Method & sources · EntryPoint Intelligence

Three kinds of data

A daily parquet archive of C-Chain blocks, transactions and logs: Every block, receipt and log since the start of the archive, partitioned by UTC day. It answers population questions — how many outer transactions and UserOperations, which accounts, paymasters, factories and bundlers, successes, failures, fees — from event logs. It stores only the first four bytes of each transaction’s input, so it cannot say what an operation asked for, who signed it, or what paymaster data it carried.
An indexed transaction database: Full transactions, including complete calldata and logs, looked up by hash or by address and block range. It answers the per-transaction questions: decoding handleOps, each operation’s fields and call data, recomputing the userOpHash and recovering signers. It holds no contract state and no internal calls.
Archive and trace RPC: Contract state at a given block (owners, implementations, modules, deposits, token metadata) and internal call traces (native value moved inside a transaction, the beneficiary’s compensation, where a revert happened). A getter read at a block is a point-in-time fact, not continuous control.

Which source answers which question

Question	Bytes / logs that answer it	Block archive	Transaction database	Archive / trace RPC
Is this an EntryPoint tx, and which version?	`to` + selector; emitter of `UserOperationEvent`	✅ `to_address`, `input_prefix`; events	✅	–
How many ops, who are the senders and paymasters, did they succeed, what did they cost?	`UserOperationEvent` topics + data	✅ full logs	✅	–
Was an account deployed, by which factory?	`AccountDeployed`	✅	✅	–
What exactly did each op request (targets, amounts, batch legs)?	`handleOps` calldata → op.callData	❌ selector only	✅ full calldata	–
Who signed? (signature recovery)	op.signature + recomputed userOpHash	❌	✅	sometimes: owner getters to cross-check
Paymaster mode / validity window?	`paymasterAndData`	❌ (Pimlico's `UserOperationSponsored` log helps)	✅	–
What actually happened in the apps?	target contracts' own logs in the execution window	✅	✅	trace for calls with no logs
Native AVAX moved inside (compensation, value calls)?	internal calls, no logs	❌	❌	✅ `trace_transaction` / balance diffs
Account implementation, owners, modules, deposits?	contract state	❌	❌	✅ `eth_call` at a block (a point-in-time fact only)

Public sources behind the address labels

eth-infinitism releases – EntryPoint v0.6/v0.7/v0.8/v0.9: https://github.com/eth-infinitism/account-abstraction/releases/tag/v0.X.0. Also in Candide abstractionkit src/constants.ts. v0.6/v0.7 runtime code equals Ethereum mainnet; v0.8/v0.9 differ (EIP-712 immutables include chainId, expected).
Multicall3 – https://github.com/mds1/multicall (deterministic address; code hash equals mainnet).
Safe – safe-global/safe-deployments JSON files list chain 43114 explicitly for v1.3.0 and v1.4.1 singletons/factories/libs. Safe 4337 modules come from safe-global/safe-modules-deployments (v0.2.0 for EntryPoint v0.6, v0.3.0 for v0.7): those files list other chains with the identical address; code hash on 43114 equals mainnet.
Candide – candidelabs/abstractionkit src/account/Safe/constants.ts DEFAULT_SAFE_4337_MULTI_CHAIN_SIG_MODULE_V1 (Safe 4337 module used with EntryPoint v0.9).
Pimlico – pimlicolabs/docs references/paymaster/erc20-paymaster/contract-addresses.mdx (singleton paymasters 0x6666…/0x7777…/0x8888… for EntryPoint v0.6/v0.7/v0.8; same address on all chains; code hash equals mainnet).
LI.FI – lifinance/contracts deployments/avalanche.json (LiFiDiamond).
Imported research: application targets, signer clusters, token/collection names read at block 97,922,545. Levels follow what that research established (mostly cluster, self_description or hint).
Vendor lists found by the web-research pass – each such label carries its own URL in source (see the label). Explorer name tags (Snowtrace/Etherscan) are recorded only as hint.
On-chain discovery: the EntryPoint index ranks bundlers (outer tx from), paymasters (UserOperationEvent topic3) and factories (AccountDeployed data word 0) by all-history activity plus the top of the last 90 days. For each, one Multicall3 batch at the pinned block reads name(), symbol(), VERSION(), version(), eip712Domain(), entryPoint(), owner(), getOwners(), getThreshold(), accountImplementation(), implementation(), accountId(), masterCopy() and EntryPoint deposits, plus eth_getCode (size, keccak hash, EIP-7702 delegation) and EIP-1967 slots.

