Research archive
Incident Investigation
Transaction Reconstruction After Protocol Exploits
Methods for building a reproducible technical timeline from on-chain and infrastructure evidence.
16 April 2026Leon Varek 12 min read
Methods for building a reproducible technical timeline from on-chain and infrastructure evidence.
01 / Analysis
Reconstruction first
Reliable investigation begins with deterministic state, raw transaction inputs, internal calls, logs and the exact code active at execution time.
02 / Analysis
Separate cause from effect
Asset movement may be downstream of the original failure. Timeline construction should distinguish initial access, privilege expansion, execution and concealment.
03 / Analysis
Preserve evidence
Node data, deployment records and access logs should be preserved with clear provenance. A plausible narrative is not a substitute for reproducible technical evidence.
> research_position:
test assumptions at the boundary;
preserve evidence through failure;
make recovery an explicit system property.
test assumptions at the boundary;
preserve evidence through failure;
make recovery an explicit system property.