The result you are building

Finished Result:

A chain-aware wallet event feed that validates network and address, defines inbound/outbound/contract/approval/bridge activity, records authoritative transaction evidence, handles finality and reorganizations, and delivers normalized alerts with raw provenance.

Use this guide when

You monitor public wallets, treasury addresses, clients' watchlists, or domain-linked addresses.
Events must be normalized across Solana, Ethereum, Base, or other EVM networks.
The same hexadecimal address can exist on several EVM chains with unrelated activity.

Do not use it as a substitute for

Assuming a label proves ownership or identity.
Collapsing a bridge deposit and destination receipt into one transfer without correlation evidence.

Before you change anything

Collect these items first. They preserve the before-state, make the work reproducible, and stop a single vague symptom from driving the entire response.

Watchlist source, owner/label claim, purpose, chain/network identifiers, address, and validation time.
RPC/indexer providers, commitment/confirmations, start checkpoint, and coverage.
Transaction/signature/hash, block/slot, index/log/instruction, from/to, asset contract/mint, amount/raw units, fee, and status.
Token metadata/source, internal calls, approvals, program events, bridge correlation, and counterparty labels.
Reorg/fork, duplicate, gap, provider disagreement, spam, dust, and delivery tests.

Stop Before Proceeding:

Stop identity claims when label ownership is unverified, and stop value interpretation when asset/network/decimals or execution status is uncertain. Monitoring public activity does not authorize spending or deanonymization.

Understand the system before fixing it

On-chain evidence outranks the interface Wallets and dashboards can be stale, partial, or misleading. Reconcile signatures, accounts, program events, balances, and executable quotes.

Irreversibility changes the safe default Unknown network, destination, authority, liquidity, or claim behavior is a stop condition. Use low-value tests and explicit maximum loss.

Address format does not identify network EVM addresses can be valid on many chains. Every record needs a CAIP-style or equivalent chain identity; Solana addresses need cluster and account ownership context.

Transfers are not the whole transaction Approvals, delegate changes, internal calls, token-program instructions, failed transactions, fees, burns, mints, and bridge events can change risk without a simple transfer.

Evidence-to-decision map

Start with the row that most closely matches the evidence. The first test isolates a layer; it is not permission to
make every available change.

   Evidence              Likely layer     First decisive check            What the result means

   Same EVM address      Network          Verify chain ID, RPC genesis,   Monitor queried the wrong network or merged networks.
   shows unexpected      selection        and explorer
   assets

   Alert says received   Execution/stat   Inspect receipt/status and      Indexer emitted intent/log-like data without final success
   but tx failed         us               reverted logs policy            semantics.

   Amount is off by      Token            Read contract/mint decimals     Metadata is missing, stale, or from wrong asset.
   powers of ten         metadata         and raw amount

   Bridge appears as     Correlation      Match protocol message/nonce    Cross-chain legs need protocol-specific linkage and finality.
   two unrelated                          /source/destination evidence
   transfers

   Dust/spam floods      Classification   Evaluate asset authenticity,    Feed treats every transfer as equally meaningful.
   feed                                   amount, sender pattern, and
                                          user policy

Step-by-step procedure

Work in order and retain the output from each step. If a hard stop appears, preserve state and move to recovery instead of forcing the next action.

01 Build a chain-qualified watchlist Why: A precise boundary prevents a plausible fix from solving the wrong problem.

Do: Store network/cluster ID, validated address, label source, ownership confidence, purpose, start point, and alert policy. Keep labels as claims with provenance.

Read the result: No event exists without an explicit chain and watchlist basis.