Live Graph Lab: Towards Open, Dynamic and Real Transaction Graphs with NFT

Blockchain and Ethereum. Blockchain, a distributed ledger technology, has attracted continuous attention recent years and is made up of securely linked blocks with cryptography techniques [53], where each block contains information of the previous block (e.g., cryptographic hash). Ethereum is a decentralized, programmable blockchain, which means users can construct various decentralized applications on the blockchain. Ether (ETH) is the native cryptocurrency of Ethereum, and every transaction incurred in the Ethereum needs a specific fee paid in ETH.

Smart Contract and Non-Fungible Token. Smart contract is an important feature in the Ethereum blockchain [88], which is a computer program that runs on the Ethereum to automatically execute or control relevant events and actions according to its logic. Smart contracts have largely reduced the requirements for trusted intermediaries, fraud losses and arbitration costs, etc. Non-Fungible Token (NFT) is one of the most successful applications on Ethereum. NFTs are tokens that can be used to represent the ownership of any unique asset such as image, video and audio, etc. Different from fungible items where one dollar is exchangeable for another one dollar, NFTs are not interchangeable with each other, since they all have unique properties and are not divisible.

The statistic information of our dataset is summarized in Table 2. To access the transaction information in Ethereum, Geth, a golang implementation of Ethereum client software, is launched to facilitate the synchronization of the ledger on Ethereum mainnet. When the client synchronizes to the latest block, we extract all the blocks before Aug 1st, 2022 (i.e., from block #0 to block #15,255,104). Then, we parse all the transaction data and log data via toolkit Ethereum ETL²²2https://ethereum-etl.readthedocs.io/en/latest/. Thanks to the well-defined standards in NFT communities, it is convenient for us to extract the information we need. Specifically, according to the standard of EIP-721, every NFT smart contract must implement the standard interfaces including transfer, approval, ownerof and balanceOf, etc. For those smart contract that do not strictly follow the EIP-721 standard, we remove those smart contracts and its relevant transactions from our data. For the remaining data, we filter out all the transfer events triggered by its smart contracts to extract the NFT transactions. This is because the ownership change of any NFT will emit a transfer event identified by the event topic Keccack256 hash 0xddf…3ef. In the NFT transfer event, it contains four key contents including the Keccack256 hash, the sender’s address, the receiver’s address, and the transferred NFT token ID. The time when the transaction occurs can be retrieved from the block that the event was found. Once we have obtained all of these key information, we can know when and which NFTs are transferred among different wallet addresses and the prices they are sold.

By parsing the transfer events, we find out that there are 97,667 NFT collections with 77,991,885 NFT tokens, where each collection contains different number of NFT tokens (e.g., varying from thousands to millions). Meanwhile, 124,660,813 transactions are extracted, and among them 4,531,020 users (i.e., we regard each wallet address as a user) participate in the transactions. It is worthy noting that there are over 100,000 NFT collections according to Etherscan³³3https://etherscan.io/tokens-nft. However, as we have mentioned, some of them are not standard NFT tokens (i.e., they do not strictly follow the EIP-721 standard), and we remove them from our data. Thus, our method almost extracts all the NFT collections.

We investigate the structure and dynamics of all these transactions by constructing a directed temporal graph $\mathcal{G}=(\mathcal{N},\mathcal{E},\mathcal{T})$, where $\mathcal{N}$ and $\mathcal{E}$ denote the node set and edge set, respectively. That’s to say, we only count once for those addresses that have repetitive interactions. $\mathcal{T}$ is a set of timestamps when the interactions happen. We use $t(e)$ to denote the timestamp when edge $e$ is formed, and $t(u)$ represents when the node $u$ is added into the graph. Thus, $a_{t}(u)=t-t(u)$ reflects node $u$’s age at time $t$. For any given time $t$, graph $\mathcal{G}_{t}$ consists of all the nodes as well as edges until time $t$. Note that, since we have accurate timestamps for the arrival of each node and edge, our investigation of graph dynamics is at a much finer granularity compared with the majority of existing studies [5, 41].

To fully understand how active is the NFT transaction network, we measure the evolution of nodes and edges over the time. Specifically, we set the time granularity to a yearly yardstick. Since our data started from the July of 2017 and ended at the August of 2022, the statistical information for 2017 and 2022 only has a half year’s data. Figure 1(a) and 1(b) show the annual growth of nodes and edges in a log-scale. As observed, there is a rapid increase in the number of nodes and edges, which become 28K and 165K times larger within the six years. It means the NFT transaction network is highly active and growing at a fast speed.

