EntryPoint IntelligenceERC-4337 on Avalanche C-Chain Data to 2026-10-25

Data

Examples gallery

Real transactions, each explained claim by claim.

Each page below is rendered from a structured explain record: every claim carries a value and the evidence behind it. A small word after each fact gives its evidence grade (how the value was obtained), and a marker after each named address gives the evidence level of its label.

How to read the evidence markers

Evidence levels (how strong an address label is)

  • evidence level: primary source The vendor or protocol itself publishes this exact address
  • evidence level: self-description What the contract says about itself via a getter; contracts can claim any name
  • evidence level: cluster Shares a key, getter or bytecode with labelled addresses: same machinery, not proof of the same operator
  • evidence level: hint Ranking, explorer tag, metadata or third-party label: a clue, never proof
  • evidence level: unlabelled No registry label. In running text, an address without a marker has no label.

Evidence grades (how a value was obtained), strongest first

grade: observed grade: decoded grade: recomputed grade: recovered grade: contract read grade: inferred grade: unknown

Weaker grades are set in italics. Hover or focus a marker for its definition; full definitions.

7. What Oct 18, 2026 on C-Chain looked like

Whole observed EntryPoint traffic for UTC day 2026-10-18: 1,396 outer transactions, 1,397 UserOperations, 2.429945061704446240 AVAX in receipt fees. All outers succeeded; one op failed.

v0.6 v0.7 v0.9
Outer txs / ops 732 / 733 600 / 600 64 / 64
Receipt fees (AVAX) 1.532096 0.842294 0.055555
Distinct accounts 364 141 1
Distinct submitters (bundlers) 10 15 1
Paymaster-paid / self-paid ops 695 / 38 554 / 46 32 / 32
Account deployments 58 91 0
Decoded target legs / distinct targets 739 / 53 651 / 28 64 / 1

"364 accounts" means 364 addresses, not 364 people. The largest v0.7 account alone sent 165 ops.

The archetypes, each with a real example

Collateral withdrawals (v0.6, the biggest single target). Coordinator 0x5bbb435ec20154f016ee96041c3fdfe46354603a evidence level: hint received 432 withdrawAsset(...) legs in 431 outers. Of these, 343 USDt and 75 USDC singleton withdrawals are already approved transfers, and all request _directTransfer = true. Example 0x8782850a1ebb1358b89bb0e2f1e7c0b1f2713d64a615be24f0e986931bb006db: account 0x11042755…65f2 requests 2,200,000 base units (2.2 USDt) of 0x9702230a…a8c7 evidence level: primary source, Pimlico-sponsored, submitted by 0x4337005d…98b6 evidence level: hint. Known: request shape, assets and matching token records. Unknown: the application behind the coordinator. Signify/Rain is a clue, not a binding. 10 native-asset requests are not proven AVAX payments.

Fan-club passes, almost certainly Fan3 (v0.7). 161 approved safeTransferFrom calls move token id 0 out of three ERC1155 collections: Sara Landry's "The Afters Pass" (88, 0x4c4dbecc300eff89b88c5ce2923056a44000201a evidence level: cluster), Say Now's "Saylor City Pass" (64, 0x69e461a41f672237afe483dd0055dd171b44133e evidence level: cluster) and Max Richter's "Sleep Pass" (9, 0x82b6d5d249f24448807f1e865e9e31d1b6e6d8a2 evidence level: cluster). Each token's own metadata says what it is: "The Afters; the Sara Landry fan club Pass.", "The limited edition membership pass for Saylor City, brought to you by Say Now.", a limited-edition pass for the album Sleep. These are the product the fans were getting: a free-to-claim membership pass that unlocks ticket pre-sales and member perks.

Why Fan3: all three are thirdweb TokenERC1155 clones with one owner(), 0x37688ab18ac82307233f22aebb58a15ce613b025 evidence level: cluster. That key owns 15 such "Collectibles" contracts, each issuing a "Pass" (Pitbull, Tinie Tempah, Jessie Ware, Ronan Keating, Newcastle United FC, Truman Brewery and others), and sends their mintTo calls. One of them, 0x5c3a8db8e43d725463883b2a7b2ab0f0f99c19c4 evidence level: cluster, issues Pitbull's "Bald-E's Pass", which Avalanche's announcement names as Fan3's launch pass. Say Now's pass links to saynow.fan3.io ("Powered by fan3"), whose app is built on the thirdweb SDK. Fan3's FAQ describes exactly this: passes are NFTs, free to claim, sign-in by Google or email, so fans get a smart account and a sponsored claim rather than a wallet of their own. Evidence: an archived copy of the source (getters at block 98,441,238, plus the IPFS metadata).

Example 0x18f586af63e7812d57e167fccaf8fc0b31b3da2c6c2e7cef102a09bd2638264e: account 0x8efb14b8…4d10 sends 1 Max Richter Sleep Pass (token id 0) to 0x51a0b2d4…4c88, sponsored by paymaster 0x5fa66dfe…a4ab evidence level: hint, submitted by 0x744d6e01…5dd1 evidence level: hint. Strong inference, not primary source: Fan3 operates these collections (it publishes no contract addresses). Unknown: who the individual fans are, and how involved each artist is beyond the branded pass.

