Source-linked AI summary
Graphlet-based Decentralized Finance Transaction Method Classification
Célestin Coquidé, Alessio Brini, Natkamon Tovanich
TL;DR
Identifying DeFi transaction methods from execution behavior matters because public contract interfaces do not cover every transaction. This paper classifies the 30 most frequent methods using directed, enriched graphlet features and SHAP explanations. Combining graphlet features with event logs improves macro F1, and the analysis identifies method-specific structural patterns.
Problem
Human-readable transaction-method labels rely on public contract interfaces that do not cover all transactions, motivating inference from observed execution behavior.
Source: §1 · p. 1Method
The study represents token transfers as directed transaction graphs, extracts directed graphlet features enriched with account and token information, classifies the 30 most frequent methods, and uses SHAP to analyze feature contributions.
Source: §1 · p. 2, §3.2 · p. 3, §3.3 · p. 4Results
Combining graphlet features and event logs achieves a macro F1-score of 0.918, compared with 0.693 for graphlet features and 0.793 for event logs.
Source: §5 · p. 11Takeaways & Limitations
SHAP analysis identifies method-specific structural signatures, and some methods are better characterized by transfer structures while others are better characterized by emitted events.
Source: §5 · p. 11Because the test window directly follows the training window, generalization to distant periods, unseen contracts, and other protocols remains untested.
Source: §5 · p. 11
Abstract
from arXiv · showhide
Decentralized Finance (DeFi) transactions involve complex interactions among accounts, smart contracts, and tokens. We investigate whether network topology can identify transaction methods that describe DeFi operations. We extract directed graphlet features to classify the 30 most frequent methods. Our results show that graphlet features complement event log counts in improving classification performance. Using SHapley Additive exPlanations (SHAP), we further derive model explanations that reveal method-specific graphlet structural patterns.
1 Introduction
DeFi transaction methods describe operations that may involve multiple tokens and contracts, but human-readable labels are not available for every transaction. This work tests whether directed graphlet structures can identify methods and complement event-log information.
1 Introduction
- Method inference from observed execution behavior can help identify, inspect, and validate on-chain financial activity when explicit method information is unavailable or uncertain.Human-readable method labels rely on public contract interfaces, which do not cover all transactions.Source: §1 · p. 1
- The study tests whether recurring graphlet structures distinguish DeFi transaction methods, using a topology-based representation enriched with account types, token types, and categories.It evaluates the 30 most frequent methods and uses SHAP to reveal method-associated structural patterns.Source: §1 · p. 2
- Graphlet topology captures a distinct dimension of DeFi transaction behavior that complements event-log information.The paper frames this as an initial step toward understanding complex transactions as interpretable structural building blocks.Source: §1 · p. 2
2 Related Work
Prior network studies used motifs and graphlets to analyze blockchain behavior, while explainability work applied SHAP and related methods to other blockchain tasks. This study extends prior DeFi transaction-method work to complete transaction graphs and examines graphlet-feature complementarity with event-log counts.
2 Related Work
- Network motifs and graphlets describe recurring local structures; graphlets are small non-isomorphic subgraphs, including directed variants.Motifs refer to patterns occurring more often than expected in randomized networks.Source: §2 · p. 2
- Blockchain motif studies examined user, service, ecosystem, and illegal behavior,,,, rather than operations within DeFi transactions.Source: §2 · p. 2
- Prior blockchain machine-learning work emphasized prediction, while SHAP and LIME were used to explain fraud, anomaly, and price-forecasting models,,.This work uses explanations to characterize network structures associated with individual DeFi methods.Source: §2 · p. 2
- The study extends ego-network and motif-based DeFi method work, to complete transaction graphs, adds account and token information, and assesses complementarity with event-log counts.Differences in data and methods limit direct comparison with the authors’ previous work.Source: §2 · p. 3
3 Material and Methods
The study builds attributed directed transaction graphs, extracts typed directed-graphlet features, tests classification using graphlets and event-log counts, and uses SHAP to summarize graphlet contributions by method.
