Tutorial 1 of 7
Your first case in five minutes
Beginner 5 min
Open the exploit post-mortem template, let Chainscope run four web3 tools on sample data, then read the dashboard, the case graph, the timeline and the report.
Chainscope is an investigation desk for public blockchain data. A case holds the wallets, contracts, transactions and DAO spaces you are looking at (the address book) and the checks that run usefulweb.site web3 tools on them. Every result becomes findings, graph nodes and timeline events in one place.
1. Open the template
Click Launch Chainscope on the app page, then File → Templates… and choose Exploit post-mortem (sample data). The case contains:
| Check | Tool | What it looks at |
|---|---|---|
| Replay of the drain | Blockchain Incident Replay | Two attacker transactions from pasted receipts |
| MEV in the related block | MEV Explorer | A small block with a sandwich, an arbitrage and a liquidation |
| Upgrade path of the drained pool | Contract Upgrade Explorer | Pasted dispatcher bytecode with upgradeTo |
| Relationships of the proxy clone | Smart Contract Relationship Graph | A minimal proxy and its known links |
All four use the offline examples that ship with the tools, so the addresses are synthetic (for example 0xA77aC4E5…A1) and the result is always the same. Opening a template runs its checks at once; the status bar ends with Run all finished: 4 checks ran.
2. Read the dashboard
The Dashboard tab opens by itself. Six tiles count the current findings: 1 Critical, 2 High, 1 Medium, 0 Low, 6 Info and 0 Pass. Click a tile to filter the list, click it again to go back.
The critical finding reads The likely attacker Attacker EOA (sample) (0xA77a…00A1) ended with a net gain of 250,000 USDC. The label comes from the address book, the address and the amount from the incident replay. Under each finding a link opens the check that produced it.
Below the findings, Suggested next checks use data from the results: the MEV result suggests Decode 0x0202…0202 (the sandwiched transaction), the relationship graph suggests Relationships of 0x0123…4567 (the clone's implementation). Add check creates the check; you decide when to run it.
3. Look at the case graph
Press 4 (or click Graph). The graphs of all tools are merged by address: the incident cluster (attacker, helper contract, drained pool) sits next to the MEV block and the proxy relationships. Red marks addresses flagged Suspect, orange Victim. A dashed ring means the address appears in more than one check. Click a node to see its roles and the checks it comes from; Nodes and relationships as tables lists the same data for screen readers and copying.
4. Follow the timeline
Press 5. Every dated event of the case is sorted by time: the MEV block (Block 20000000 on Ethereum: 6 transactions.), the incident transactions (0xA77a…00A1 deployed 0xC0Ff…0C01 …) and the two journal notes of the case. Add your own note under Case journal → New entry; it is timestamped and goes into the report.
5. Print the report
Press 7. The report collects the counts, the findings, the address book, every check with its last result, the graph, the timeline and the journal. Print or save as PDF opens the browser's print dialog; Copy as Markdown puts the same report on the clipboard.
Your case autosaves in this browser. Next: investigate a real transaction.
Ready to try it?