Confused by internal transactions

Question

Let's say contract A has function F.

If someone uses a regular account to call A::F a transaction is laid down on the blockchain. That transaction is easily found on EtherScan for example.

If a contract account, say contract B, uses call to call the function A::F, this is called an "internal transaction," and this is not laid down as a transaction on the blockchain. So, for example, you would not see a transaction on contract A 'transactions' page on EtherScan or by interrogating the blockchain with something like web3.

Two questions:

1) Is what I said above correct?

2) Other than by clicking on EtherScan's 'Internal transactions' link, how can I possibly know about these 'internal' transactions?

In other words, what if I wanted to audit EtherScan by using the blockchain directly? Can I do that? How?

Answer 1

1) Is what I said above correct?

Yes.

2) Other than by clicking on EtherScan's 'Internal transactions' link, how can I possibly know about these 'internal' transactions?

This has come up a couple of times recently. Block explorers use their own instrumented versions of the EVM, so to do something similar you'd need to implement your own.

• Instrumenting EVM
• How to get contract internal transactions
• How do block explorers actually work?

Edit:

As per this answer to one of the other threads, Parity v1.1 should include a feature to allow users to trace and inspect internal transactions.

Answer 2

1) Yes.

2) See following.

Here's a wallet executed internal transaction - 0xcad1183ecf7f278713858d92c06f00934f79a75eb5c852352a3ac35de07e151c.

I use the following to firstly extract the debugging information:

user@Kumquat:~$ geth --exec 'debug.traceTransaction("0xcad1183ecf7f278713858d92c06f00934f79a75eb5c852352a3ac35de07e151c")' attach >  0xcad1183ecf7f278713858d92c06f00934f79a75eb5c852352a3ac35de07e151c.txt

Looking in the output file, I search for all "CALL" instructions and these are:

1)

  }, {
      depth: 2,
      error: "",
      gas: 25007,
      gasCost: 109040,
      memory: ["0000000000000000000000000040a54aa449a9a8f4e8a0641a1caf76efcc0c8e", "0000000000000000000000000000000000000000000000000000000000000102", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000040a54aa449a9a8f4e8a0641a1caf76efcc0c8e", "0000000000000000000000000000000000000000000000004563918244f40000", "000000000000000000000000bb9bc244d798123fde783fcc1c72d3bb8c189413", "0000000000000000000000000000000000000000000000000000000000000080", "0000000000000000000000000000000000000000000000000000000000000000"],
      op: "CALL",
      pc: 2299,
      stack: ["00000000000000000000000000000000000000000000000000000000b61d27f6", "00000000000000000000000000000000000000000000000000000000000003c6", "000000000000000000000000bb9bc244d798123fde783fcc1c72d3bb8c189413", "0000000000000000000000000000000000000000000000004563918244f40000", "0000000000000000000000000000000000000000000000000000000000000084", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000", "000000000000000000000000bb9bc244d798123fde783fcc1c72d3bb8c189413", "0000000000000000000000000000000000000000000000004563918244f40000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000004563918244f40000", "000000000000000000000000bb9bc244d798123fde783fcc1c72d3bb8c189413", "00000000000000000000000000000000000000000000000000000000000186a0"],
      storage: {
        0000000000000000000000000000000000000000000000000000000000000106: "0000000000000000000000000000000000000000000000004563918244f40000",
        0000000000000000000000000000000000000000000000000000000000000107: "000000000000000000000000000000000000000000000000000000000000422c"
      }
  }, {

2)

  }, {
      depth: 3,
      error: "",
      gas: 25007,
      gasCost: 76291,
      memory: ["0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060"],
      op: "CALL",
      pc: 2761,
      stack: ["0000000000000000000000000000000000000000000000000000000000000966", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000980", "000000000000000000000000ff8fb62c8a7d3bb7b825c6b859020d4eac9ea998", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000003782dace9d900000", "000000000000000000000000807640a13483f8ac783c557fcdf27be11ea4ac7a", "0000000000000000000000000000000000000000000000000de0b6b3a7640000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000de0b6b3a7640000", "000000000000000000000000807640a13483f8ac783c557fcdf27be11ea4ac7a", "00000000000000000000000000000000000000000000000000000000000106b3"],
      storage: {}
  }, {

