Case Study
Chimera
On-chain fraud analysis toolkit that assesses DeFi contract risk, correlates interacting addresses, and builds wallet intelligence profiles for investigative triage.
Problem
Financial crime and security investigations on-chain are slow when analysts hop between explorers. They need a structured path from vulnerable DeFi contracts to interacting addresses to ranked wallet intelligence — with false-positive filtering and exportable case documentation.
My role
Designed and built the full three-stage pipeline and local operator UI: contract risk assessment (DeFiLlama discovery, Etherscan source, pattern scan + Slither, FindingValidator), contract–wallet correlation with exposure ranking, and a 9-stage wallet intelligence profiler with OSINT modules and batch PDF reports.
Architecture
Technical decisions
Three-stage investigation pipeline
Contract analysis → correlation → wallet intelligence keeps each stage independently runnable while composing into a full case workflow for triage and documentation.
FindingValidator without LLM dependency
Pattern and Slither findings are auto-validated with deterministic checks (e.g. confirm tx.origin / selfdestruct presence, require after .call) so false positives drop before prioritization — without requiring an LLM.
Exposure-ranked correlation
Interacting EOAs are extracted from explorer history, filtered for exchanges/bots where configured, and ranked by estimated USD exposure so investigators start with the highest-value follow-ups.
Challenges
Scanner noise vs usable findings
Raw vulnerability scans over-report. Building validation that filters false positives while preserving high-priority, evidence-backed findings was essential for trust in the priority queue.
API rate limits and incomplete attribution
Explorer and balance APIs constrain throughput. The pipeline emphasizes lawful, best-effort triage signals — behavior, funding hints, OSINT — rather than claiming perfect attribution.
Outcome
A local on-chain casework toolkit with operator UI: protocol risk assessment across high-TVL DeFi targets, correlation into ranked address queues, multi-stage wallet profiling, and batch intelligence PDFs for investigation documentation. Built as security research tooling; intended for lawful, authorized use only.