To further figure out what leads to the growth, we analyse the newly added nodes in each pair of consecutive years. New nodes could join the network through different ways (i.e., mint, buy or airdrop NFTs). Among them, mint is the most common and easy way to obtain NFTs, where only a small number of gas fee is needed to pay. Figure 1(a) presents the trend of newly added mint nodes and non-mint nodes. We notice that the number of mint nodes added into the network is approximately the same magnitude of the total nodes at that time. Therefore, mint NFTs dominates the growth of nodes in the network at present, meanwhile the number of non-mint nodes are also increasing at a high velocity. These two phenomena result in the expansion of nodes.

Figure 1(b) also shows the trend of added bidirectional edges and self-edges. We can see that the number of bidirectional edges only account for a small volume. Unlike social networks where the edges are highly mutual, the NFT market is an anonymous ecosystem and the probability of mutually interacting with each other is relatively low. These bidirectional edges might happen in the scenarios of swap or wash trading activities [73]. We also notice that there exist a very few self-loops in the network, which means these addresses transact with themselves. This abnormal phenomenon might be caused by a mistake input for the received address or these transactions are executed for testing. Furthermore, to characterize how active are these addresses, we compute the percentage of edges in which new nodes have links from or to old nodes, and the percentage of edges which only contain links between new nodes. Here, we refer to new nodes as the nodes created in the current year, and old nodes indicate the nodes that have existed in the previous years. Figure 1(c) demonstrates that more than 50% percent of newly added edges are constituted by the connections between new nodes and old nodes, except for the year of 2021. This indicates that most of the addresses remain active as the NFT ecosystem become mature. It is also very interesting to note that the newly created addresses are highly active in 2021, and at the same time, the whole NFT market capitalization reaches over $40 billion USD dollars in this year.

For completeness, we also show the degree distribution of the NFT transaction network in Figure 1(d) with log-log scale. As expected, it follows a power-law distribution. We observe that some nodes have the degree of 1, which indicates they did not conduct any other transactions after the NFTs were minted or transferred. There also exist several high degree hubs that are extremely active and interacts with more than thousands of different addresses. Among them, a special Null address (i.e., 0x000…000)⁴⁴40x0000000000000000000000000000000000000000 has the highest degree, since every NFT mint activity will create a link from the Null address to the mint address.

Evolution of Hub Nodes. The node degree shows a heavily long-tailed distribution (i.e., Figure 1(d)), and the assortativity raises year by year (i.e., Figure 4(a) in Appendix C). Both these two measurements are highly relevant to the evolving of hub nodes in the transaction network. Figure 2(a) and 2(b) illustrate the correlations between node degrees and its number of new connections in two consecutive years. We use blue color to present the node degree distribution in the previous year, and then red color indicates the number of connections from new nodes in the current year. As expected, we can find that if a node had high degree in the previous year, it would have high probability to get more new node connections in the current year. Moreover, this observation is also validated by measuring their Pearson Correlation Coefficients. We evaluate the correlation coefficients between node degrees and its number of new node connections (in year 2018-2019 and 2019-2020), which are 0.2266 and 0.5476, respectively. The results reveal that these two factors are positively relevant. Thus, we can draw the conclusion that the NFT transaction network follows preferential attachment growth model [54, 32], i.e., “the rich gets richer”.

Next, we analyze the distribution of the hub nodes. Specifically, we note that half of the top-100 largest hub nodes are smart contract addresses. This is understandable, since smart contracts play an important role in providing various services (e.g., NFT fractionalization and staking) to other users in the network. Thus, they tend to have high degrees once they are frequently used by others. The transactions with such smart contracts result in the increase of assortativity. Furthermore, there also exist some hub nodes that are not smart contracts. For instance, we observe that address 0x8a0…700⁵⁵50x8a01fa5a77311bbcf29e293d8ecb48707cfdb700 is the fifth largest hub nodes with the degree of 69,458. After checking its transactions manually, we find that all its transactions are about HyperNFT tokens, and it holds more than 180,000 such kind of tokens. Since it is strange, we then check its transactions in details and discover that this address creates a transaction every a few minutes, where the ID of the transacted NFT token is in a continuous and increase order. According to these clues, it is very certain that this address is a bot, which makes frequent transactions to pretend it’s very prosperous to attract more users to join in. The hub nodes are responsible for the spreading of information in the network, thus it is necessary to investigate the properties of hub nodes.

