On-Chain Footprint
What an on-chain analyst sees — normal SOL transfers, nothing suspicious.
Analyst View
An analyst observing a completed Invisible swap sees:
- Independent wallets making ordinary SOL transfers to fresh addresses, spaced days apart
- Non-round, non-uniform, non-correlated amounts
- No smart contract invocation —
SystemProgram.transferonly - No link between LP wallets and Alice's deposit wallet
- No link between Alice's destination addresses
On-Chain Transactions
Deposits (Look Normal)
LP_origin ──(transfer)──► W_lp "consolidating SOL"
Alice_origin ──(transfer)──► W_alice "moving SOL to new address"Payouts (Over 3 Weeks)
Day 2: W_lp_1 → Alice_fresh_1 (0.4 SOL)
Day 5: W_lp_2 → Alice_fresh_2 (1.1 SOL)
Day 11: W_lp_1 → Alice_fresh_3 (0.3 SOL)
Day 16: W_lp_4 → Alice_fresh_4 (0.8 SOL)
Day 20: W_lp_2 → Alice_fresh_5 (0.4 SOL)Different wallets, different addresses, different days. Nothing links them.
Why Detection Is Hard
| Attack Vector | Why It Fails |
|---|---|
| Amount correlation | Non-uniform, non-round, CSPRNG-generated |
| Timing correlation | Payouts span 3 weeks with random jitter |
| Graph analysis | No shared addresses between destinations |
| Program fingerprint | Only SystemProgram.transfer — used by every wallet |
| Wallet clustering | Each payout from a different LP wallet to a fresh address |
POC vs. MVP
| Aspect | POC (P2P) | MVP (Pool) |
|---|---|---|
| Flows | 2 near-simultaneous | 5+ spread over weeks |
| Timing | Same second (easy to correlate) | Days apart, randomized |
| Amounts | Mirror amounts | Non-uniform fragments |
| Analyst difficulty | Moderate | Very hard |