How XemaS knows
what it knows
Every finding is traceable to the evidence that produced it. XemaS separates evidence, verification, risk, and explanation so every verdict can be inspected - not just trusted.
Six principles behind every investigation
Most security tools return a score. XemaS returns a score, the evidence that produced it, the evidence state of that evidence, and an explicit statement of what could not be assessed. That difference matters when the verdict has to be explained to a regulator, a board, or a counterparty.
Six layers, one traceable finding
Each layer answers a distinct question. A finding retains provenance through every layer it passes. The AI layer sits last on purpose - it reads the canonical evidence model and its verification, conflict, applicability, and acquisition states. It does not produce them.
See how XemaS works in practiceAssessments can draw from four broad evidence channels. Independence is evaluated per fact - sources sharing an upstream are treated as correlated, not confirming.
Every fact has one canonical owner. Correlated observations are merged, not counted multiple times. This prevents inflated confidence.
Independence check, provenance recording, recency weighting. Sources sharing an upstream are treated as correlated, not confirming.
Both readings are preserved. Verification is downgraded to CONFLICTED. The conflict is surfaced, not averaged. Conservative policy is applied separately from the canonical evidence record.
Evaluates canonical findings against the scoring policy. Verification state and evidence coverage are shown alongside the risk score - not merged into it.
AI reads the canonical evidence model - verification, conflict, applicability, and coverage states - and explains the verdict. It does not generate it. The evidence is the substrate; the explanation is the surface.
Evidence Collection
Contract assessments can draw from four evidence channels. Applicable evidence families are evaluated separately. Sources sharing an upstream are not counted as independent corroboration.
On-chain data
On-chain state collected directly via RPC. Third-party sources may corroborate but are never treated as canonical chain state.
- Ownership and authority state
- Holder concentration and distribution
- Liquidity pool lock status
- Proxy implementation history
- Transaction history and behavioral signals
Static analysis
Source-verified contracts get expanded AST and control-flow analysis. Unverified bytecode gets opcode pattern matching and selector extraction - relevant functions identified without source code.
- Expanded AST analysis for source-verified contracts
- Bytecode opcode pattern matching
- Function selector classification
- Access control and ownership detection
- Proxy architecture identification
ML behavioral signals
Versioned behavioral models trained on labeled security data. Scores behavioral patterns - gas usage, timing, value distribution - that correlate with known attack classes. One signal among several, never the sole basis for a verdict.
- Behavioral pattern classification across gas, timing, and value distribution
- One signal among several - not a standalone verdict
- Model version recorded with every scan
Entity and history intelligence
Deployer wallet history, funding chain, prior projects, and entity attribution across labeled addresses. A clean contract with a deployer linked to prior exit events carries a different risk profile than the contract alone.
- Deployer wallet history and prior projects
- Funding chain tracing
- Entity attribution against labeled registry
- Cross-chain behavioral linkage
Evidence Verification
Independence
High confidence requires independent sources to agree. Ownership confirmed by the on-chain authority record and corroborated by transaction history is stronger than a single-source finding. Sources sharing an upstream are treated as correlated, not confirming.
Provenance
Every piece of evidence carries its source, acquisition method, and timestamp. Provenance is preserved with the finding so any claim can be traced back to the specific on-chain data that produced it.
Recency
On-chain state changes - ownership transfers, liquidity is removed. Evidence ages as new blocks are produced. The scan record preserves observation time so any report can be correctly interpreted relative to when it was made.
Conflict Resolution
Independent sources sometimes disagree. When they do, three rules apply.
Conservative default
Both readings are preserved and verification is downgraded to CONFLICTED. Conservative operational policy is applied separately from the canonical evidence record. Absence of exploitation is not evidence of absence of the mechanism.
Explicit CONFLICTED state
Conflicts are not resolved silently. The state is marked CONFLICTED and both readings are preserved in the canonical record. A reviewer can examine what disagreed and why, rather than a smoothed result that obscures the disagreement.
No synthetic resolution
There is no synthetic resolution. A source identifying a controller as a Safe multisig and another identifying it as an EOA do not produce a synthetic intermediate conclusion. Both claims remain visible and verification is downgraded. The conflict is the finding.
