AI Agent Hub
Back to skills
EVM Log Correlation Pattern Detection icon

EVM Log Correlation Pattern Detection

IT Ops & Security Updated 2026.08.30

Paste the following prompt into your AI chat to install this skill:

Please install @user_d4087b8b/evmlog according to https://skillhub.cn/install/skillhub.md.

About this skill

Problem

With only a known EVM address, raw log rows are often fragmented: it is hard to tell which contract_address and topic0 event combinations are strongly associated with that address, or whether interactions are concentrated in a small set of counterpart wallets and contracts. EVMLOG turns that investigation into a repeatable statistical workflow: start from one address, then surface likely event patterns and candidate transaction paths.

How It Works and Where It Applies

The skill first pads the address to a 32-byte topic form, then queries a Dune log table in two directions: topic1=A* and topic2=A*. It aggregates results by (contract_address, topic0), counting hits, top counterpart addresses, top1_ratio, and gap_ratio to separate strong patterns from weak ones. Weak patterns can be expanded by increasing top_n and checking from/to context; strong patterns are followed by sample transaction hashes and event-sequence examples.

It fits cases where the address appears in topic1 or topic2, such as ERC20 Transfer, Approval, NFT transfers, DeFi custom events, and bridge events. It does not decode ABI by default, so topic0 to event-name mapping may need separate enrichment; very large ranges should be narrowed or run with a larger query tier.

Use Cases

  • Security analysts use log tables to find a suspicious wallet's frequent counterpart addresses and contracts across topic1/topic2, then infer flow patterns.
  • On-chain analysts investigate ERC20 approvals by aggregating contract_address and topic0 to locate high-frequency approval contracts and representative transactions.
  • Risk teams examine DeFi custom events by comparing counterpart-address share on topic1 and topic2 to identify contracts with concentrated interactions.
  • Investigators start from newly found addresses to extract unlabeled counterparts, related contracts, and sample transactions for follow-up tracing.

Best For

  • On-chain security analysts who need to isolate frequent contracts, events, and counterpart wallets from one known address.
  • Risk engineers querying EVM logs on Dune who want topic1/topic2 search results aggregated into reviewable CSV conclusions.
  • Transaction analysts auditing ERC20 Transfer/Approval anomalies who need strong patterns and representative transaction hashes.
  • Bridge event auditors who need to compare counterpart-address concentration on topic1/topic2 and discover new addresses.