Case files and grades
A case file is one JSON document. Its shape is the same for a paid case and for a Night Watch case.
{
"v": 1,
"caseId": "0x<32 random bytes>",
"salt": "0x<16 random bytes>",
"openedAt": "2026-10-23T09:14:05.112Z",
"head": 95412233,
"source": "client" | "watch",
"target": { "address": "0x…", "kind": "pons-token", "label": "$TICKER", "symbol": "…", "name": "…" },
"detectives": ["census", "locksmith", "archivist", "tracer"],
"findings": [
{
"id": "census-3",
"detective": "census",
"severity": "alert",
"title": "6 early buyers sent their tokens to one wallet",
"detail": "…",
"evidence": [{ "label": "0x6505…40dc", "url": "https://robinhoodchain.blockscout.com/address/0x…" }]
}
],
"verdict": { "grade": "D", "label": "Serious concerns", "score": 54 },
"timeline": [{ "t": 1792687054, "block": 95255581, "label": "Launch", "url": "…" }],
"narrative": { "text": "…", "by": "template" },
"reads": { "calls": 54, "blocksScanned": 601, "logs": 583, "ms": 66026 },
"notes": ["Read 581 transfers since the launch: 185 buys and 150 sales against the curve."]
}Findings
A finding is one fact a detective can show. Its evidence holds up to eight explorer links: the transaction, block, address or token behind it. Each finding carries one of four severities:
| Severity | Weight | Means |
|---|---|---|
info | 0 | A reading with no concern in it: a phase, a holder count, a sale that went through. |
note | 4 | Worth knowing: a fresh wallet, fees to another address, no history to judge. |
warn | 12 | A real risk: an upgradeable contract, a high creator tax, same-block buying, a creator who sold. |
alert | 30 | A pattern that usually means one hand: buys in the launch block, shared funding, consolidation, a sale that reverts. |
The grade
The score is the sum of the weights. The grade follows it:
| Grade | Score | Label |
|---|---|---|
| A | 0 to 5 | Nothing found against it |
| B | 6 to 15 | Minor notes |
| C | 16 to 35 | Proceed with care |
| D | 36 to 65 | Serious concerns |
| E | 66 and above | Hostile |
A grade is a reading of what the detectives found at the block in head, and an A says that nothing was found, which is different from nothing being there.
Timeline, reads and notes
The timeline orders what the detectives dated: the deployer's first visible launch, funding hops, the launch, the first buy, the creator's first sale. reads counts the batched requests, the full blocks and the logs the case read and how long it took. notes says in plain words what was read and where a detective stopped.
The fingerprint
fileHash is the SHA-256 of the file's canonical JSON: keys sorted at every level, no whitespace, undefined fields dropped. The same file always gives the same hash, and the random salt makes a hash impossible to guess from a target. That hash is what gets anchored; see Anchoring and the registry.