EntryPoint IntelligenceERC-4337 on Avalanche C-Chain Data to 2026-10-25

Evidence

Open questions

What is still unknown, why, and what evidence would settle it.

These are the named gaps from the handoff, phrased as questions. Each says what evidence would close it.

  1. Which app is the signed daily-result registry (0xfb315bbe…a3f)? The grammar and the signer are solved, but no public frontend, repo or registry ties this address and schema to a named product or field labels. Needed: a project-owned source binding the exact address, or the EIP-712 schema with field names.
  2. Which app is the collateral coordinator (0x5bbb435e…603a evidence level: hint), and what do its residual branches do? Signify/Rain is a clue. Needed: the project's own deployment registry listing this address. The 10 native-asset withdrawals also need execution evidence (trace) before anyone can call them AVAX payments.
  3. Two opaque account call formats, plus some LI.FI facets (0x5fd9ae2e, 0x80c65808). Needed: the actual account module or diamond facet in force at that block, and its ABI with an exact byte round-trip.
  4. Who issues the small token and NFT collections, and why? Names come from metadata. Needed: URI/source domains, factory/deployer lineage, and issuer-owned registries. A shared sponsor or factory doesn't make them one project.
  5. Who runs the probe and Safe self-call workloads? Signer clusters are proven. Needed: an exact public binding, e.g. a monitoring repo that names these accounts. Real-world identity never follows from signature recovery.
  6. Who pays the paymasters? Verifying-mode sponsorship settles off chain. Only ERC-20 mode leaves a token trail, and that goes to a settlement recipient.
  7. Bridges: did the money arrive? Relay, CCTP and LI.FI requests are visible on C-Chain. Arrival needs destination-chain evidence.

Why so much stays unknown: an EntryPoint transaction proves authorization and execution on this chain very precisely. Identity, intent, off-chain billing and other chains sit outside the transaction. Keep them as separate, evidence-backed claims, and leave them "unknown" until you have that evidence.

From the activity history

Open points from What happened, the story of the waves of activity:

  1. Which Pixelmon title is behind the main game id, and what the three undecoded activity types are.
  2. Why logging stopped on May 13–14, 2026. A move to a dedicated Avalanche L1 was Pixelmon's stated plan, but we found none.
  3. What drove the 2023 v0.6 wave and the 2024–25 v0.7 surges. They have not been examined yet.

Infrastructure still unattributed

  • Paymasters 0xbd0334ac (839k ops), 0xb2aa3511 (174k), 0x5fa66dfe, owner 0x77ba6e3f/0x6dd80d80. BundleBear and Pimlico's 4337-stats call them thirdweb, and 97 % / 99.9 % of the senders they sponsor were deployed by the thirdweb factories. thirdweb publishes no paymaster address for Avalanche (only Base, Celo and Lisk token paymasters), so they stay hint. Their bundler fleets (0x62733e85, 0x222a5720, 0x06cef741, then 0x744d6e01, …) also stay hint.

  • Vanity 0x4337… bundler fleet (~40 EOAs). These mostly submit Pimlico-paymaster ops, and BundleBear labels three of them Pimlico. Pimlico publishes no executor list, so they stay hint.

  • Paymaster 0x1c6ad754 (24k ops), with owner 0xbe4c70a0 shared with 0x472edefe/0xf7bb387e/0x8aa86770. It only serves accounts from factory 0xb3f15a44, which 4337-stats labels Biconomy. The factory's bytecode is Biconomy-like (4,240 bytes) but its code hash is not a Biconomy one, so this stays hint.

  • Paymasters 0xa2ce4265/0x73f31a64. These only sponsor ZeroDev-Kernel accounts. That is a property of the account stack, not of the paymaster operator.

  • Paymasters 0xe93eca65/0x9d6ac51b. BundleBear labels them Stackup. No Stackup source lists them.

  • Small factories 0x57feb548, 0x872f64d0, 0xecca1f8a, 0x86293783, 0x3fdcd9aa, 0x2ba5da91, 0x335ed05d. No official or GitHub source names them.

  • 0x91e60e06 (SimpleAccountFactory v0.7). Only Pimlico's SDK publishes it, not eth-infinitism, so it is hint.

  • 'Avax-dle' paymaster/factory/bundler remain discovery links (see open question 1).

Not identified by third-party explorers either

  • the top v0.6 bundler 0xba9cfe6a. Snowtrace's tag is only "Relayer 1".
  • paymasters 0xbd0334ac and 0x1c6ad754. 0xb2aa3511 and 0x3f383d23 show only contract names ("VerifyingPaymasterV6", "VerifyingSingletonPaymaster").
  • owner keys 0x77ba6e3f, 0x129443ca, 0x0e189a30, 0x97751373, 0x4337aa1c, 0x433704c4
  • the previously documented cluster and signer keys 0x8fd37924, 0x0f88ef66, 0x359ad9b2, and the daily-result contract 0xfb315bbe with its deployer, factory, paymaster and bundler. The collateral coordinator shows only the contract name "Coordinator".