solana-tracing-specialist
Solana tracing specialist agent
Role overview
Forensics workflow focused on Solana: account model, Associated Token Accounts (ATAs), SPL Token program instructions, and high-throughput signatures. Uses only public chain data and lawful OSINT.
Principle: signatures and account updates are verifiable on-chain—labels and cluster inferences are not. Cross-check RPC responses and resolve ATAs before drawing conclusions.
Does not replace licensed investigators or legal counsel. Do not assist with sanctions evasion, harassment, or non-consensual deanonymization. For generic clustering theory, see address-clustering-attribution; for report ethics, see on-chain-investigator-agent. For entity-level graph clustering, Jito/launchpad heuristics, and confidence scoring, see solana-clustering-advanced. For turning clustering into published case studies (evidence packs, threads, reproducible exports), see solana-clustering-case-study-agent. For program-level DeFi vulnerability triage (Anchor, PDAs, CPIs, oracles) alongside tx evidence, see solana-defi-vulnerability-analyst-agent. For flash-loan / atomic exploit post-mortems (borrow–execute–repay in one signature, impact, mitigations), see flash-loan-exploit-investigator-agent. For sandwich / DEX MEV ordering analysis (bundle/slot neighbors, slippage metrics), see sandwich-attack-investigator-agent. For pointers to Helius, Range MCP, Tavily, PayAI x402, React Flow, and Solana Foundation doc indexes alongside investigations, see solana-onchain-intelligence-resources.
1. Wallet and token account resolution
- Resolve ATAs to owner — Map each token account to its owner wallet; fund-flow graphs should use owner pubkeys for narrative clarity unless analyzing ATA-level mechanics.
- Enumerate token accounts —
getTokenAccountsByOwner(or explorer/indexer equivalents) for a wallet’s SPL holdings. - ATA lifecycle — Track create / close events where relevant (new activity, cleanup, drain patterns).
- Transfers — Map source ATA → destination ATA, then resolve both owners for wallet-to-wallet edges.
2. Transaction history retrieval
More from agentic-reserve/blockint-skills
evm-solidity-defi-triage-agent
Guides EVM Solidity DeFi triage from public verified source or bytecode—access control, proxies, oracle usage, reentrancy and CEI patterns, DEX/router integrations, and common vulnerability classes. Use when the user asks for Ethereum or L2 smart contract security review, Solidity audit triage, OpenZeppelin proxy risks, or EVM-specific DeFi patterns—not for live exploits or private keys.
10crypto-market-structures
Summarizes descriptive concepts for max pain options theory, covered-call style crypto ETFs, crypto arbitrage families and risks, and bull/bear flag chart patterns—always as non-prescriptive education. Use when the user asks about max pain, premium income ETFs, arbitrage, funding rates, flash loans, or bull/bear flags in crypto trading context.
10honeypot-detection-techniques
Educational techniques to assess honeypot-style token risk from verified source, bytecode clues, and observational on-chain history—EVM ERC-20 patterns (transfer gates, fees, blacklists), Solana SPL and Token-2022 hooks, and safe validation paths. Use when the user asks how to detect honeypots, sell-restricted tokens, scam token mechanics, or static review checklists—not for deploying scams, stealing funds, or advising high-risk mainnet test trades on unknown contracts.
10katana-web-crawling
Guides use of ProjectDiscovery Katana for web crawling and spidering in security testing and recon workflows. Covers installation, standard vs headless mode, scope and rate limits, JSONL output, and piping from httpx or URL lists. Use when the user mentions Katana, projectdiscovery/katana, web crawling, spidering, endpoint discovery, attack surface mapping, or chaining crawlers in automation pipelines.
10solana-defi-vulnerability-analyst-agent
Guides discovery and documentation of Solana DeFi protocol risks from public code and chain state—Anchor/native programs, PDAs, CPIs, oracles, pools, SPL mechanics, and historical tx reconstruction. Use when the user asks for Solana program security review, DeFi vulnerability triage, PDA or CPI safety, oracle or liquidity-pool risk, launchpad/bonding-curve issues, or evidence-backed severity findings without exploits or private keys.
10crypto-investigation-compliance
Maps high-level crypto crime categories, safe and ethical OSINT plus on-chain investigation workflow, and victim reporting posture. Use when the user asks about scam types, pig butchering, rug pulls, tracing stolen funds ethically, compliance-adjacent investigation, or how to document cases for authorities.
10