Onboarding Course
Risk Graph Indexer
A guided, lesson-by-lesson tour of the risk-graph-indexer system — from raw on-chain events to a live risk graph. Each lesson is self-contained, grounded in the real code, and ends with a quick self-check.
Lessons
Lesson 01 · The Pipeline
Events in, graph edges out
The one mental model that makes the whole codebase make sense. ~8 minutes.
Lesson 02 · The Data Model
Nodes, edges, and the shape of the risk graph
The graph's vocabulary — and the three properties that will bite you if you ignore them. ~10 minutes.
Lesson 03 · The Decoder Path
From a raw log to a typed event
Your EVM knowledge, made executable — and how to add a decoder (a real first contribution). ~10 min.
Lesson 04 · The Write Path
From a typed event to a graph edge
Closing the loop: how decoded events become a batched, atomic write to Memgraph. ~11 min.
Lesson 05 · The Enrichment Worker
How a bare node learns what it is
The async classifier — and the discovery loop that makes the graph grow itself. ~11 min.
Lesson 06 · The Risk Engine
Turning the graph into risk numbers
Why we built a graph at all: "if this fails, which tokens lose value — and how much?" ~12 min.
Lesson 07 · The Streaming Backbone
How blocks travel between the binaries
Opening the "Redis Stream" black box: a durable log, consumer groups, and flow control. ~12 min.
Lesson 08 · Failure Modes & Recovery
What happens when things go wrong
Reorgs, crashes, lost caches, diverging cursors — and why none of them corrupt the graph. ~13 min.
Lesson 09 · The Single-Writer Architecture
Why every write funnels through one pod
The disaster that forced it, and the machinery behind L4's "recorder" and L8's two cursors. ~13 min.
Lesson 10 · Bootstrap & Fresh-Start
Where the graph comes from
From an empty database to a seeded risk graph — by asking the chain, not loading a snapshot. ~12 min.
Lesson 11 · Observability · Phase-1 Capstone
Watching the machine run
Every mechanism you've learned has a concrete signal. This is how you see them. ~12 min.
Lesson 12 · The Rule Engine · Deeper Track
From risk numbers to alerts
The layer the whole system exists to feed: customer rules → evaluation → firing. ~12 min.
Lesson 13 · The Risk Math · Deeper Track
How the risk numbers are actually computed
The formulas behind the fields — opening the box deferred in L6. ~13 min.
Lesson 14 · The Read Surface · Deeper Track
Reading the graph on demand
The query-api, the operator UI, and the read discipline that keeps it all cheap. ~11 min.
Lesson 15 · The Alert Processor · Deeper Track
The last hop: alert → human
Delivering a fired alert exactly once — and the same patterns, one more time. ~11 min.
Lesson 16 · Exposure-BFS · Deeper Track
How risk flows through the graph
The last L6 deferral: weight propagation, hop by hop. ~11 min.
Lesson 17 · The Admin Panel · Deeper Track
The operator console
How humans see and steer the graph — safely. Auth, audit, and Cypher-backed views. ~11 min.
Lesson 18 · The Delivery Boundary · Final Deep-Cut
Where the system ends
The last detail of the alert path — and a lesson about boundaries. ~9 min.
Lesson 19 · at_risk Aggregation · Deeper Track
From cells to a number
How thousands of attack cells collapse into one honest at-risk dollar figure. ~12 min.
Lesson 20 · Oracle Attack Path · Deeper Track
One path, end to end: the oracle attack
How a focus token's price feed becomes cells — the gnarliest of the six construction paths. ~13 min.
Lesson 21 · Exit Liquidity v2 · Deeper Track
The drainable ceiling
How exit_v2_total — the number every extractable formula leans on — is actually measured. ~12 min.
Lesson 22 · Multisig Expansion · Deeper Track
Where the partial flag is born
One Safe-controlled cell fans out into an anchor + one cell per signer. ~11 min.
Lesson 23 · at_risk Lifecycle · Deeper Track
Trigger, ordinary paths, and proof
The three loose ends: what fires a run, the cells you haven't seen, and how it's all kept honest. ~14 min.
Lesson 24 · Discovery / Enrichment Internals · New Subsystem
The discovery flywheel
How the graph grows itself — one address discovers the next, without a hardcoded map of DeFi. ~14 min.
Lesson 25 · Admin-Role Discovery · Discovery Internals
Finding who can attack
How the graph learns who controls a token — and stamps each finding with a severity. ~13 min.
Lesson 26 · Oracle / NAV Discovery · Discovery Internals
How a token learns its price feed
The upstream L20 left open: where value_defining_oracle comes from. ~13 min.
Lesson 27 · The Oracle Bridger · Discovery Internals
Inheriting oracle dependencies
A pure-Cypher pass that gives markets and vaults the oracles their assets depend on. ~12 min.
Lesson 28 · Project Inference · Discovery Internals
Attributing a contract to a protocol
Stage 10: how a bare contract becomes "belongs to Aave" — and why it's deliberately a heuristic. ~12 min.
Lesson 29 · Chain-Reference Quality Harness · New Subsystem
How the system audits itself
Re-checking the derived graph against on-chain truth — and routing durable drift to action. ~14 min.
Lesson 30 · The Healer Subsystem · Quality Internals
Letting a machine fix the graph
How chainref auto-corrects drift — and the layered guards that make that safe. ~14 min.
Lesson 31 · The Reconcile Transport · Quality Internals
The shared apply mechanism
One transport carries every healer's writes — and protects realtime apply from them. ~14 min.
Lesson 32 · One Verifier In Depth · Quality Internals
Conservation of supply
Σ HOLDS ≈ totalSupply — and the judgment hidden in one "simple" check. ~12 min.
Lesson 33 · The Linear Promoter · Quality Internals
File each finding exactly once
Turning persistent findings into tickets without spamming duplicates. ~13 min.
Lesson 34 · The Validation Suite · New Subsystem
The graph's self-test
A periodic, two-tier data-quality monitor — and how it differs from chainref. ~13 min.
Lesson 35 · The Cost-Allocation Model · New Subsystem
Billing a shared platform
Attributing cost to customers when there is no per-customer cost to measure. ~13 min.
Lesson 36 · Narrow Corner · Defensive Boundaries
One door for the balance cache
A tiny package, a dense lesson: containing corruption with a single un-bypassable invariant. ~10 min.
Lesson 37 · Narrow Corners · Capstone
The primitives under the principles
Where "single writer," "Redis is rebuildable," and "heal safely" are actually implemented. ~14 min.
Lesson 38 · Risk-Graph Math · Deeper Track
How well-governed is a node?
node_risk_score opened all the way — including how much of it is real today. ~13 min.
Lesson 39 · Risk-Graph Math · Deeper Track
How concentrated is a vault?
HHI, the 1/HHI readout, and the accounting that's most of the code. ~12 min.
Lesson 40 · Risk-Graph Math · Deeper Track
Where the BFS weights come from
The last gap in the risk engine: each edge's exposure weight is a real economic quantity. ~12 min.