FORENSIAWeb3 forensicsOpen workspace

The public contract registry

Where the contract names in a result come from, how narrow the list is on purpose, and how matching works.

2 min read · Screening and labels

#Plain languageIn plain terms

A raw address tells you nothing. Knowing that an address is the USDC token, or the Uniswap router, or a bridge to another network, changes how you read every transfer that touches it.

Forensia names a contract only when the project that runs it has published the address in its own documentation. The list is small and hand-checked. An address with no name is simply not on the list. That says nothing about it.

#How it worksHow it works

  1. Look up the searched address in the registry for this network.
  2. Look up every sender, recipient and token contract in the activity.
  3. Attach the name and category to each match, along with the link to the documentation it came from.
  4. If a match is a bridge or a privacy pool, add the caution that goes with it.

#Technical detailThe exact rules

Each entry holds an address, the networks it applies to, a category, a name, the URL of the primary documentation listing it, and a short note. The registry holds 77 entries.

CategoryEntriesExamples
Cross-chain bridge45Across, Arbitrum, Base, OP Mainnet, Polygon, Hop, Stargate, Synapse, Wormhole
DEX router15Uniswap, 1inch, 0x, Curve
Token contract9USDC on six networks, USDT, WBTC, WETH
Privacy pool8Tornado Cash pools and router, RAILGUN

Matching is exact and scoped to the network. The same 20-byte address on a different network is a different deployment and is never assumed to be the same contract. Label sets scraped from block explorers are deliberately excluded, because their terms do not allow reuse.

MatchFindingClass
The subject is in the registryfinding:known-contract-subjectAttribution
Counterparties are in the registryfinding:known-contract-counterpartiesObserved
Any match is a bridgefinding:cross-chain-boundaryLimitation

The counterparty finding names up to 6 matched contracts and counts the rest. On the graph, a matched node is labelled with its registry name.

Named contracts also behave differently elsewhere. Token tracing stops at a known shared service. The fan-out detector ignores registry contracts as recipients. On the graph, a named contract is never folded into a group.

#LimitsWhat it does not tell you

  • Exchanges, individuals and most services are not in the registry. It lists infrastructure contracts only.
  • An unlabelled address is not in the registry. It is not thereby unknown, suspicious or safe.
  • A transfer involving a privacy pool is an observed interaction. It does not link a deposit to a withdrawal.
  • The registry is a fixed list compiled on a date. A project can deploy new contracts that are not yet in it.
  • Bitcoin addresses are not covered.