Forensics

Re-execute any historical mainnet transaction deterministically. In counterfactual mode, substitute the deployed program with a patched ELF and find out if it would have BLOCKED or REPRODUCED the incident.

BLOCKED ✓

The patched program caused the transaction to fail. The fix would have prevented the incident.

REPRODUCED ✗

The patched program did not prevent the transaction from succeeding. Further investigation needed.

CLI · rustag forensics

Re-execute a historical transaction

rustag forensics <SIGNATURE> --rpc $ALCHEMY_RPC

Counterfactual: would this fix have stopped it?

rustag forensics <SIGNATURE> \
  --rpc $RPC \
  --patch ./patched-program.so \
  --patch-program <PROGRAM_ID>

Machine-readable JSON output

rustag forensics <SIGNATURE> --rpc $RPC --json

How counterfactual mode works

Fetch the historical transaction by signature from mainnet RPC.
Reconstruct the Clock sysvar at the transaction's slot and blockTime.
Load the current deployed program; then override with the patched ELF.
Re-execute in a sealed EVM sandbox — the EVM has no network access.
If the transaction now fails, verdict = BLOCKED. If it still succeeds, verdict = REPRODUCED.
Emit a signed EvidenceBundle with the semantic diff and invariant alarms.

Read the Forensics docs