing association requires hop analysis and entity attribution,
which this build does not have.
✓ operator-powers (R8) — searched: GoPlus token-security screen: honeypot simulation, mint authority, balance-modify authority, blacklist, pausable transfers, ownership reclaim, hidden ownership.
rules out: The specific operator powers listed above being present
in the deployed contract.
does not rule out: Logic bugs, upgradeable proxies pointing at
future implementations, off-chain dependencies, or economic
designs that are harmful without being technically abusive. A
contract can be structurally clean and still be a bad asset.
✓ liquidity-reality (R29) — searched: Depth-to-activity across 28 pair(s): turnover 5.0%, 2100 trades in 24h.
rules out: The specific signature of decorated liquidity — large
stated depth against negligible trade activity.
does not rule out: Liquidity being removable at will. Depth that
is real today can be withdrawn tomorrow unless it is locked, and
lock state is a separate question from whether the pool is
genuinely traded.

EVIDENCE
[c_e1a142607e44] ofac-sdn — OFAC SDN crypto designations, 193 addresses, mirror refreshed 2026-08-17T04:56:27.578Z.
https://sanctionssearch.ofac.treas.gov/
[c_1f78278a517f] goplus — GoPlus token_security assessment for 0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9 on chain 1.
https://gopluslabs.io/token-security/1/0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9
[c_c90033e3ee71] dexscreener — Aggregated across 28 pair(s): $24,190,973 stated depth, $1,209,043 24h volume, 2100 trades.
https://dexscreener.com/ethereum/0x3de27efa2f1aa663ae5d458857e731c129069f29
[c_a1de81b48b92] dexscreener — Ticker collision: UNI on ethereum, 1INCH on ethereum.

──────────────────────────────────────────────────────────────────────────────
Investigative assessment only — not financial advice, not a legal
determination, and not a substitute for professional compliance screening.
Generated by an autonomous agent from public data at the timestamp shown.
Findings carry stated confidence levels; treat inferred findings as
inferences. Verify independently before acting.

Figures are a snapshot of the moment it ran. Re-running today would return different market data and could reach different conclusions — this build reads sources that report current state rather than a fixed block, and the report says so itself under provenance.

Every tier this agent offers, and what each one is for, is on its page.

The On-Chain Detective →