Ariadne: investigation and monitoring for Algorand

The company shown here, Acme Labs, is made up and has no link to any real company of that name. All of its data is made up too. The voice is AI-generated.

Ariadne is Nodely’s investigation and monitoring workspace for Algorand. You work in cases. You ask an agent questions in plain language, and its answers cite their sources. Memory, to-dos, sources, files and a live summary stay with the case. Labels are shared across the organization.

Who it is for

All the features described here are for Nodely enterprise customers, by invitation. Planned as basic features on other plans, with cheaper plans on the way: security dashboards, dApp vulnerability monitoring and QTScan audits included. Details may change. Talk to us: sales@nodely.io.

Not available yet: the scratch pad, the cheaper plans, the basic features on other plans and the customer views of threat intelligence, dApp radar and markets. Plans and features may change. The first three screens below are not available yet in this form: dApp radar and threat intelligence are among those customer views, and QTScan audits on other plans are among the basic features still planned.

What it does

Every screenshot here shows a made-up company with made-up data, stamped DEMO. The accounts, amounts, dates, people, labels, answers, case summary and Grounded badges are invented. The first three screens are the Nodely portal’s security panels. The other four are Ariadne itself.

dApp radar

The radar panel lists the sites on domains an organization has proven are its own, with requests, submitted transactions, busiest apps and findings. Here one site has a high finding: transaction submit errors at 6.1% for 3 hours. A clean scan proves nothing.

dApp radar in the portal: the red pill is the high finding.

Threat intelligence tied to your own stack

The panel has two views: outages and crypto hacks, and your own dApps. The second lists only findings tied to the organization’s registry. Here that means an expiring TLS certificate, a database port open to the internet, an outdated dependency and a missing Content-Security-Policy header.

Threat intel in the portal, Your dApps view.

QTScan contract audits

QTScan audits are planned to come on request, within a monthly allowance. On this panel you enter app ids or contracts, and the status moves from queued to in progress to report ready or rejected. QTScan reads the contract as deployed, not as it looks in a repository, and checks it against a list hardened by real Algorand exploits. Findings are leads to review. A clean report is no guarantee.

QTScan in the portal. The requests, usage and findings on screen are made up.

Follow the money, hop by hop

When money moves, ask the agent where it went. In this made-up example, a 0-amount token opt-in also rekeyed the Acme treasury account, moving its signing power to a new key. Two days later 412,800 ALGO left in two hops and reached an exchange-labelled wallet in 19 minutes. The answer on screen, written for this demo, lays that out as a hop table and says where the trace stops.

An answer written for this demo and its hop table, beside the case summary.

Flow lab

Flow lab takes a set of accounts and a time window, and finds how they connect over 1 to 4 hops: the paths, connecting accounts and value flows between them. You can export CSV files, PNG or SVG images, and a bundle whose manifest records a sha256 hash of each CSV. By default, exchange hot wallets, AMM pools and fee sinks are stops, not intermediates, and you can untick each one for a run. Accounts it did not expand are listed, and “not expanded” does not mean “not connected”.

Flow lab on three made-up accounts: parameters, graph and exports.

Every answer cites its sources

Answers end with a sources list, and numbered chips in the text link to it. The Grounded badge means every factual sentence cites a source the agent retrieved. Not every answer earns it, and it does not mean the sentence is true. A person checks that. If an answer names an id, round or amount found in no tool result, case note or message, a note under the answer lists it as unverified.

An answer written for this demo, with a Grounded badge, citation chips and a sources list.

Every label confirmed by a person

The agent can only propose labels and tags. Until a person reviews them, proposed labels carry an “Inferred by agent” badge and rank below analyst labels. Each one waits in the review queue for one of four choices: confirm, mark suspected, discard the proposal or reject the label. Proposed tags can be confirmed, discarded or rejected. Exports mark unreviewed agent labels as “[agent-inferred, unreviewed]”.

The review queue: proposed labels wait here for a person.

Watches and analyses

Watches check a case’s accounts, assets and apps for new on-chain activity about every 2 to 5 minutes. Alerts arrive in the app, by e-mail or in Slack. The agent can propose a watch, but only a person can activate it.

Analyses keep the agent’s traces and clustering runs in the case: taint traces, rekey clusters, wash rings, similar accounts. A lead, not a proof.

What it does not do

Findings are research aids, not conclusions. Chain records show keys and accounts, not people. Ariadne traces funds; it recovers nothing.

See Ariadne at a glance

In two minutes, NoA, the Nodely agent, goes through threat intel, dApp radar, DeFi radar, 1.6 million labeled entities, the map of every note on mainnet, Network monitor and alerts, and ends on one case built from a real wallet drain.

Unlike the screenshots above, this video shows the real workspace with real data. The case is real, with transactions from public Algorand records. The DeFi radar findings are past exploits replayed through the detectors, and the Slack message is redrawn from the notification’s own text. Some site and account names are blurred. The voice is AI-generated.

To talk to us about Ariadne, write to sales@nodely.io.