an off-chain intelligence layer for on-chain risk

Smart contracts see a transaction. PISTA sees the trail.

PISTA watches blockchain activity across any number of protocols in near real time, evaluates it against adaptive behavioural baselines, and — the moment risk is detected — acts, on-chain and off.

PPreventive

IInvestigation

SSystem

TTransaction

AAuditing

live signal — baseline vs. deviation

⚠ anomaly flagged
→ pause() triggered

block streamnominal

the problem

Contracts operate in a vacuum.

They enforce who can call them, and when. They have no awareness of anything broader.

Encoding complex, evolving detection logic directly in Solidity is prohibitively expensive and rigid — by the time you update the contract, the attack has already moved on.

how pista works

One continuous trail, from block to response.

A Substream collects and parses every block, an AI agent scores it against baseline, and a ruleset decides whether to act.

01 · source

On-chain events

Any number of contracts and protocols emit events PISTA subscribes to.

02 · substream

Collect & parse

A Substreams module scans every block and transforms raw events into structured signals.

03 · store

ClickHouse

Signals land in ClickHouse — real-time analytics, queryable in plain SQL.

04 · evaluate

AI agent

Updates are scored against learned baselines and adaptive policies.

05 · decide

Ruleset

If behaviour deviates from baseline, a response is triggered.

06 · act

Response

An on-chain or off-chain action executes — see below.

response actions

What PISTA can do once risk is confirmed.

pause(contract)

blacklist(address)

transfer(funds)

trade(dex)

alert(email)

lock(card_transfer)

why this matters

Independent, adaptive, and cheap to run.

Works on contracts you don't own

No integration required. Any user, DAO, or protocol can run PISTA as an independent safety layer.

Adaptive, not static

Rules aren't hardcoded. PISTA learns what "normal" looks like and adjusts as conditions change — a bull market behaves differently from a bear market.

Catches novel attacks

It flags deviation from baseline rather than matching known signatures, so it can catch zero-days and emerging fraud patterns.

No on-chain cost for intelligence

All analysis happens off-chain. The EVM is only touched for the final action, keeping gas minimal.

Cross-protocol visibility

One PISTA instance can watch several contracts and protocols at once, correlating signals no single contract could see alone.

Near real-time response

Events are processed as they land — not the days or weeks a governance proposal or manual intervention would take.

under the hood

Tools and components.

The Graph

Substreams stream, transform and aggregate on-chain data with high parallelism and throughput, at reduced cost.

The Graph Hosted Service

Runs the deployed substream and, paired with ClickHouse, stores the resulting substream aggregation.

Runs the fraud-detection agent inside a TEE on 0G's decentralized model network, returning a verifiable attestation of the execution with every result.

engineering stack — Rust (substreams module) · Protobuf (aggregate schema) · Solidity / Foundry (demo contract) · Docker Compose (local dev chain) · Nix flake (reproducible env)

built with

AI / models used during development.

Opencode + Claude.ai

Documentation, the demo smart contract, and the protobuf definition.

substream-devs skill

The Graph's own skill for Substreams creation.

Status — built & tested

Substreams module computing the full FraudData aggregate per block, smoke-tested on a local dev chain
ClickHouse sink wired via substreams-sink-sql's from-proto mode, DDL generated from the proto schema

Further development

Extend the data captured for fraud detection
Implement an on-chain ruleset
Run the off-chain ruleset inside a TEE

reference deployment — Counter.sol demo, Sepolia

network: Ethereum Sepolia
contract: 0x6A1fa9938e2698EA4009E3821CbeF215620f2003
deployer: 0xd6d5e7b2c47399853f6c988eb60f862a6cb26f7d
explorer: sourcify · blockscout