Topics

#blockchain-security #contract-analysis #cybersecurity #defi-security #deployer-reputation #ethereum #etherscan #machine-learning #onchain-data #python #real-time-monitoring #risk-scoring #rugpull-detection #scikit-learn #smart-contracts #solidity #static-analysis #token-auditing #web3 #web3-security

Language breakdown

No language data available.

▸ Files click to expand

README

Machine Learning Meets Etherscan: A Full Pipeline for Real-Time Smart Contract Scanning

How to Build a Complete ML + Blockchain Security System That Monitors New Smart Contracts in Real Time

Blockchain security is changing fast. Rugpulls evolve, malicious deployers grow more sophisticated, and new contracts appear every few seconds. Traditional manual audits simply cannot keep up.

So what is the future? AI-powered, automated, real-time contract scanning, a pipeline that continuously fetches fresh deployments from Etherscan, analyzes their Solidity code, classifies risk using machine learning, and generates trust scores for both tokens and deployers.

In this article, we build exactly that. Step by step. Fully explained.

Why “Real-Time Smart Contract Scanning”?

Every malicious token and every rugpull begins with one moment:

A deployment transaction.

Once the token is live, investors will be targeted, liquidity may be added, Telegram hype starts, and a scam might unfold in minutes.

If we can intercept and analyze a token immediately at deployment, before the first investor buys, we gain:

Early warning signals
Automatic red flags
Deployer reputation insight
Liquidity risk estimation
Scam pattern detection

This is where Etherscan + Machine Learning becomes a powerful combination.

The Full Real-Time ML + Etherscan Pipeline

Below is the complete architecture pipeline:

┌───────────────────────────────────────────────────────┐  
        │ [1] Listen for New Deployments (Etherscan / On-Chain) │
        └──────────────────────────┬────────────────────────────┘
                                   │
                                   ▼
            ┌───────────────────────────────────────────────┐
            │ [2] Fetch Contract Source Code (Etherscan V2) │
            └──────────────────────┬────────────────────────┘
                                   │
                                   ▼
        ┌─────────────────────────────────────────────────────────┐     
        │  [3] Static Token Audit (Rule-Based Analysis)           │
        │    - dangerous patterns (mint, blacklist, trading lock) │
        │    - taxable functions, honeypot flags                  │
        │    - suspicious structures                              │
        └───────────────────────────┬─────────────────────────────┘
                                    │
                                    ▼
                  ┌───────────────────────────────────┐
                  │  [4] ML Feature Extraction        │
                  │    - numeric + binary features    │
                  │    - contract metadata            │
                  └─────────────────┬─────────────────┘
                                    │
                                    ▼
               ┌─────────────────────────────────────────┐
               │ [5] Machine Learning Classification     │
               │   - RandomForest or Gradient Boosting   │
               │   - P(rugpull), P(suspicious)           │ 
               └────────────────────┬────────────────────┘
                                    │
                                    ▼
              ┌───────────────────────────────────────────┐
              │ [6] Deployer Reputation Engine            │
              │   - aggregates all contracts by deployer  │
              │   - ML trust score (0–100)                │    
              └─────────────────────┬─────────────────────┘
                                    │
                                    ▼
                ┌───────────────────────────────────────┐
                │ [7] Final Output                      │
                │   - Token Risk Score + Label          │ 
                │   - Deployer Reputation Score         │
                │   - JSON Report / Alerts / Dashboard  │
                └───────────────────────────────────────┘

This is essentially a self-contained risk intelligence system.

Let’s break it down layer by layer.

Layer 1, Real-Time Detection Using Etherscan V2

Etherscan V2 introduces a cleaner, more explicit API:

https://api.etherscan.io/v2/api

Every deployment contract comes from:

A transaction where contractAddress is non-null
Usually a CREATE or CREATE2 opcode

To discover new contracts, we can:

Option A, Poll Etherscan every X seconds for latest txs

Option B, Use WebSocket blockchain listeners (Alchemy, Infura)

Option C, Hybrid (WS for speed, Etherscan for source code)

Once you detect a deployer transaction:

{
  "from": "0xDEAD...123",
  "contractAddress": "0xABC...789",
  "hash": "0xTX..."
}

You pull the source code immediately via:

module=contract
action=getsourcecode

If verified, you now have raw Solidity text to analyze.

Layer 2, Static Token Risk Auditor (Pattern-Based)

Before machine learning even enters the conversation, pattern-based static analysis is extremely effective.

The auditor extracts indicators from Solidity like:

Mint Authority

function mint() public onlyOwner {}

Huge rugpull signal.

Trading Locks

bool public tradingOpen;

Blacklisting

mapping(address => bool) public isBlacklisted;

Fee Manipulation

function setFee(uint256 fee) external onlyOwner {}

Sell Restriction

uint256 public maxTxAmount;

Owner-Controlled Liquidity

Owner can drain liquidity after listing.

These convert into binary features:

has_mint = 1
has_blacklist = 1
hastradinglock = 1
hassetfee = 1
...

Combined with structural features:

number of lines
number of functions
number of public keywords
number of modifiers
complexity metrics

This forms a structured feature vector for ML.

Layer 3, Machine Learning Classification (Token-Level)

This is where the AI comes in.

Given a feature vector:

[
  n_lines,
  n_public,
  has_mint,
  has_blacklist,
  hastradinglock,
  hassetfee,
  ...
]

A model like RandomForestClassifier can learn patterns such as:

“When a contract has mint + blacklist + trading lock, it is usually a rugpull.”

Model Outputs:

risk_score (0–100)
risk_level (Low / Medium / High)
label (safe, suspicious, rugpull_candidate)
Optional: feature importance

This converts contract-level risk → clear insights.

Layer 4, Deployer Reputation Engine

A scammer rarely deploys only one malicious token.

They repeat the pattern.

So the pipeline aggregates:

# number of deployed tokens
n_contracts
how many were safe / suspicious / rugpull
n_safe
n_suspicious
n_rugpull
portfolio ratios
fracsafe = nsafe / n_contracts
fracrugpull = nrugpull / n_contracts

This becomes a second ML feature vector:

[ncontracts, nsafe, nsuspicious, nrugpull, fracsafe, fracrugpull]

Then the model computes:

ML-based Deployer Trust Score (0–100)

Risk class: Low / Medium / High

Label: trusted / watchlist / high_risk

This is extremely effective at detecting serial rugpull deployers.

Layer 5, Orchestration: The End-to-End Pipeline

A real-time system must:

Monitor new deployments (WS or Etherscan)
Fetch code immediately
Run the auditor
Run ML classifier
Attach the deployer reputation
Output a full JSON report
Optionally publish to on-chain registry

A final real-time output looks like:

{
  "contract": "0xABC...",
  "deployer": "0xDEAD...",
  "token_risk": {
    "score": 87,
    "level": "High",
    "label": "rugpull_candidate"
  },
  "deployer_reputation": {
    "score": 92,
    "risk_class": "High",
    "label": "high_risk"
  }
}

This can be: