78 posts tagged with "xatu"

The name is the trap. beacon_api_eth_v3_validator_block has a slot, an execution block number, gas used, transaction count, blob gas, and payload values. It looks like a block table.

It is not a block table in the canonical sense. Across two complete UTC days, I joined Xatu's raw /eth/v3/validator/blocks/{slot} rows to the eventual canonical block for the same slot. Only 82 of 195,448 joined rows matched the canonical execution payload shape. In 14,312 of 14,341 canonical slots, not one observed v3 row matched the payload that actually landed on chain.

block and head sound even cleaner than block_gossip. A block event says the beacon node saw a block. A head event says fork choice moved to it. If those rows show up hours after the slot started, the first question should not be "did Ethereum propagate blocks hours late?" It should be "what denominator did I just use?"

The denominator was the row.

block_gossip sounds like the clean block-arrival clock. Most of the time it is. Then Caplin shows up with canonical block roots arriving eight minutes after the slot started, which is not how blocks propagate on Ethereum unless something has gone very wrong.

Nothing went very wrong.

The per-contract ERC-20 transfer leaderboard looks sane for about three rows. USDT is first, USDC is second, WETH is third, and then individual tokens whose names look like USDT, USDC, and ETH start showing up. Aggregated as a family, those lookalikes belong above WETH.

From June 17 through June 23 UTC, 19 Unicode lookalike contracts in the top-50 ERC-20 event sources emitted 4,858,242 unique Transfer logs. Real USDC emitted 4,929,166. The lookalikes got almost the same event count from 47,703 transactions, while USDC needed 1,596,999 transactions.

The top ERC-721 transfer source last week was not a mint everyone suddenly cared about. It was a mirror contract.

From June 17 through June 23 UTC, ORE404Mirror emitted 273,448 unique ERC-721 Transfer logs from 740 transactions. That made it the busiest ERC-721 event source in Xatu's new execution tables, more than 7x the next contract by deduped event count. The awkward part is that the verified source says exactly what it is: contract ORE404Mirror is DN404Mirror.

Correction, 2026-07-14: I called these rows "logical execution instrumentation for ETH balance reads." The count was right, but the noun was wrong. Xatu gets this table from Cryo's projection of Geth's prestateTracer, so each row is a transaction-account prestate record, not a BALANCE opcode or repeated-read counter. The fee-recipient one-row-per-transaction result survives. I wrote up the correction here.

USDT was not the hottest address in the balance-read table.

I expected the usual suspects: USDT, USDC, WETH, routers, precompiles, some unlabeled contract that every block touches. They are all there. But the biggest line in the one-day sample was a builder fee recipient, because the execution path records a balance read against the block author once per transaction.

That sounds obvious after you see it. It was not obvious from the table name.

The new Xatu execution tables are exactly the kind of thing I like: raw enough to be dangerous, tidy enough to query without crying. Then I opened canonical_execution_native_transfers and got a very silly-looking leaderboard.

USDT was the top native-transfer recipient.

I opened the new contract-creation table expecting the usual factory soup: account abstraction wallets, Uniswap pools, NFT leftovers, random deployer spam. XEN was sitting in the middle of it again, quietly copying the same tiny contract over and over.

Not metaphorically tiny. Forty-five bytes.