Same runtime code hash as a primary-source contract → cluster (code-hash-match).
Same owner() key as a primary-source contract of a named protocol → cluster (owner-cluster, cluster:<protocol>); otherwise shared owners are listed in notes.
A naming getter answered → self_description.
Otherwise → hint named "Unattributed #".

AA vendor sources (2026-10-19 pass): every URL is in the label's source; an excerpt with URL and fetch date is stored under an archived copy of the source and named in notes. Summary in a project output file. thirdweb-dev/js smart/lib/constants.ts, coinbase/smart-wallet README + releases, alchemyplatform light-account and aa-sdk, eth-infinitism v0.6.0 deployments/mainnet/SimpleAccountFactory.json, Biconomy docs (SA v2 contracts, contracts-and-audits), zerodevapp/sdk core/constants.ts, pimlicolabs/4337-stats data/paymasters.csv, Circle developer docs (gas station, paymaster, wallet upgrades) and circlefin/buidl-wallet-contracts, Candide developer docs, trustwallet/barz deployments/avalanche, AmbireTech/ambire-common, okx/AccountAbstraction, Superform docs, the 0xGasless npm package, etherspot repos, MiraclePlayTeam address list, safe-deployments v1.5.0. Tokens: Circle USDC addresses, tether.to supported protocols, ava-labs avalanche-bridge-resources, ava-labs/wrapped-assets, ava-labs/public-chain-assets C-Chain token list. Token labels carry symbol and decimals read by getter at the pin block.

Tags: chain-listed = the source names Avalanche/43114; crosschain = all-chains / no chain scope. The builder compares C-Chain runtime code with Ethereum mainnet and keeps primary_source only if equal, or if the only differing bytes are the cached chainId and the EIP-712 domain separator derived from it. Otherwise the label is downgraded (xchain-code-mismatch), e.g. Biconomy "Verifying Paymaster v1.1.0" 0x00000f79. if-code = a vendor address that is dropped unless it has code on C-Chain.
Implementations reported by a primary factory's accountImplementation()/implementation() -> cluster.
owner() keys of primary vendor contracts -> cluster label "owner() key of contracts". It is an admin key, never an operator identity. CREATE2 deployer proxies and sentinels are never used as owners.
Third-party attributions (BundleBear, Pimlico's 4337-stats for other vendors, other vendors' SDKs, explorer tags) and sender/factory co-occurrence are recorded in notes / 3p:<vendor> tags at hint only.

Third-party explorer lookups

171 C-Chain addresses were looked up on both sites. They include bundlers, paymaster/factory owner keys, hint-level paymasters and factories, app contracts and previously documented keys. The browser was a standard browser and did not log in. Both sites are third-party, so their labels are merged as notes plus 3p:arkham:<entity> / 3p:snowtrace tags and never change an evidence level. Running registry/build_labels.py confirmed that no level changed. Absence of a label is not evidence.

Method and data quality

Arkham: page titles were read after client-side navigation. A record was taken only once the /intelligence/address/<addr> response had arrived and the URL matched the address; from row 67 on, the page heading also had to contain the address, and it did in every case.
Arkham entity and label come from the title only. Scraped entity links were wrong on unlabelled pages, where they picked up an unrelated "Quasar Builder" link, so they were discarded.
Arkham results were transcribed from the in-page results to titles-transcribed.tsv. build_lookups.py checks every row against the queue order and fails if an address doesn't match.
The independent full-reload re-check was not done: Arkham escalated to an interactive Cloudflare challenge.
Snowtrace: the name tag sits in the same page title as the address (" | Address: 0x<8>…<10>"), so a tag cannot carry over from the previous page. There were 0 errors.

	labelled with an entity	contract name only	no label
Arkham	85	19	67
Snowtrace	61 name tags (mostly generic "ERC-4337 Bundler N")	–	110

About this site

This site is generated by a script from the project’s own outputs: the explanatory documents, the structured explain records for the example transactions, the monthly population series, the address registry and the ontology. Charts are inline SVG; diagrams use a vendored copy of Mermaid 10.9.1. There are no trackers, analytics or external fonts. Population data covers 2023-04 to 2026-10-25; the registry is pinned at block 97,989,143.