On-Chain Entity Resolution — Naming the "Unknown Proxy"

The Challenge

ClearTrace attributes DEX volume to the frontend that originated each trade. But attribution has a stubborn tail: the highest-volume contracts often resolve to nothing more useful than Unknown Proxy (0x…). Those anonymous entries are the flow that matters most: institutional desks, custom enterprise frontends, and wallet-native swap extensions. A single unnamed proxy can sit near the top of a chain's volume table and quietly distort the entire picture of who is actually transacting.

No single data source names them all. Etherscan misses verifications that Sourcify holds. A proxy hides the implementation that carries its real identity. The same router, redeployed byte-for-byte across four chains, looks like four unrelated unknowns. Paid entity APIs would name a chunk of it, but running them across every unknown, on every sync, burns credits fast. The hard part is resolving each address to the best available label without paying for answers a free source already holds.

What We Built

A resolution ladder. For each unknown contract, ClearTrace walks a fixed sequence of sources ordered cheapest-and-most-authoritative first, stopping at the first real name. Roughly a dozen rungs, from a free eth_call to paid entity APIs tried last, with the order itself doing most of the work: by the time an address reaches a paid source, the free rungs have already named the vast majority of volume.

The ladder, cheapest first

Ground truth: the deployer's own list. The single highest authority is a protocol publishing its own deployment addresses. This rung was added after a hard lesson: a contract's absence from a third party's decoded set is not evidence that it is unofficial. When the deployer publishes the addresses, that file is the answer, and it outranks every heuristic below it.
On-chain registries. Some protocols track their own deployments in on-chain registries. A single free eth_call (for example, an ownerOf against the 0x Settler deployer's ERC-721) returns the currently active contract for a feature, straight from the chain, with no third-party API and no key.
Free local and public sources. Intel tables already in the local database, then the Etherscan v2 multichain API, then the keyless public mirrors Sourcify and Blockscout, which frequently hold verifications Etherscan does not.
Structural resolution. When no directory has a name, the bytecode does. Identical normalized runtime bytecode to an already-named contract on any chain inherits its label. Proxies are followed to their implementation via the EIP-1167 minimal-proxy target or the EIP-1967 implementation and beacon storage slots, and the proxy inherits that name.
Deployer-graph attribution. Still unnamed contracts are attributed through their creator: a named deployer EOA, its ENS primary name, or the majority label of sibling contracts the same deployer already shipped.
Paid sources, last and gated. Arkham (only when a session is configured) and Nansen (paid credits) sit at the bottom. Nansen halts for the rest of the run the moment it reports credit exhaustion, and a final pass batches every still-unnamed address into one Dune labels.contracts execution, never one call per address.

Cross-chain identity

Two facts collapse a lot of duplicate unknowns into single known entities. First, teams deploy byte-identical routers across chains, so ClearTrace fingerprints each contract as a SHA-256 of its runtime bytecode with the Solidity CBOR metadata trailer stripped. That trailer differs between otherwise-identical builds, so removing it lets one labeled instance name its twins everywhere. Second, the same key controls an address on every EVM chain, so a mainnet ENS primary name identifies a wallet cross-chain. The pipeline also recognizes EIP-7702 delegated EOAs by their 0xef0100 designator and labels them through their delegate, so a delegated wallet never masquerades as a high-volume "Unknown Proxy" whale.

Refusing to guess

A wrong label is worse than an honest "Unknown." Every rung is filtered against a blocklist of meaningless names: generic activity tags like "High Activity," and proxy wrapper class names like TransparentUpgradeableProxy or ERC1967Proxy that describe the shape of a contract, not its owner. Masking those forces the ladder to fall through to a rung that resolves the actual implementation instead of propagating a name that says nothing. Each label also carries a confidence tier and is re-checked on a fixed interval, so a name from a weaker rung is replaced when a more authoritative source later resolves the same address.

Spending the effort where the volume is

Unknown volume is heavily concentrated in a few large addresses, so the pipeline ranks unresolved contracts globally by attributed volume and resolves the top of that list each sync, rather than sweeping every address round-robin. It is the cheapest way to move the most attributed volume from "Unknown" to named per run. In a recent snapshot of the label store, 259 of the resolved contracts carried entity names, and about 89% of those (231 of 259) were named by the free and structural rungs before any live paid lookup to Arkham, Nansen, or the batched Dune call.

-- Rank still-unnamed contracts by the volume they carry, across all chains,
-- so the resolution ladder spends its effort (and any paid rungs) on the
-- addresses that actually distort attribution.
SELECT
    resolved_contract_name,
    blockchain,
    total_volume_usd
FROM dune_attribution
WHERE (resolved_contract_name LIKE 'Unknown%'
       OR resolved_contract_name GLOB '0x[0-9a-fA-F]*')
  AND blockchain IS NOT NULL
ORDER BY total_volume_usd DESC
LIMIT 100;

What It Shows

Entity resolution on deliberately adversarial identity: flow that is unlabeled, proxied, redeployed across chains, or actively structured not to be measured. When off-the-shelf labels run out, ClearTrace resolves identity from the on-chain facts themselves: bytecode fingerprints, proxy storage slots, deployer graphs, and registry calls. It is the same Rantum through-line as the attribution engine it feeds: finding signal others can't, and doing it with cost discipline and a refusal to invent an answer.

What It Proves to a Client

That we can build an identity and attribution layer no single vendor sells. Any one vendor names part of the on-chain world; the value is in the ladder that combines authoritative, free, and paid sources in the right order, resolves structurally when none of them answer, and knows when to stop. For a foundation, grant program, or protocol team, that is the difference between "a large unknown near the top of the table" and a named entity you can actually reason about. It runs today inside ClearTrace's live dashboard and public API.