Anomalous Transaction Pattern Detector

WHAT IT DOES

Anomalous Transaction Pattern Detector is a read-only security tool that identifies unusual transaction patterns in EVM smart contracts using statistical analysis. It reads transaction history for a contract, establishes baseline patterns for gas usage, transfer values, and transaction frequency, then flags transactions that deviate significantly from the norm. The tool calculates mean and standard deviation for gas usage and transfer values, identifies transactions that exceed 2-3 standard deviations from the mean, detects high-frequency transaction bursts, and assigns an overall anomaly score and severity level (Low, Medium, High, Critical). It helps developers and security teams quickly identify potentially malicious transactions, unusual contract activity, and outlier behavior that may indicate exploits or attacks.

HOW TO USE

Connect your EVM-compatible wallet via the BGWallet bridge and select the network where your contract is deployed. Enter the contract address and specify the number of recent transactions to analyze (10-100). Click "Detect Anomalies" to fetch transaction data and perform statistical analysis. Results include an anomaly score, overall severity level, average gas and value statistics, a list of anomalous transactions with detailed reasons for each flag, and a visual progress bar indicating risk level. The tool flags transactions with unusual gas usage, abnormal transfer values, and high-frequency patterns. All analysis is read-only—no signatures or transactions are submitted.

TECHNICAL MECHANISM

The tool uses ethers.js v5.7.2 to fetch transaction data via the provider. It retrieves contract logs to identify transaction hashes, then fetches transaction details and receipts for each hash using provider.getTransaction() and provider.getTransactionReceipt(). Block timestamps are retrieved via provider.getBlock(). The tool calculates statistical baselines: mean and standard deviation for gas usage and transfer values. Anomalies are detected using z-score analysis (transactions exceeding 2-3 standard deviations are flagged), plus frequency analysis (transactions less than 5 seconds apart are flagged). Each flagged transaction receives a score (gas anomaly: 1-3 points, value anomaly: 1-2 points, frequency anomaly: 1 point). Anomaly scores are summed to produce an overall severity: Low (≤2), Medium (3-5), High (6-10), Critical (>10). The tool also handles insufficient data cases (fewer than 5 transactions) by returning a "low data" message. All analysis is statistical and does not determine intent—only flags patterns that deviate from established norms.

WHAT IT CANNOT SEE

This tool has fundamental limitations that users must understand. It cannot definitively determine if a transaction is malicious—only flags statistical anomalies that may be benign (e.g., a legitimate large transfer or unusual gas usage due to complex logic). It cannot detect zero-day attack patterns that do not deviate from normal behavior—attacks designed to mimic normal patterns will not be flagged. It cannot analyze transactions that occur off-chain or in private mempools—only on-chain transactions are visible. It cannot establish a baseline without sufficient historical transaction data—contracts with few transactions will produce unreliable results. It cannot detect anomalies in contracts with highly variable or unpredictable usage patterns—high natural variance reduces the effectiveness of statistical detection. It cannot automatically classify anomalies as benign or malicious without manual review—the tool provides flags, not judgments. It cannot detect anomalies in contract state or storage changes—only transaction-level metrics. It cannot analyze contracts that have not been deployed or that have no transaction history. The tool's statistical thresholds are fixed and may need adjustment for specific use cases.

PLEASE NOTE

This tool only supports EVM-compatible blockchains (Ethereum, Polygon, BSC, Avalanche C-Chain, Optimism, Arbitrum, and their testnets). Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. The tool is free, open-source, requires no API keys, and uses the wallet's native provider for all read operations. Anomaly detection is a statistical aid—always manually review flagged transactions and investigate further before taking action.