Case files and integrity checks with solana
Sources
Investigation results
Interactive audio/text chatbot
Money Flow
results of chatting with the chatbot
The main page where you can select the analysis style and data
Saved analysis

TraceBlock — Devpost Submission

Inspiration

As a team with three IT Security students, we chose the Infosys Forensic challenge over courier logistics because enterprise fraud investigation is fundamentally digital forensics and threat modeling.

In Mexico, invoice fraud (factureras, shell companies, SAT Article 69-B) drains billions of pesos. Most audit teams rely on either rigid spreadsheets that trigger disastrous false accusations or unconstrained LLMs that hallucinate findings. We applied the core rule of cybersecurity: never accuse without incontrovertible, tamper-evident logs.

What it does

TraceBlock is an AI-assisted forensic auditor that analyzes corporate accounting records (SQLite .db or CSV ZIPs), traces multi-hop fund flows, and generates defensible audit case files across five major fraud schemes:

Phantom Vendors (Factureras): Invoicing without contracts, delivery proof, or POs, combined with SAT 69-B lists and rapid fund forwarding.
Kickbacks: Multi-hop disbursements flowing from suppliers into an employee's exact 18-digit CLABE account.
Round Tripping: Circular money laundering where funds exit the company and return ($\ge 80\%$) disguised as sales or loans.
Threshold Splitting: Fragmented purchases structured just below managerial approval limits.
Revenue Inflation: Cancelled CFDIs or fictitious sales kept on books to fake receivables.

Key features:

Zero-Accusation Adversarial Gate: An automated "Challenger" tests benign explanations (refunds, reimbursements, credit notes). Unsupported leads are formally closed with transparent reasoning.
Centavo-Exact Math: Strict integer arithmetic clearly separating claimed loss, exposure, and circular funds.
Blockchain Integrity Seal: Anchors audit report hashes onto Solana Devnet (FA:v1:<commitment>) so any retroactive tampering is immediately detectable.
100% Offline Replay: Runs with zero network access in $\approx 40\text{ ms}$ and exports a self-contained .replay.zip.

How we built it

Engine & Tracing: Python 3.12, FastAPI, and NetworkX for directed multi-hop graph traversal across bank ledgers. PostgreSQL with Tiger Data for saving records .
Adversarial Pipeline: Modular architecture consisting of Detectors (leads), Corroborators (evidence linking), Challenger (benign counter-arguments), and a Deterministic Validator (code gatekeeper that models cannot bypass).
Frontend: React 19, TypeScript, Vite, and Tailwind CSS with interactive money-flow graphs and timeline inspection and back and forth talking support with ElevenLabs.
Privacy-Preserving AI: OpenRouter + NVIDIA Nemotron 3 Ultra/DeepSeek v4.1 flash for investigation scheduling and conversational Q&A. All corporate names, RFCs, and CLABEs are masked into session aliases locally before prompt construction.
Integrity Layer: Local ed25519 signing with Python’s solders to broadcast canonical hash commitments to Solana Devnet via the SPL Memo program.

Challenges we ran into

Centavo Drift: Binary floating-point rounding invalidated multi-hop reconciliations. We rebuilt all financial arithmetic on integer centavos.
Taming LLM Hallucinations: LLMs want to jump to conclusions. We constrained the model to scheduling review steps over masked aliases while keeping all calculations, evidence checks, and accusations 100% deterministic in Python.

Accomplishments that we're proud of

100% Recall & 0.0% False Accusations: Achieved a perfect score across 5 held-out reporting seeds (19 planted schemes identified, all 50 decoy traps correctly cleared).
Centavo-Perfect Reconciliation: $4,067,864.96 MXN claimed vs. $4,067,864.96 actual verified loss.
Live Solana Integrity: Successfully notarized an audit seal on Solana Devnet (slot 497616695), proving tamper-evident verification.

What we learned

Forensics is Threat Modeling: Ledgers are log files and transactions are network packets. Defense-in-depth and adversarial testing work just as well in accounting as in cybersecurity.
The Power of Adversarial Agents: Having a dedicated sub-agent whose sole job is to disprove guilt is the single best way to prevent false positives.
AI Should Advise, Not Adjudicate: In compliance, LLMs should explore and explain, but deterministic code must guard the evidence gate.

What's next for TraceBlock

CFDI 4.0 Cryptographic XML Validation: Direct verification of SAT digital stamps (SelloDigitalSAT) to detect forged XML invoices at ingestion.
Live ERP Connectors: Real-time read-only adapters for SAP, Oracle, and CONTPAQi for continuous fraud monitoring.
Zero-Knowledge Proofs (ZKP): Allowing companies to cryptographically prove clean books to regulators without exposing proprietary ledger data.