How to use it. See Program labels and token locks in the user guide for how these names and locks appear in Scout.

An address can belong to a person, or it can be controlled by a program: an exchange pool, a router, a bridge, a staking program, or a token lock. Which one it is changes what a transfer means. Funds sent to a pool were swapped; funds sent to a bridge left the blockchain; funds sent to a lock still belong to someone and pay out on a schedule. This page names the signals Wallet Sleuth uses to tell them apart.

The catalogue

Wallet Sleuth keeps a catalogue of programs and contracts on Solana, Base and Ethereum. Each entry has a name, an operator, a category, a confidence and the public sources it came from.

• Verified entries are named by the operator's own documentation or code.
• Unconfirmed entries come from public registries and explorers. A name a program declares about itself, such as its own on-chain metadata, never makes an entry verified.
• Reported entries are drainer programs and wallets published by named security researchers. They enter the catalogue only from those reports or from a Wallet Sleuth reviewer, never from automated sources.

The catalogue is refreshed from public registries and explorers, from a registry of programs whose published source code matches what is deployed, and from the blockchain itself. Automated updates can raise an entry's confidence but never lower it; only a reviewer can lower it. A field a reviewer has set is never overwritten by an update. Programs that Scout, the AI Investigator, evidence reports or audits meet and cannot name are queued for a reviewer.

Deciding what an address is

On Solana, Wallet Sleuth reads the account and stops at the first signal that answers:

1. The address itself is a catalogued program, or it is an executable program that is not catalogued yet. A catalogued address that is not a program, such as a reported drainer wallet, is shown as a wallet with its catalogue name.
2. The account's owner is a catalogued program. The account type is matched by its data layout, and if the program is a token lock, the account is decoded.
3. A token account's authority is controlled by a catalogued lock. Where the authority has no data of its own, the lock is found by looking up which lock account points to that token account.
4. Otherwise the address is a plain wallet, or an account owned by a program that is not in the catalogue yet.

An account that no longer exists, such as a fully withdrawn and closed lock, is a fact about the address, not a failed lookup.

On Base and Ethereum, Wallet Sleuth checks whether the address is a catalogued contract, whether it is a proxy that points to a catalogued contract, and otherwise whether it has contract code, using the verified contract name from a public block explorer. A verified contract name alone gives an unconfirmed name. Addresses that delegate their execution under EIP-7702 are treated as wallets.

When the blockchain data provider does not answer, the address is marked as not checked. It is never shown as a plain wallet because a lookup failed.

Reading a token lock

A lock is read from the blockchain with the published layout of its protocol. The reading gives the depositor, the recipient, the token, the amount deposited and withdrawn, and the schedule: start, cliff and end. On Base and Ethereum a lock is a position inside a shared contract, so it is found from the transaction that created it and then read from the contract.

Some protocols record a different amount. A payment stream records what the recipient has earned so far and can claim; some vesting programs record only what is still locked. Wallet Sleuth reports the amount the protocol records and names it as such, rather than deriving a figure the protocol does not hold.

A reading is checked before it is used. A layout that does not match, a schedule that ends before it starts, an implausible date, or more withdrawn than deposited makes the lock unreadable. A lock that has been cancelled or revoked is also treated as unreadable, because what is still owed to the recipient is no longer the deposit less the withdrawals. Wallet Sleuth then names the lock but does not use its contents. Some lock programs are catalogued by name only, because their layout is not published in a form that can be checked; their locks are named and not read.

Some locks pay out to whoever holds a position NFT. For these the recipient is the current holder, which can change. For one protocol the recipient is the withdrawal address recorded in the lock.

Following a trail through a lock

• The lock stays on the trail as evidence, and a link is drawn from the lock to its recipient with the amount still locked and the schedule.
• The trail continues from the recipient.
• In an evidence report, the trail continues from the recipient's actual withdrawals out of the lock only where the lock holds a single position, under the same rule as every other transfer: a withdrawal counts only after the funds arrived in the lock. A lock held in a shared contract also holds other people's positions, so its withdrawals cannot be tied to the reporter's deposit; the report names the recipient and what is still locked and says withdrawals were not traced.
• A position is tied to the reporter's funds only when the lock records the sender of the funds as its depositor, or when the deposit could only have funded that one position. Otherwise the report says the depositor could not be determined and does not treat the recipient as a wallet of interest.
• If the depositor can cancel the lock, the depositor is shown as able to reclaim the unvested part.
• A permanent lock, an unreadable lock, a lock that pays back to its depositor, and an airdrop distributor without a claimed recipient are named and not followed.
• A recipient that is already on the canvas or already on the trail is linked, never added twice.

Bridges and reported drainers

Funds sent to a bridge left the blockchain. Wallet Sleuth names the bridge and stops; it does not follow funds onto another chain.

A transfer to an address in the catalogue as a reported drainer is shown with the name of the researcher who reported it and a link to the report.

In AI Investigator reports

Program names are passed to the AI Investigator as data from the blockchain, never as instructions. A statement in its report about a lock's amount, schedule or recipient is kept only when it cites a lock read from the blockchain; otherwise it is removed.

What this does not do

Wallet Sleuth does not detect drainers from transaction patterns in this version, and it does not follow funds across bridges. Program names and lock facts never change an audit's grade or the values it is based on.