Cross-Reference Patterns

Comparing values between different transactions, events, and parameters - essential for correlation detection

Learning Objective

Master cross-transaction and cross-parameter comparisons for detecting complex patterns

Cross-Transaction Parameter Comparison

watchRule:

{
  "expressions": [
    "system.addressCompare(tx1.UniswapV2Router.F.swapExactETHForTokens.to, ==, tx2.AavePool.F.deposit.onBehalfOf)"
  ]
}
Concept: Cross-transaction parameter comparison

Verifies same recipient across Uniswap swap and Aave deposit - enables parameter correlation between transactions

Event Field Correlation

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.USDC.E.Transfer.value, ==, tx2.AavePool.E.Deposit.amount)"
  ]
}
Concept: Event field correlation

Confirms USDC transfer amount matches Aave deposit amount - correlates event fields across transactions

Transaction Metadata Correlation

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.CompoundCToken.blocknumber, ==, tx2.UniswapV2Pair.blocknumber)"
  ]
}
Concept: Transaction metadata correlation

Ensures both transactions occur in same block - correlates transaction metadata for timing verification

Internal Transaction Parameter Correlation

watchRule:

{
  "expressions": [
    "system.addressCompare(tx1.itx1.WETH.F.transfer.to, ==, tx1.itx2.DAI.F.transferFrom.from)"
  ]
}
Concept: Internal transaction parameter correlation

Links WETH recipient to DAI sender within same transaction - correlates parameters across internal transactions

Internal Event-to-Function Correlation

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.itx1.UniswapV2Pair.E.Swap.amount1Out, ==, tx1.itx2.AavePool.F.deposit.amount)"
  ]
}
Concept: Internal event-to-function correlation

Matches Uniswap swap output to Aave deposit input - correlates internal event data with function parameters

Value Relationship Verification

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.itx1.LendingPool.F.flashLoan.amount, ==, tx1.itx2.LendingPool.F.repayFlashLoan.amount)"
  ]
}
Concept: Value relationship verification

Confirms flash loan amount equals repayment amount - verifies value relationships for loan integrity

Function-to-Event Correlation

watchRule:

{
  "expressions": [
    "system.addressCompare(tx1.itx1.MultisigWallet.F.executeTransaction.to, ==, tx1.itx1.USDC.E.Transfer.to)"
  ]
}
Concept: Function-to-event correlation

Links multisig execution target to USDC transfer recipient within same transaction - correlates function parameters with event fields from internal calls

Multiple Cross-Reference Validation

watchRule:

{
  "expressions": [
    "system.addressCompare(tx1.UniswapV2Router.F.swapExactETHForTokens.to, ==, tx2.AavePool.F.deposit.onBehalfOf)",
    "system.uintCompare(tx1.itx1.UniswapV2Pair.E.Swap.amount1Out, ==, tx2.AavePool.F.deposit.amount)"
  ]
}
Concept: Multiple cross-reference validation

Validates that swap recipient matches deposit beneficiary and swap output amount matches deposit amount across transactions - combines top-level function parameters with internal transaction events