3.1 Data
- 20,000 Ethereum blocks (20,000,000–20,019,999) were split evenly by block into training and test sets; simple ETH transfers, failed transactions, contract creations, and incomplete-address transfers were removed.The 30 most frequent methods were selected as labels; six use function selectors where human-readable labels were unavailable, and together the classes cover 73.78% of transactions.Source: §3.1 · p. 3
3.2 Token Transfer Network
- Each transaction is a directed, attributed multigraph of accounts and token transfers, retaining multiple transfers between the same accounts when they involve different tokens.Nodes are assigned account types, while edges carry token-transfer standards; the 1,000 most frequently transferred tokens also receive economic-function categories.Source: §3.2 · pp. 3–4
3.3 Graphlet Pattern Matching
- Directed graphlet matching identifies predefined G0–G39 subgraphs while preserving edge direction and assigning accounts to graphlet positions.For star-like G0 matches, the method counts the pattern directly rather than enumerating isomorphic combinations, avoiding combinatorial growth.Source: §3.3 · p. 4
3.4 Feature Extraction
- Four feature groups count graphlet patterns, node positions, typed node positions, and typed edge positions; node- and edge-position features count distinct entities rather than repeated matches.Raw counts are retained to convey transaction scale and complexity, and joint account-type, token-type, and category features are omitted to limit feature-space size.Source: §3.4 · p. 5
3.5 Transaction Method Classification
- The classification experiments ablate typed graphlet-feature groups, compare graphlet features with event-log counts, and combine both representations to test their complementarity.The experiments target transaction-method classification.Source: §3.5 · p. 5
3.6 SHAP Analysis and Graphlet Importance
- For each method, SHAP uses low-probability transactions as a method-specific baseline, aggregates feature contributions by graphlet, and analyzes up to 1,000 high-probability test transactions.Directional and strength graphlet-importance scores are defined for each method’s explainability set; signature magnitudes are interpreted within, not across, methods.Source: §3.6 · p. 6
4 Results
Combining graphlet features with event log counts produced the strongest reported classification performance, while SHAP analyses identified method-specific contributions from graphlet structure and attributes.
4.1 Transaction Method Classification
- Removing account-type features lowered graphlet-model F1 from 0.693 to 0.592, the largest ablation drop; removing graphlet counts changed it only to 0.691.Removing token-type and token-category features yielded F1 scores of 0.669 and 0.681, respectively.Source: §4.1 · p. 7
- F1 = 0.918, precision = 0.953, and recall = 0.918 for all graphlets combined with the top 1,000 event logs, outperforming either representation alone.Event log features alone reached F1 = 0.791 with the top 1,000 events; all graphlets achieved F1 = 0.693.Source: §4.1 · p. 7
- 82% of Transfer From transactions were misclassified as Transfer, the largest reported confusion among the top-10 methods.The next outstanding confusion was 74% of Swap Exact ETH For Tokens classified as Swap Exact ETH For Tokens Supporting Fee On Transfer Tokens; that method is outside the top-10 list.Source: §4.1 · p. 8, Figure 1 · p. 8
- Graphlets outperformed event logs for Swap (0.986 vs. 0.855) and Execute (0.964 vs. 0.927), while combining representations maintained or improved performance for 29 of 30 methods.Deposit ETH was the exception: combined F1 was 0.903 versus 0.989 for event logs alone.Source: §4.1 · p. 8, Figure 1 · p. 8
4.2 SHAP Analysis and Graphlet Importance
- Graphlet-based features accounted for more than 50% of cumulative absolute SHAP contributions for most top-10 methods; Transfer From reached 79.01%, while Unxswap By Order Id reached 29.44%.The latter method relied primarily on event-log features.Source: §4.2 · pp. 9–10, Table 2 · p. 9
- Top features combined graphlet and event-log signals; graphlet features often encoded account type by node position and token type or category by edge position.Position-specific account patterns distinguish Deposit (0 Contract) from Withdraw (1 Contract), reflecting opposite asset-flow directions relative to the contract account.Source: Table 2 · p. 9, §4.2 · p. 10
- G0 contributed strongly across all top-10 methods and dominated Transfer, while G1–G3 had high strengths across many methods.Swap variants and Execute also showed strong contributions from G6, G9, G12, G13, G18, and G19, consistent with multistep interactions among multiple accounts and transfers.Source: §4.2 · p. 10, Figure 2 · p. 10
5 Conclusion
The paper concludes that graphlets provide predictive and interpretable representations of DeFi transaction behavior, while noting that generalization beyond the adjacent training and test periods remains untested.
5 Conclusion
- Graphlet features achieved macro F1 = 0.693 versus 0.793 for event logs, while combining them raised performance to 0.918.Some operations were better characterized by transfer structures and others by emitted events.Source: §5 · p. 11
- The test window directly followed the training window, leaving generalization to distant periods, unseen contracts, and other protocols untested.The authors propose evaluating larger datasets and additional baselines and explanation approaches in future work.Source: §5 · p. 11
Appendix; A Directed Graphlets
- The appendix supplies directed graphlet patterns, full confusion matrices and per-method scores, and complete SHAP-based feature and graphlet analyses.It notes that G31, G36, G37, and G39 do not occur in the data.Source: Appendix · p. 14, A Directed Graphlets · p. 14
B.1 Confusion Matrix of the Combined Model
The recall-normalized confusion matrix shows that the combined model classifies most methods correctly, but its largest errors occur between methods with closely related functionality or execution behavior.
B.1 Confusion Matrix of the Combined Model
- 81.8% of Transfer From transactions are classified as Transfer, the largest confusion; both methods represent token transfers and can yield similar structures and event profiles.Source: §B.1 · p. 14
- 74.0% of Swap Exact ETH For Tokens transactions are classified as the fee-on-transfer variant, reflecting their closely related swap operations.The methods mainly differ in handling tokens that charge transfer fees.Source: §B.1 · p. 14
- Other errors include Execute F Fs Yo as 0xa0000000 (14.3%), the fee-on-transfer swap variant as Execute (10.5%), and smaller confusions among deposit, withdrawal, and staking methods.These errors frequently connect methods with related functionality or overlapping execution behavior.Source: §B.1 · p. 14
- The recall-normalized matrix uses actual methods as rows and predicted methods as columns, so diagonal entries are recall and off-diagonal entries show misclassifications.Rows sum to 1.Source: §B.1 · p. 14, Figure A2 · p. 16
B.2 Method-Level Performance
Graphlet features and event logs perform differently across methods, while their combination improves or matches the best individual F1-score for 29 of the 30 methods.