Mutual Interaction Edges. In the previous study, we find that the reciprocity of the transaction network is relatively low, which is around 0.1 in the end (i.e., Figure 4(c) in Appendix C). This is quite different from the property in the social networks, where the reciprocity is very high and the value is above 0.7 [39]. One possible reason is that people are prone to mutually following and interacting with their friends in the social networks, since it does not cost anything. However, it becomes different in the NFT transaction network, because we do not know who we are actually interacting with and every action costs in the blockchain. To uncover the reciprocity’s characteristics, we focus on the mutual interaction edges. Specifically, we are interested in if two nodes are mutually interacting with each other, i.e., reciprocal edges $\left\langle u,v\right\rangle_{t}$ and $\left\langle v,u\right\rangle_{\hat{t}}$, what their maximum time interval distribution $|t-\hat{t}|$ looks like, i.e., the maximum delay in days of the reciprocity. Figure 2(c) shows that mutual interaction edges forming within one day account for the highest proportion, and the maximum time interval can reach to more than 1,000 days. According to Figure 2(d), we can observe that about 15% of the reciprocal edges are formed almost simultaneously among those bi-directional edges, and more than 70% of them are formed within 90 days. From these observations, we can conclude that the NFT transaction network can not be regarded as an undirected network due to its low reciprocity value, and the simultaneously formed bi-directional edges can be a good indicator to judge the abnormal activities. For instance, it may be caused by the token transfers among the accounts controlled by a same person.

To further investigate this phenomenon, we want to know how many address pairs are suspicious in these bi-directional links. We first conduct some statistics for all NFT transaction addresses, which involves the following two factors: the number of transactions (including from transactions and to transactions) and the number of distinctly interacted addresses. Then, if one address has very limited transactions and it only interacts with a specific address, it is highly possible that these two addresses are of same person’s wallets. This is because this address is actually not active, but it responses promptly in the bi-directional links. Similarly, another situation is although one address has a lot of transactions, it interacts with one specific address frequently and the specific address accounts for a large ratio of the total transactions. They may also belong to same person’s wallets. Based on these two observations, we define the following two rules to identify the suspicious address pairs: 1) one of them makes less than 5 transactions or 2) the transaction ratios between them is larger than 0.8. If they satisfy at least one of the rules, we then believe these two addresses are likely to be same person’s wallets. According to these rules, we discover that 33.72% of those simultaneously formed bi-directional links have high probability of being suspicious. This observation provides a new perspective for detecting anomaly transactions.

Link prediction lies at the core of graph analysis and mining. The link prediction’s goal is to predict whether a pair of node would form a link, which has been extensively used in diverse real-world scenarios like recommendation [79, 7] and knowledge graph completion [55], just to name a few. In this section, we focus on temporal link prediction, i.e., we try to forecast future interactions based on the historical transactions. Specifically, we investigate the snapshot-based representation for temporal link prediction via graph neural networks [36, 25]. Since each edge $e$ has a timestamp $\tau_{e}$, we utilize a sequence of graph to depict the temporal transaction network $G=\{\mathcal{G}_{t}\}_{t=1}^{T}$, where each snapshot is a static graph $\mathcal{G}_{t}=(\mathcal{N}_{t},\mathcal{E}_{t},\mathcal{T}_{t})$ with $\mathcal{E}_{t}=\{e\in\mathcal{E}|\tau_{e}\leq t\}$. Through modeling the sequential information of different graph snapshots, we could leverage the information available up to time $t$ to forecast possible edges at time $t+1$. Although various approaches have been proposed for temporal link prediction, it is unclear whether they can achieve satisfied performance in this highly active and large-scale temporal transaction network.

