How to Keep a DeFi Transaction Evidence Folder
A lightweight record structure for hashes, screenshots, sources and follow-up notes.
This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.
A transaction evidence folder is the place where you keep what proves what happened. Not a screenshot you meant to save later, and not a note in a chat window you cannot search six months on. It is a deliberate folder per investigation or per period, holding the transaction hash, the inputs you used, the screenshots you took while the state was still visible, the sources you consulted, and what you still need to check.
DeFi transactions settle asynchronously and irreversibly. By the time a problem is visible, the state that would explain it has usually moved on or been overwritten. The evidence that would settle a dispute is almost never the evidence that was easiest to capture.
Decide What the Folder Is For
There are two different jobs, and mixing them makes both useless.
An operational folder supports your own activity: it lets you reconstruct what you did, confirm a deposit arrived, and produce a clean record if a counterparty asks a question. A dispute folder supports a specific contested event and is organised around that event’s timeline.
Keep them separate. A dispute folder that also holds six months of routine transactions is hard to hand to anyone.
The Five Records Every Entry Needs
Whatever the purpose, an entry is only useful if it carries the same five things:
- Transaction hash. The single identifier that lets anyone re-check the transaction without trusting your description of it.
- Network and contract. A hash without the network is ambiguous, and contract addresses are reused across deployments.
- Timestamp and block. When it happened, and in which block.
- Inputs. What you sent, what you received, the token, the amount, the slippage setting you chose.
- What you expected to happen. Written before you check the outcome.
That last field is the one people skip and the one that carries the diagnostic weight. “I expected the full amount to arrive” and “I expected a partial amount after slippage” are different claims, and only the first one turns an unexpected result into a question.
Screenshots Are Supporting Evidence, Not Proof
A screenshot captures what the interface showed you at one moment. That is genuinely useful, but it has limits you should record alongside it.
Screenshots usually omit the transaction hash unless you deliberately capture it. They carry no timestamp unless the interface displays one. They can be cropped, edited or staged, which means they carry little weight on their own if a dispute escalates.
Treat a screenshot as a pointer to the hash, not as a substitute for it. If you capture one, capture the hash and the block number in the same image, and write the date you took it next to the file.
The records with actual evidentiary weight are on-chain state: the transaction, the emitted events, the contract code at the block in question. Capture those by hash and let them be re-checkable later.
The Evidence Folder Should Be Writable Once
Set the folder up so that entries are append-only in practice. If you overwrite a record because the interface looked wrong the first time, you destroy the only account of what you originally saw.
If a later check shows you misread the interface, add a second note that says so and explains what you originally believed. Two honest entries are better than one corrected entry, because the correction itself is evidence about how reliable the first reading was.
This is also what makes the folder useful in aggregate. Several misreadings of the same interface over months are a pattern worth knowing about.
Write the Follow-Up Note Before You Close the Folder
Most folders fail at the last step. The evidence is collected, the transaction is confirmed, and the folder is never closed out with a statement of what was resolved and what remains open.
Close each entry with three short lines:
- Outcome. Confirmed, reversed, still pending, or lost.
- What the evidence actually showed. Not what you hoped, and not what you assumed at the start.
- What remains open. The question you still need answered, and by whom.
That third line is what turns a pile of files into a task list. Without it, an unresolved issue sits in a folder until the moment it becomes urgent.
Sources Belong With the Transaction
When you investigated using documentation, a block explorer, a governance post or an incident report, record the reference next to the transaction it informed. Include the address you read and the date you read it.
Explorers and documentation get updated. A note that says “the explorer shows the transfer failed” without a date cannot be re-checked, because the explorer may now show something different for the same transaction.
A Practical Routine
Keep the routine short enough that you actually do it:
- Write the hash down at the moment of the transaction, not afterwards.
- Capture the expected outcome before checking the result.
- Store one folder per month, with subfolders per dispute or investigation.
- Close every entry with an outcome line, even if the outcome is “still investigating”.
- Once a quarter, scan for entries whose “what remains open” line is not resolved, and deal with those specifically.
What an Evidence Folder Does Not Do
An evidence folder proves what happened on chain. It does not recover funds, and it does not convert an irreversible transaction into a reversible one.
It also does not settle a question about intent, or about what a party knew at the time. Those require records you probably do not have, which is another reason to store the transaction-level evidence while it is cheap to collect.
Collecting evidence is a few minutes of work at the time. Reconstructing it afterwards is often impossible, which is the entire argument for doing it the first time.