B.2 Method-Level Performance
- Graphlet features outperform event logs for 9 methods, event logs outperform graphlets for 20, and both reach F1-score 1.000 for Propose Block.Source: §B.2 · p. 17
- Graphlets excel on structurally distinctive methods: Swap scores 0.986 versus 0.855 for event logs, while Execute F Fs Yo scores 0.911 versus 0.237.Graphlets also outperform event logs for Mint and 0xa0000000.Source: §B.2 · p. 17
- Event logs perform better for methods with distinctive emitted signatures: Uniswap V3Swap To scores 0.970 versus 0.407 for graphlets, and several protocol-specific methods reach F1-score 1.000.Event logs also outperform graphlets for Deposit ETH and Multicall.Source: §B.2 · p. 18
- The combined representation improves on both individual models for 19 methods and matches the best individual F1-score for 10 more; only Deposit ETH falls below its best individual score.Stake reaches F1 = 0.941, versus 0.478 for graphlets and 0.779 for event logs.Source: §B.2 · p. 18
- Deposit ETH is the exception: the combined F1-score is 0.903 versus 0.989 for event logs, as precision falls from 0.994 to 0.824 while recall rises from 0.983 to 0.999.Source: §B.2 · p. 18
C.1 Feature-level SHAP analysis
SHAP analyses show that graphlet contributions vary by method, with local address, contract, and token configurations providing interpretable structural signals alongside event-log features.
C.1 Feature-level SHAP analysis
- Graphlet participation ratio (GPR) compares cumulative absolute SHAP contributions from graphlet features with those from all features; graphlet dominance measures the share of transactions where graphlet contributions are larger.The explainability set size varies with method support in the test set.Source: §C.1 · p. 18
- Graphlet features dominate explanations for most analyzed methods, with GPR above 50% for most; Mint and Transfer from reach 80%, while Unxswap By Order Id reaches only 29.4%.Unxswap By Order Id may rely on order identifiers and routing information not captured by local transfer topology.Source: §C.1 · pp. 18–19
- Graphlet dominance exceeds 90% for many methods, including 100% of transactions for one fee-on-transfer swap variant, but is only 0.1% for Unxswap By Order Id.Source: §C.1 · p. 19
- Additional methods show strong graphlet contributions: Execute F Fs Yo, 0xa0000000, 0x263fd4a1, and two swap methods have GPR values from 72% to almost 79%.These methods also show graphlet dominance in more than 93% of transactions.Source: §C.1 · pp. 19–20
- Graphlet reliance is heterogeneous: Uniswap V3Swap To has GPR 35% and dominance in 4.3% of transactions, while Send Message is more balanced at GPR 50.8%.Buy With Eth, Sigma Buy, and Sigma Sell have GPR below 40%; unlabeled methods also vary substantially.Source: §C.1 · p. 20
- Top graphlet features commonly encode address and contract configurations, while token types recur in exchange, deposit, and withdrawal operations.Mint’s 0 Null feature aligns with token creation, and 0 1 erc721 links it to the NFT ecosystem.Source: §C.1 · pp. 19–20
C.2 Graphlet signatures
Aggregated graphlet importance reveals method-specific signatures, from simple transfer patterns to larger local structures that distinguish exchange operations and unlabeled methods.
C.2 Graphlet signatures
- The method heatmap shows the distribution of signed directional importance and score magnitude; positive direction indicates a contribution toward predicting that method relative to baseline.Negative scores should not be read as counter-signatures without a method to distinguish absent patterns from alternative signatures.Source: §C.2 · p. 20, Figure A3 · p. 22
- G0 contributes strongly to most methods and dominates Transfer, consistent with direct token transfers’ dyadic structure.Unlabeled methods and Bond Withdrawal are exceptions to G0’s broad contribution.Source: §C.2 · p. 20
- Swap-related methods show positive contributions from G0–G3, while Swap and Uniswap V3Swap To also emphasize distinct larger graphlets, suggesting signatures can distinguish exchange types.Swap emphasizes G6 and G9; Uniswap V3Swap To emphasizes G9, G3, G2, and G12.Source: §C.2 · p. 21
- Larger graphlets contribute to Multicall, Execute, Stake, and swap variants, whereas Mint and Claim have simpler signatures dominated by G0 and G1.Source: §C.2 · p. 21
- Unlabeled methods have distinct signatures: 0x415565b0 emphasizes G11, G9, and G6, while 0x263fd4a1 is particularly characterized by G14.These patterns differentiate methods through local transaction topology despite absent explicit method information.Source: §C.2 · p. 21