Signed daily-result registry (v0.7). 175 ops call 0x1e781cbd on 0xfb315bbe8c1ae254b6ea88afe2d38139c3148a3f evidence level: self-description. Each carries (F0 day, F1, F2, F3 deadline, signature), where the signature is an EIP-712 attestation (domain Avax-dle) from one signer, 0x359ad9b2c381e1e1cc373551a12bf6033842ae74 evidence level: cluster. 100 accounts took part; 75 were deployed that evening by factory 0x863b8e15d37abf33d5177108f6a07d541a698d25 evidence level: hint, sponsored by paymaster 0x25ff7720…df9, bundled by 0x28738746aaafd124f8796d916dc5d9f07d8d7b7b evidence level: hint. Example with deployment: 0x4ee9e9e25a46be48a5e2ca2306b0c047b75a86668e018e3a9e211ba28b7c98fa (account 0x2485c0de…dcdf). Proven: a signer-attested per-participant daily record with streak-like state; the contract moves no tokens. Unknown: the public app, and what F1/F2 mean. "-dle" is a clue, not proof of a word game.

Scheduled probe accounts (v0.6 + v0.7). Account 0x34551da0a1c30149667f0fc189d7724995f71119 evidence level: cluster (v0.6) and 0x9be1b9b87d189df444f4f8a66f1a50398bceba37 evidence level: cluster (v0.7) each sent 120 ops: an empty, zero-value call to address 0. Every one of the 96 quarter-hour slots is covered, each op has a fresh nonce key with sequence 0, and all 240 signatures recover to 0x8fd379246834eac74b8419ffda202cf8051f7a03 evidence level: cluster. Examples: 0x205b550f8cf4462ca048872d6b5df61b1e841d5b2f050657e11f7affd6339049 explained → (v0.6, Pimlico v0.6 paymaster) and 0xb5124fb1689d02f6fad461d3487e57afc0a321e02447b4fe613f486d4b9a4788 (v0.7, Pimlico v0.7). Strong evidence: one coordinated scheduled workload. Inference only: that it is infrastructure monitoring, and who runs it.

Safe self-calls via the Candide module (v0.6, v0.7, v0.9). Three Safes send empty zero-value calls to themselves: 0x58aa5729…696b evidence level: cluster (v0.6, 18 ops), 0xe96e4060…6c1f evidence level: cluster (v0.7, 65), 0xa1fdd9daed9004f685b6900d5463f72d13dfccca evidence level: cluster (v0.9, 64, nonces 8516→8579). All 147 signatures recover to 0x0f88ef66eea497e7bc54b3b7a871b138a1f0bc9f evidence level: cluster under each version's own SafeOp schema (v0.6 uses a legacy uint256 layout; the later schema gives wrong results). All are submitted by 0x3cfdc212769c890907bce93d3d8c2c53de6a7a89 evidence level: cluster. The v0.9 module 0x22939e839e3c0f479b713eaf95e0df128554aead evidence level: primary source matches Candide's published constant. Examples: 0x1edcd542859e091aeaa7b9fc069255cf6f42f7ad0e34db22dc6729cc58f15448 explained → (v0.9), 0x572444e6ec6583f42b063199be809fc69d5959ab8a49f92461766a5598bde63a (v0.7, self-paid), 0x43bf538a3cba3a503b3a63cbdbd66a6c2f25e79efdb2e987eb730d75ed890b7c (v0.6). Consistent with Candide's documented live monitoring. Not proven: no public source binds these exact accounts. This is the only v0.9 traffic on Oct 18.

LI.FI routes (v0.6 + v0.7). LI.FI's diamond 0x1231deb6f5749ef6ce6943a275a1d3e7486f4eae evidence level: primary source (bound to LI.FI's official deployments file) appears in 20 outers. Example 0x6af4bb5b034d8462aae51e42c34df6f47cf13e2295b39730de88a3f41a43ec45 explained → (v0.7): swapTokensMultipleV3NativeToERC20 with integrator string "bitpanda" and two inner swap descriptors, from account 0xc4d96305…8035. A v0.6 example: 0x4d47531659364b9e64140f25a11d8b1198cd03603e721e7919d628f2a78910cd (approve + LI.FI call 0x5fd9ae2e, a facet not yet decoded). Known: the requested route. Unknown: full realized route, and destination arrival.

Small mints and app calls (v0.6). 49 fungible mints of exactly 10^18 across ten ERC-20s with names like EtherArcade, and 39 NFT mints across eleven collections. Each one has a matching zero-from Transfer. Example 0x3b818a650700d009dc5f9ec2cb65acd97759e9add434c30694b63b99ae43ad5d: mint(account, 1e18) on 0x89994c4282d18efc56fe74c3a5cdb76b39780d22 evidence level: self-description ("EtherArcade"/ERCA). Plus postMessage, setStatus, addContact… calls with timestamped strings. Not established: that these are games, real projects or bots.

Cross-chain sends. The walk-through transaction (Relay deposit after a Kernel deployment) and the failed CCTP op above are examples. On Oct 18, ten v0.7 operations (this one included) share the shape "deploy a Kernel account via the ZeroDev meta factory, Pimlico-sponsored, then approve → Relay depositErc20 → approve(0)".