Complete reference of transaction fields available in rule conditions. All fields are always available and don’t require any special configuration.
Basic Transaction Fields
Essential transaction information available in every transaction.
| Field | Type | Description | Example |
|---|
tx.hash | string | Transaction hash (unique identifier) | tx.hash != "" |
tx.from | address | Sender address | tx.from == "0x742d35..." |
tx.to | address | Recipient address (null for contract creation) | tx.to in (known_addresses) |
tx.value | wei | Transaction value (use ether for readability) | tx.value > 100 ether |
tx.gas | uint64 | Gas limit | tx.gas > 500000 |
tx.gas_price | wei | Gas price (use gwei for readability) | tx.gas_price > 100 gwei |
tx.gas_used | uint64 | Actual gas consumed (from receipt) | tx.gas_used > 100000 |
tx.input | hex | Transaction input data (calldata, raw) | len(tx.input) > 100 |
tx.nonce | uint64 | Transaction nonce | tx.nonce == 0 |
tx.status | uint64 | Transaction status (0=failed, 1=success) | tx.status == 1 |
tx.logs_count | int | Number of event logs emitted | tx.logs_count > 5 |
Block Data
Block-level context for the transaction.
| Field | Type | Description | Example |
|---|
tx.block.number | uint64 | Block number | tx.block.number > 18000000 |
tx.block.timestamp | uint64 | Block timestamp (Unix timestamp) | tx.block.timestamp > 1234567890 |
Function Selectors
Check function selectors using the startswith() function:
# ERC-20 transfer() function
condition: startswith(tx.input, "0xa9059cbb")
# ERC-20 approve() function
condition: startswith(tx.input, "0x095ea7b3")
Arrays: Event Logs, Transfers, and Approvals
Blocklight automatically parses event logs and provides three arrays for easy access:
tx.logs - Raw Event Logs
Raw event logs emitted by contracts. Use with array methods (.any(), .count()).
| Property | Type | Description | Example |
|---|
address | address | Contract that emitted the log | tx.logs.any(address == "0x...") |
event_signature | string | Event signature hash (topic[0]) | tx.logs.any(event_signature == "0xddf...") |
event_name | string | Parsed event name | tx.logs.any(event_name == "Transfer") |
Transfer, Approval, ApprovalForAll, Unknown
tx.transfers - Parsed ERC-20 Transfers
ERC-20 Transfer events automatically parsed for easy access.
| Property | Type | Description | Example |
|---|
contract | address | Token contract address | tx.transfers.any(contract == "0x...") |
from | address | Source address (padded 32 bytes) | tx.transfers.any(from == "0x0000...") |
to | address | Destination address (padded 32 bytes) | tx.transfers.any(to == "0x0000...") |
amount | string | Transfer amount (hex string) | tx.transfers.any(amount != "0x0") |
Address Format: Addresses in tx.transfers are padded to 32 bytes (64 hex characters) as they appear in event topics. Example: 0x000000000000000000000000742d35cc6634c0532925a3b844bc9e7595f0beb
tx.approvals - Parsed ERC-20 Approvals
ERC-20 Approval events automatically parsed. Essential for detecting unlimited approvals and approval-based attacks.
| Property | Type | Description | Example |
|---|
contract | address | Token contract address | tx.approvals.any(contract == "0x...") |
owner | address | Owner address (padded 32 bytes) | tx.approvals.any(owner == "0x0000...") |
spender | address | Spender address (padded 32 bytes) | tx.approvals.any(spender == "0x0000...") |
amount | string | Approval amount (hex string) | tx.approvals.any(amount != "0x0") |
Address Format: Addresses in tx.approvals are padded to 32 bytes (64 hex characters) as they appear in event topics.
Unit Suffixes
Use these suffixes for better readability. Blocklight automatically converts units for you.
| Unit | Field | Conversion | Example |
|---|
ether | tx.value | 1 ether = 1018 wei | tx.value > 100 ether |
gwei | tx.gas_price | 1 gwei = 109 wei | tx.gas_price > 50 gwei |
Field Naming Patterns
All fields follow consistent patterns:
- Direct properties:
tx.value, tx.hash, tx.from
- Nested structures:
tx.block.timestamp, tx.block.number
- Arrays:
tx.logs, tx.transfers, tx.approvals (use with array methods)
Next Steps
