Output
custody.v1.CustodyEventsinstitutional_wallet_custody_evm
Package ref
institutional-wallet-custody-evm@v0.1.0Run package
CLI
Run custody_evm from the command line.
substreams run institutional-wallet-custody-evm@v0.1.0 custody_evm -e mainnet --start-block -1substreams auth or directly on thegraph.market (see docs).README
institutional_wallet_custody_evm
Watchlist-filtered Ethereum custody security events composed from maintained transfer packages.
Overview
custody_evm emits block-scoped custody.v1.CustodyEvents for a dynamic list of protected EVM addresses. It normalizes native value and fee deltas, transaction initiation, ERC-20 transfers and approvals, ERC-721/ERC-1155 activity, and EIP-7702 authority changes. It is authorization-neutral: the consuming application supplies the watchlist and correlates the resulting independent chain evidence with its own authorization plane.
Modules
| Module | Kind | Output | Description |
|---|---|---|---|
custody_evm | map | proto:custody.v1.CustodyEvents | Filters configured addresses and normalizes composed EVM activity into custody security events. |
Composition
The module composes four narrow, immutable Pinax package artifacts. Importing the primitives directly also avoids dragging unrelated database-sink schemas into this security stream:
- Registry
erc20-transfers v0.2.0, modulemap_events, for ERC-20Transfer/Approvaldecoding. - Registry
evm-native-transfers v0.2.0, modulemap_events, for native calls and fee metadata. - Pinax
erc721 v0.4.0, modulemap_events, from commit44f7809c027c64c8d725cfde7941249636ad6bd4. - Pinax
erc1155 v0.5.0, modulemap_events, from the same pinned commit.
Raw sf.ethereum.type.v2.Block access supplies block identity, top-level transaction initiation and semantic context, fee-inclusive native net changes, and EIP-7702 authority changes. Those security facts are not exposed together by the imported transfer packages. ERC-20 events whose log identity is also decoded as ERC-721 are suppressed to avoid classifying NFTs as fungible tokens.
Prerequisites
- Substreams CLI v1.22.0 or newer.
- A The Graph Market data-plane credential created with
substreams auth.
Parameters use this strict format:
chain_id=eip155:1;addresses=0x1111111111111111111111111111111111111111,0x2222222222222222222222222222222222222222
Quick Start
The following verified mainnet block contains native and ERC-20 activity for the configured public address:
substreams run institutional-wallet-custody-evm-v0.1.0.spkg custody_evm \
--network mainnet -s 25968310 -t 25968311 -o jsonl \
-p 'custody_evm=chain_id=eip155:1;addresses=0x28c6c06298d514db089934071355e5743bf21d60'
Build and pack from source:
substreams build
substreams pack substreams.yaml -o institutional-wallet-custody-evm-v0.1.0.spkg
Modules