Confidence and Evidence Debt
Confidence measures the quality of the evidence. It is not confidence in the AI. A high confidence finding means evidence depth is strong. A low confidence finding means the assessment is limited - not that the risk is low.
What raises confidence
- Multiple independent sources agree on the same finding
- Evidence was collected at sufficient depth to cover the applicable scope of the question
- The on-chain data is recent relative to the observation time
- The entity type is well-supported by available analysis methods
What limits confidence (Evidence Debt)
- Only one source could be consulted for a particular dimension
- The entity type has limited on-chain footprint (new deployment, sparse history)
- A proxy contract whose implementation could not be resolved
- Chain conditions limited the depth of data that could be collected
Illustrative
High risk, low confidence: more evidence is needed before acting. Both numbers are always shown together.
Evidence Debt principle: confidence grows only through evidence improvement - corroboration, fresher observations, resolved conflicts, or previously missing evidence. Evidence Debt is derived from the applicable families that remain missing, unresolved, stale, or conflicting - not a complement of the confidence number. The evidence state is shown alongside each finding, not hidden behind a single aggregate score.
Evidence States
Every finding carries evidence dimensions across four distinct axes: acquisition, verification, conflict, and applicability. These are not interchangeable values of a single field - each axis answers a different question about the evidence.
Evidence was collected for some aspects of the question, but gaps remain. The finding is real but does not cover the full applicable scope of the claim.
The question was asked, and no usable evidence was found. This is not evidence of absence - it means the assessment could not be made for that dimension, not that the risk does not exist.
The claim meets the fact-specific verification rule using sufficient applicable evidence. The confidence level reflects the depth and independence of that evidence.
Evidence exists but could not be independently confirmed. A proxy contract whose implementation could not be resolved, or an authority wallet whose history is ambiguous.
Two or more independent sources disagree. Both readings are preserved. Verification is downgraded, the conflict is surfaced, and any conservative operational policy is applied separately from the canonical evidence record.
The question does not apply to this entity type. Solana mint authority revocation is not applicable to an EVM contract. Chain-native semantics determine which questions are relevant.
Two investigations, two outcomes
The same pipeline. Different evidence. Different states. Confidence reflects what the evidence actually supports.
Ethereum - ERC-20
USD Coin (USDC)
BNB Smart Chain - BEP-20 (2021)
Squid Game Token (SQUID)
Real investigation output is available at usdc-ethereum and squid-game-token-2021.
What XemaS cannot determine
On-chain intelligence has structural limits. Naming them is part of the methodology.
Off-chain intent
A contract that passes every on-chain check can still be operated maliciously. XemaS can characterize what a contract is capable of and what patterns the deployer has shown; it cannot determine what the operator intends to do.
Future exploits in present code
Static analysis and ML models detect patterns that correlate with known attacks. A novel attack vector, or a logic flaw with no prior exploit history, may not be flagged. The absence of known patterns is not a safety guarantee.
Identity behind an address
On-chain attribution links addresses to behavioral clusters and labeled entities where that linkage is evident. It does not verify the real-world identity of a person or entity. A labeled address is labeled from on-chain evidence, not KYC.
Mixer exit paths
Mixer and tumbler attribution can trace funds to and from known mixing protocols. The specific path from a mixing output to a final beneficiary is generally not determinable from on-chain evidence alone.
Explainable intelligence
Defensible positions
"Our system returned LOW RISK" is not a defensible posture. "Our system collected these evidence types, found these patterns, assessed this proportion of the relevant question space, and here are the gaps" is. The methodology page is part of that posture.
No hidden assumptions
A score without provenance is an assumption. Every finding XemaS surfaces is linked to the evidence that produced it. When a finding is PARTIAL or UNVERIFIED, that is shown - not smoothed into a confident-looking number.
Architecture that compounds
Evidence-first architecture improves with every new data source because the verification and conflict models apply universally. Exposing the reasoning model and its limits is how a methodology remains trustworthy as coverage expands.
The evidence is the product. The score is one policy-derived summary of the security findings. This distinction is why XemaS produces different output than a scanner that starts from the score and works backward.
Methodology questions
Apply the methodology
Every supported assessment shows the evidence collected, its verification state, and confidence alongside the risk conclusion.