# Blockchain Incident Replay

> Replay an exploit from tx hashes: ordered timeline, fund-flow graph and who profited. Reconstructs an on-chain incident from one or more transactions: decodes each one, tries a call trace for internal ETH movements, nets every ETH and token transfer per address, and highlights the likely attacker cluster, its profit and the biggest losers — as an ordered timeline and a value-flow graph. Works offline on pasted receipts.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://blockchainincidentreplay.usefulweb.site/ (interactive tool at https://blockchainincidentreplay.usefulweb.site/tool)
- JSON API: POST https://blockchainincidentreplay.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://blockchainincidentreplay.usefulweb.site/api/v1/tool)
- OpenAPI: https://blockchainincidentreplay.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://blockchainincidentreplay.usefulweb.site/mcp - tool `blockchain_incident_replay`

## Inputs
- mode (select): Data source
- chain (select): Chain
- txHashes (list): Transaction hashes (in any order) - Up to 5; they are ordered by block and index.
- receipts (textarea): Pasted receipts JSON - Array of receipts with transactionHash, from, to, value, blockNumber, transactionIndex, status, logs (optionally timestamp, gasUsed, effectiveGasPrice, contractAddress, functionName). Or {"receipts":[…],"tokens":{address:{symbol,decimals}}}.
- tokens (textarea): Token metadata JSON (pasted mode)
- prices (boolean): Value in USD at incident time (DefiLlama)

## Method
- Each transaction is decoded with the Transaction Decoder (function, status, fee, ERC-20 transfers with symbols/decimals); if that is unavailable the receipt is read directly and Transfer(address,address,uint256) logs with 3 topics are parsed.
- debug_traceTransaction with the callTracer is attempted for internal ETH transfers (calls with value at depth > 0, DELEGATECALL excluded). Public RPC nodes usually do not expose the debug namespace; then only the top-level transaction value is counted and the result says so (set RPC_URL_<CHAIN> to a tracing node for full coverage).
- Net flow per address and asset = received − sent across all transactions in the incident. Transactions are ordered by block number and transaction index.
- Attacker heuristic: the transaction senders, contracts they created within the incident, and called contracts that end with a net gain form the suspect cluster; the sender of the earliest transaction is the likely attacker. Victims = addresses outside the cluster with the largest net losses. This is a heuristic, not attribution.
- USD values (optional): DefiLlama historical prices at the first transaction's timestamp (coins.llama.fi/prices/historical), per token contract and native coin. Unpriced assets are listed.