Not a hypothetical. A repeated, documented failure.
Flagged. Not explained.
LayerZero flagged over 800,000 sybil addresses. Linea's sweep initially caught over half its eligible wallets before walking most of that back. Arbitrum's shared-funding heuristic restricted real users who happened to withdraw from the same exchange. None of it came with a reason a flagged wallet — or an outside reviewer — could actually inspect.
The fix
0.85
the ceiling this model will ever return — never sold as a normalized 1.0
A known-funder registry — 10 labeled bridge contracts, 100 exchange hot wallets — is checked before a shared funding source ever counts against a wallet. Labelled and unlabelled funders are scored separately, and the higher wins.
See the risk model →Four campaigns, the same failure
800,000 flagged.
May 2024 — out of a 1.28M-wallet eligible pool, with a CEO-acknowledged amnesty program on top.
137,000-wallet gap.
50.45% initially flagged, walked back to 39.85% — the cost of a detector nobody could ask "why me?"
Real users caught.
Shared-funding clustering, no exchange or bridge exclusion list — the exact signal this registry now guards.
Thousands, forgiven.
A bounty for human-reported sybils produced false positives that had to be reversed after the fact.
One pipeline. Four Graph products.
Token API, Standardized Subgraphs, Substreams, and Subgraph MCP compose into one evidence pipeline — driven by one schema-family query pattern reused across every protocol supported. That reuse, not any single API call, is the actual composability claim.
Token API · Standardized Subgraphs · Substreams · Subgraph MCP
See how each product is used →A stale query never becomes a yes.
A stale Graph query, an unhealthy deployment, a timed-out World verification — none of these resolve to ALLOW. They resolve to PENDING_REVIEW. An unknown wallet is not a safe wallet; absence of history is missing evidence, never a clean record.
See the claim flow →Verified live. Not from memory.
Every claim below was checked against a real Postgres, a real Redis, a real chain, and a real phone — not asserted in a spec and left there.
- CH 012026
Coordinated cluster
Funding + timing correlation
A coordinated 5-wallet cluster scores BLOCK at ≈0.85 — the ceiling the model will ever return, because 0.15 is deliberately reserved rather than pretending the score is normalized to 1.0.
- Funding correlation
- Timing correlation
- Shared counterparty
- CH 022026
Clean wallet
Deterministic scoring
The same five weighted features return ALLOW for a wallet with no coordination signal — no hardcoded exception, no manual override.
- Token API
- Standardized Subgraphs
- Postgres + Prisma
- CH 032026
Unknown wallet
Fail-closed policy
A wallet Xander has no evidence for always resolves PENDING_REVIEW — never a confident ALLOW just because nothing bad was found.
- Freshness guard
- World ID escalation
- Provenance guard
Two people. One seam between them.
Suganthan owns the Evidence & Risk Engine — Token API, Subgraphs, Substreams, clustering, scoring (Phases 1–12). Sylesh owns Decision, Escalation & API — the Subgraph MCP investigator, World ID Selfie Check, policy engine, the Claim Gate (Phases 13–25). The two tracks meet at exactly one interface: getOrComputeClusterRisk, refreshWalletEvidence, and the risk-invalidation queue. Built for ETHOnline 2026.
The evidence trail, in noir-o-vision — hover to lock the signal
Nothing here is asserted twice.
Query it yourself. No setup.
The xander subgraph is deployed and fully synced on Base Sepolia at v0.0.3 — open the GraphiQL playground and pull the five most recent real USDC Transfer events, live, with no fixture data involved.
Built for ETHOnline 2026
Targeting two sponsor prizes: Best Use of Composable or Standardized Graph Products (The Graph, $5,000) and Selfie Check (World, $7,000 pool across up to 3 teams).
The prize tracks this build is aimed at — not a neon sign
Every score traces back to a real transfer, a real block number, and a real deployment. Start with the README, or go straight to the data — nothing here is inferred or fabricated.