Method / the pipeline
01
The scanner accepts a base58 Solana address (roughly 32–44 characters) or the word demo. Invalid input never reaches RPC. Demo builds a fixed sample report so the UI stays usable when the network is down.
02
A JSON-RPC call to getSignaturesForAddress asks for confirmed history, limit 100. Each row already contains signature, slot, error, memo, and blockTime — enough for a public activity log before any transaction body is fetched.
03
For each signature, getTransaction with jsonParsed and maxSupportedTransactionVersion 0 returns account keys, instructions, inner instructions, pre/post balances, token balances, and program logs. Public RPC may withhold some bodies under load; the report says so.
04
The analyzer scores exposure, writes findings with explorer evidence, builds a transfer map, groups recognized programs, and flags debugger leaks (memos, logs, raw instruction data). Every claim that can cite a signature does.
RPC
If SOLANA_RPC_URL is set, that dedicated mainnet endpoint is tried first. Otherwise VEIL Scan walks public fallbacks (PublicNode, then api.mainnet-beta.solana.com), with retries on 429/5xx and timeouts. Production should set a dedicated URL; public RPC is a courtesy, not a quota.
Reads use commitment confirmed. Unconfirmed mempool gossip is out of scope. Failed transactions still count: the signature list keeps them, and the program plus accounts often remain in the body.
Signatures can arrive without a parsed body. The report tracks scannedSignatures vs fetchedTransactions and adds a warning. Signature-level memos and timestamps remain public even when the body is missing.
Hosts should bind HTTP to 0.0.0.0:$PORT. Local disks are ephemeral on typical PaaS deploys — VEIL Scan does not use them as a database. If RPC is down, open the sample report.
Evidence model
A readable claim: memos are on-chain, this address paid fees, amounts moved, a recognized DEX was invoked. Severity is a reading aid, not a court filing.
Usually a signature, optional slot and time, a short label, and a detail (amount, program name, excerpt). Labels link out to a public explorer so you can verify the same fields without trusting our copy.
A transfer is interaction, not common ownership. A UTC hour cluster is not a home address. A program id is behavior, not a legal name. We do not merge CEX KYC, social graphs, or IP logs.
Transfer map
The map draws the scanned address in the center and up to sixteen counterparties around it. A line means SOL or a token-account balance moved between those keys in the parsed window. Thickness follows repeat count. It is a picture of interaction.
It is not a clustering algorithm, not a change-address heuristic, and not proof that a CEX deposit, a program PDA, and a friend's wallet share a human. Empty maps happen on unused addresses, program-only activity, or when RPC returned signatures without parsed instructions.
Window
getSignaturesForAddress is asked for 100 confirmed signatures. Busy wallets have more history. Quiet wallets have fewer. Unused wallets have none — and that is not a privacy guarantee. The first airdrop, transfer, or mint starts a permanent public record.
Timing clusters use UTC hours from blockTime. They can hint at a bot schedule or a waking hour. They are a weak signal and are labeled as such.