The following code from github.com/bokkypoobah/TheDAOData/getTheDAOCreatedTokenEventsWithNonZeroExtraBalance_v3#L65-L85 will detect Wallet contract execute(...) functions using the function signature 0xb61d27f6 which is on the stack of the 1) "CALL" trace above.

status.structLogs.forEach(function(e) {
  if (e.op == "CALL") {
    var stack = e.stack;
    extraBalanceAmount = web3.toBigNumber("0x" + stack[stack.length-3]);
    // baac5300 = createTokenProxy(address) - https://www.4byte.directory/signatures/?bytes4_signature=0xbaac5300
    if (stack[0].substring(56) == "baac5300") {
      tokenOwner = "0x" + stack[2].substring(24);
      createdBy = "Proxy";
    } else if (stack[0].substring(56) == "b61d27f6") {
      amount = web3.toBigNumber("0x" + stack[stack.length-3]);
    } else if (stack[0].substring(56) == "00000966") {
      if (("0x" + stack[3].substring(24)) != tokenOwner) {
        tokenOwner = "0x" + stack[3].substring(24);
        createdBy = "Wallet Contract";
      }
    }
  }
  if (e.error.length > 0) {
    error = e.error;
  }
});

And from https://github.com/ethereum/dapp-bin/wallet/wallet.sol#L344-L360 the execute(...) function has the following parameters:

function execute(address _to, uint _value, bytes _data) external onlyowner returns (bytes32 _r) {

which matches the function signature from 0xb61d27f6:

execute(address,uint256,bytes)

Note that a multisig wallet contract call is from a confirm(...) function. From github.com/ethereum/dapp-bin/wallet/wallet.sol#L362-L371:

// confirm a transaction through just the hash. we use the previous transactions map, m_txs, in order
// to determine the body of the transaction from the hash provided.
function confirm(bytes32 _h) onlymanyowners(_h) returns (bool) {
    if (m_txs[_h].to != 0) {
        m_txs[_h].to.call.value(m_txs[_h].value)(m_txs[_h].data);
        MultiTransact(msg.sender, _h, m_txs[_h].value, m_txs[_h].to, m_txs[_h].data);
        delete m_txs[_h];
        return true;
    }
}

I saw this message two days ago New in Geth: Support for server-side transaction tracing with custom JS callbacks!, but have not had time to check out the new debug.traceTransaction(...) functionality:

[–]nickjohnsonEthereum - Nick Johnson[S] 22 points 2 days ago

tl;dr: You can now call debug.traceTransaction with a custom JavaScript function; that function gets executed for every step of the VM on the target transaction, letting you accumulate and transmit back only the details you care about from the traced transaction - for instance, you can return just the call graph, or just a list of successful value transfers.

Answer 3

Answering this specific question:

2) Other than by clicking on EtherScan's 'Internal transactions' link, how can I possibly know about these 'internal' transactions?

There's an alternate solution to a debugger or mining software features: Use Events. They are very cheap on gas, and can provide you with a pretty good trace of what happened. For example you can log all the inputs to a Solidity function and log any key branches or outputs of the Solidity function.

I pretty much never use a debugger and always use extensive Events.

This won't help you if you are calling someone else's code that doesn't have events. I'm still shocked how much code out there doesn't use events...

Documentation:

http://solidity.readthedocs.io/en/develop/contracts.html#events

Answer 4

To answer your second question, you really have two main options for track internal transactions: (a) running a Parity node (can be expensive and take up to weeks to sync) or (b) using address activity tracking (such as internal transactions) from Alchemy Notify.

I'd highly recommend you check out Alchemy Notify--> it's free and will have you up and running in <5 minutes. Here's a link to their docs: https://docs.alchemyapi.io/alchemy/guides/using-webhooks#address-activity