Sigvex
EVMOperations2 min read

Evidence Graph

Map an incident as a graph — link addresses, contracts, transactions, findings, and code locations with typed relations to build a shareable picture of how an attack fits together.

Open Evidence GraphAll guides
forensicsevidenceworkspacecase-study

Evidence Graph is where the pieces of a case become a picture. You add nodes for the things involved in an incident — addresses, contracts, transactions, findings, code locations, exploit capsules — and connect them with typed relations, until the graph shows how the attack actually fit together.

Why it exists

A serious incident produces a pile of facts: a drain transaction, the contract it hit, the function at fault, the attacker address, the exchange the funds reached. Held as a list, the connections between them are hard to see and harder to hand to someone else. Evidence Graph makes those connections explicit and visual, so the relationship between a finding, the code it lives in, and the transaction that exploited it is one edge you can point at — and the whole case is one artifact you can share within a workspace.

Who uses it

  • Auditor — links each finding to the exact code location and the transaction that demonstrates it.
  • Red team / blue team — build a shared attack picture, tagging who contributed each node.
  • Incident responder — assembles the address-to-off-ramp trail as a graph the rest of the team can follow.

How to open it

  1. Sidebar → Evidence Graph.
  2. Direct URL — /evidence-graph.

Building the graph

  • Add a node — pick a type (address, contract, transaction, finding, code location, exploit capsule, on-chain incident) and give it a label, e.g. lending:Drain $1.2M or contract:0xdef….
  • Add an edge — connect two nodes with a relation that names how they relate (for example, a finding is located in a code location, or a transaction exploits a contract).
  • Load demo data to see a worked example, and Clear graph to start fresh.

The graph is scoped to a workspace, so everyone on the case sees and builds the same picture, and each node records the role that added it.

Limits

  • Evidence Graph is a modelling surface — nodes and relations are what you assert, not something inferred automatically. It records your analysis; it does not replace it.
  • It captures structure, not raw evidence bytes — attach the underlying transaction, capsule, or finding it points at from their own pages.
  • Transaction Trace — the execution detail behind a transaction node.
  • Exploit Capsule Detail — the sealed reproducer an exploit-capsule node refers to.
  • Watchlist — track the addresses a graph implicates as the case develops.