Graph Neural Networks. GNNs have gained great success in numerous learning tasks on graphs including node classification [36, 25], graph classification [84, 83] and link prediction [82, 75]. The objective of GNN is to acquire effective node representations through iteratively aggregating messages from its local neighborhood. Specifically, the $l$-th layer of a GNN model can be formulated as follows:

where $\mathbf{h}_{v}^{l}$ is the node representation for node $v$ at layer $l$ and $\mathcal{N}(v)$ represents node $v$’s neighborhood. $\textsc{Msg}(\cdot)$ indicates the message-passing function, which propagates information from its neighbors. $\textsc{Agg}(\cdot)$ is the aggregation function, which updates its representation with node’s neighborhood representations. For a $L$ layers GNN, it aggregates information from the $L$-hop neighborhood. Different GNN architectures can have different message-passing and aggregation functions. The original GNN model is designed for static graphs, thus it cannot capture the underlying temporal information within the graph. To incorporate the evolving property, existing works utilize RNNs [28, 14] to aggregate information from different graph snapshots. Hence, the dynamic GNN models have much more parameters compared with the vanilla GNNs, which is more difficult to scale to large graphs due to the back propagation through time constraints.

Models. We compare a number of recent state-of-the-art dynamic GNN models. (1) Dyngraph2vec [21] captures the temporal transitions with a deep architecture with dense and recurrent layers. (2) TGCN [87] integrates GCN with GRU to learn complex spatial and temporal dependencies. (3) EvolveGCN [56] use a RNN to adapt the graph convolutional network parameters. (4) GCRN [62] generalize TGCN with either GRU or LSTM. Moreover, it uses ChebNet [15] to encode the graph structure information, and separate GNNs are applied to compute different gates of RNNs. (5) DynGEM [22] utilizes deep autoencoder to perform graph embedding, then local and global constraints are employed to keep node representations being stable over time. (6) Roland [81] is an efficient learning framework designed for temporal GNNs, which updates its parameters through a combination of incremental training and meta-learning strategies [19, 20].

Settings. For dataset, we remove all the transactions associated with the Null address, which results in 3.13 million nodes and 23.13 million edges in the directed graph. We set node feature as 1 for all the nodes and utilize area under the curve (AUC) as well as mean reciprocal rank (MRR) as evaluation metrics. For every node $u$ connected by a positive edge $(u,v)$ at time $t$, we randomly select 100 negative edges originating from node $u$. Subsequently, we determine the rank of the score for edge $(u,v)$ among all the sampled negative edges. AUC characterizes the probability of ranking positive node more highly than negative nodes. MRR denotes the average of reciprocal ranks computed across all nodes. Following the settings in Roland [81], we utilize two different train-test splits: fixed-split and live-update. Among them, the fixed-split setting assesses the models using all the edges from the last $20\%$ graph snapshots. Although it is widely used in the existing works, the fixed-split might produce misleading results based on edges merely from the last few graph snapshots, since the graph structure could constantly evolve in the real world scenario. To eliminate this bias, we also utilize live-update split to test the models, which evaluates their performance over all the available graph snapshots. $10\%$ of edges are used to determine the early-stop condition in this setting.

Results. We present the link prediction results in Table 3. Specifically, we use three different time granularities (i.e, days, weeks and months) to construct the graph snapshot sequences, which results in 1,657 graph snapshots, 253 graph snapshots and 60 graph snapshots, respectively. All the models’ performance is evaluated under two different settings, i.e., fixed-split and live-update. We notice that as the time granularity becomes coarser, the models’ performance drops. This is because the NFT transaction network is highly active, which is about 68 million transaction volume per day on average in 2021. Thus, it will be more difficult to predict all the possible links in a long time period. Meanwhile, we can observe very high AUC scores in a daily time granularity, which indicates the models have a better capability of distinguishing the positive and the negative edges in this short time scenarios. Also, the performance in live-update setting is a little lower than the fixed-split setting. This is caused by the pattern shifts in different graph snapshots, which implies the patterns indeed evolve over the time. Therefore, we can conclude that it is necessary to model the NFT transaction network in a finer time granularity, and at the meantime this will result in longer graph snapshot sequence, which puts forward more challenges to model the temporal information.

Node classification plays a crucial role in understanding the attributes, behaviors, and relationships of nodes in temporal graphs, offering valuable insights in diverse applications. By predicting the label of nodes at a particular time $t$, we gain a temporal perspective that deepens our understanding of how nodes evolve over time and their dynamic characteristics. Specifically, we focus on categorizing nodes according to their transaction behaviors. They can be generally classified into five distinct classes: daily traders, weekly traders, monthly traders, yearly traders and the remaining traders. We first filter out nodes that only have one transaction. Then, each node’ maximum transaction interval is calculated. If the maximum interval is within one day, we call it daily trader. Likewise, if the maximum interval is within one week and larger than one day, we call it weekly trader, and so forth. This process results in a large-scale directed graph with about 1.80 million nodes and 21.83 million edges. Following the setting of EvoloveGCN [56], we use the first 80% graph snapshots as training set, the following 10% graph snapshots as validation set and the last 10% graph snapshots as test set. Similar to temporal link prediction task, we use the same set of GNN models and add a multi-class classification layer. Furthermore, nodes’ degrees are encoded as features. The number of transactions between two nodes and their latest interaction timestamp are transformed as edge features. Two commonly used metrics (i.e., accuracy and recall) are employed to assess the model’s performance.

