Internal Transactions

Monitoring internal transactions (contract-to-contract calls) within main transactions

Learning Objective

Master internal transaction patterns for detecting complex multi-step operations and contract interactions

Basic Internal Transaction Detection

watchRule:

{
  "expressions": [
    "system.invoked(tx1.itx1.WETH.F.transfer)"
  ]
}
Concept: Basic internal transaction detection

Detects WETH transfer function call within first internal transaction of main transaction

Multi-Internal Transaction Sequence

watchRule:

{
  "expressions": [
    "system.invoked(tx1.itx1.UniswapV2Router.F.swapExactTokensForTokens) && system.invoked(tx1.itx2.WETH.F.transfer) && system.invoked(tx1.itx3.AavePool.F.deposit)"
  ]
}
Concept: Multi-internal transaction sequence

Detects ordered sequence of three internal transactions - swap, transfer, and deposit within single main transaction

Internal Transaction Parameter Correlation

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.itx1.USDC.F.transfer.amount, == , tx1.itx2.USDT.F.transfer.amount)"
  ]
}
Concept: Internal transaction parameter correlation

Two internal transfers with matching amounts - correlates parameters across internal transactions for validation

Internal Transaction Address Correlation

watchRule:

{
  "expressions": [
    "system.addressCompare(tx1.itx1.WETH.internal_from, ==, tx1.itx2.DAI.internal_from)"
  ]
}
Concept: Internal transaction address correlation

Verifies same sender across multiple internal transactions - ensures same contract sender in multi-step operations

Flash Loan Arbitrage Pattern

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.itx1.AavePool.F.flashLoan.amount, ==, tx1.itx3.AavePool.F.repayFlashLoan.amount)"
  ]
}
Concept: Flash loan arbitrage pattern

Flash loan amount matches repayment amount across internal transactions - validates complete arbitrage cycle

Internal Event-Function-Event Sequence

watchRule:

{
  "expressions": [
    "system.invoked(tx1.itx1.UniswapV2Router.F.swapExactETHForTokens) && system.emitted(tx1.itx2.USDC.E.Transfer) && system.invoked(tx1.itx3.AavePool.F.deposit)"
  ]
}
Concept: Internal event-function-event sequence

Mixed internal transaction pattern - function call, event emission, then another function call within same main transaction

Internal Transaction Chain Validation

watchRule:

{
  "expressions": [
    "system.addressCompare(tx1.itx1.WETH.to_address, ==, tx1.itx2.UniswapV2Router.internal_from)"
  ]
}
Concept: Internal transaction chain validation

WETH recipient becomes Uniswap caller - validates proper transaction chaining in internal sequences

Reentrancy Detection in Internal Transactions

watchRule:

{
  "expressions": [
    "system.reentrant(tx1.itx1.WETH.F.withdraw) && system.invoked(tx1.itx2.MaliciousContract.F.fallback)"
  ]
}
Concept: Reentrancy detection in internal transactions

Detects reentrancy in WETH withdraw followed by malicious contract callback - identifies potential reentrancy attacks

Internal Transaction Event Monitoring

watchRule:

{
  "expressions": [
    "system.uintCompare(tx1.itx1.UniswapV2Pair.E.Swap.amount0Out, >, ${largeSwapAmount})"
  ]
}

options:

{
  "literalDefs": {
    "largeSwapAmount": 1e+24
  }
}
Concept: Internal transaction event monitoring

Large swap event within internal transaction - monitors significant internal transaction events with value thresholds