counterparty exposure audit · solana

Who can see you?

Mainnet live · checking… Status: Ticker (placeholder, no token exists):
the working app

Open the file on any address.

Leakscan reads the address's most recent signatures and decodes the newest transactions on mainnet, then resolves every token account to the wallet behind it. It runs in your browser; this site's server only relays read-only requests and keeps no log of them.

Nothing is read until you press the button. Your lookup is not saved anywhere, not even in this browser.

What an observer learns

Public record

Plain-English exposure summary

    Counterparty web top 0

    walletprogram-ownedprogramfee payer / funder / lookalikethicker = stronger link

    Lookalike addresses in this history

    First funder

    App fingerprint

    Programs that ran in the decoded transactions, excluding plumbing (System, Token, Compute Budget, ATA). The set of apps you use — and when — is itself a fingerprint.

    how it works

    Five exhibits, all from public data

    1. Recent signatures. One getSignaturesForAddress call returns the last 50–100 transactions that mention the address, with their block times. This is the same call every explorer and analytics firm makes.
    2. Decode the newest transactions. Up to 40 getTransaction calls (jsonParsed), paced to stay under the public RPC limits and retried with back-off on rate limits. Every SOL transfer, wrapped-SOL move and SPL / Token-2022 transfer — including ones inside swaps — is attributed to the wallet behind each token account, using the owners recorded in the transaction itself.
    3. Score each counterparty. Paying someone (out) counts more than being paid (in); paying someone's fees or co-signing with them counts most; tiny unsolicited inbound transfers are marked dust and count least. Addresses that share their first and last three characters with another counterparty (a 1-in-38-billion coincidence) are flagged as likely address-poisoning lookalikes.
    4. Classify. One getMultipleAccounts call (no account data, just owner and flags) tells wallets apart from programs, token accounts and program-owned vaults; an on-curve check separates keys a person can hold from program-derived addresses.
    5. Walk back to the first funder. Optional: page backwards through up to 3,000 signatures to the oldest transaction and decode it to find who sent this address its first SOL — the classic link between a "fresh" wallet and its owner.
    privacy model

    What leaks, what this app hides

    What Leakscan keeps private

    • Your lookup: the address you scan is not stored, logged or put in the page URL. The server is a stateless relay for nine read-only RPC methods and writes no query log.
    • Your keys: there is nothing to sign and no wallet connection, so no key ever touches this page.
    • The report: it is built in your browser and disappears when you close the tab, unless you download it.

    What still leaks

    • Everything in the report is already public. Leakscan does not create the exposure; it shows it.
    • Your IP address and the addresses you query are visible to this site's host and to the upstream RPC provider while the request is relayed. Use a VPN or Tor if that matters.
    • Explorer links open a third-party site that can see what you look at there.
    • Real analytics firms read far more history, cluster across millions of wallets and add off-chain data (exchange KYC, IP logs). This is a small, honest slice of that view.

    Leakscan helps you reduce linkability by showing which links exist. It does not make anyone anonymous.

    Known limitations — please read

    • Heuristics from public data, not proof. A counterparty is "an address on the other side of a transfer". Shared addresses can be exchanges, pools, airdrop bots or spam; a lookalike can be coincidence. Nothing here proves who owns what.
    • Small window. Only the newest 15–40 transactions are decoded, out of the last 50–100 signatures. Older relationships are invisible unless they show up in the first-funder walk. The report says exactly how much it read.
    • First funder is capped. Busy addresses with more than 3,000 signatures stop before the beginning; the report says so instead of guessing. Funding that arrived through a program (bridge, exchange withdrawal program) is shown as the program call's fee payer, which may be a service, not a person.
    • Transfers only. Swaps are attributed to the pool or vault on the other side; NFT trades, staking, lending positions and compressed assets are not modelled. Unparsed program instructions are counted in the app fingerprint only.
    • Public RPC limits. Requests are paced and retried, but a congested public endpoint can still fail some reads; failed reads are reported, never filled in.
    • Experimental and unaudited. Hand-written for this demo. Use it to learn, not to accuse anyone.