Results. The node classification results are illustrated in Table 4 and key observations are as follows. Three granularities, i.e., days, weeks and months, are utilized to generate the temporal graph snapshot sequences. In accordance with the temporal link prediction task, we can draw similar conclusions. Roland could consistently outperform other baselines, and its variant Roland-MA (moving-average) stands out due to its parameter-free design and remarkable capability to capture evolving patterns. On the other hand, TGCN fails to achieve satisfactory performance because of the gradient vanishing problem in longer sequences. GCRN-GRU and Roland-GRU address this issue by utilizing separate GNNs or leveraging previous and current snapshots. Furthermore, the scalability of several baselines is limited and they experience out-of-memory (OOM) issues. Among the three time granularities, the month granularity is generally the most difficult scenarios. This is because with a month granularity, the time period between snapshots is longer compared with the day and week granularities. As a result, it becomes more challenging to accurately predict the temporal patterns and changes in node behaviors. The longer time gap between snapshots increases the complexity of modeling the evolving dynamics of the network and introduces more uncertainty, leading to decreased performance in terms of classification accuracy and recall. Therefore, we can conclude that given the highly active NFT transaction network, it is essential for the model to use a finer time granularity. Nonetheless, this choice results in longer graph snapshot sequences, presenting additional difficulties in accurately capturing the temporal information.

Continuous Subgraph Matching (CSM) plays a vital role in numerous real-time graph applications. The goal of CSM is to identify and report the occurrences of a given query graph $Q$ within a temporal graph stream $G$. It can be utilized in various scenarios. For example, when setting the query graph $Q$ as wash trading patterns in e-commerce, CSM could identify the anomaly transaction patterns in the graph via exactly matching [58]. Similarly, representing query graph as rumor patterns in social network could help to detect and prevent the spread of rumors [74]. In this subsection, we set the query graphs as the frequent wash trading patterns in the NFT transactions. According to the definition in [73, 47], wash trading is an activity where the seller is on the both sides of the trade. The goal of wash trading is to influence the price or create the illusion that the item is very popular, which produces artificial activities in the marketplace. Wash trading has been prohibited by many countries. However, due to the anonymous nature of the blockchain, wash trading has become a severe issue in the NFT market⁶⁶6https://cryptopotato.com/over-33-of-nft-volume-is-wash-trading-bitscrunch-ceo-interview/, which accounts for a large volume in the whole NFT transactions. For instance, the CryptoPunk’s $9,998$-th NFT was traded between two wallets for 124,457 ETH (about $534 million USD), in which the buyer paid to the seller, then the seller transferred the money back to the buyer. Thus, it is important to detect the wash trading transactions to uncover the anomaly behaviors and reduce the risks in the market. We resort to CSM to identify the wash trading transactions. Five most common wash trading patterns are shown in Figure 3. As can be seen, all of them contain at least one cycle. Here is a toy example that exemplifies Pattern 1: Address A (0x744…282) initiated the sale of Azuki token 1,215 to Address B (0xd39…263). Subsequently, Address B sold the token to Address C (0xeaa…c0f), and eventually, Address C sold it back to Address A. These transactions happened within half an hour, and interestingly, the token’s price surged from 8.98 ETH to 11.99 ETH. Such activity can raise suspicions of wash trading. We will use them as query graphs in the experiments to simulate the wash trading detection procedure. More details are given in Appendix E.

Results. Table 5 shows the key results of continuous subgraph matching. As we can see, RapidFlow [68] is the most efficient algorithm, which demonstrates about 18-724x speedups compared with the remaining frameworks. This is because the query reduction technique can significantly expedite the query procedure through an optimized matching order. We also observe that no algorithm can dominate others in different query patterns except RapiadFlow. Among them, SymBi [50] and Graphflow [33] perform quite worst on pattern 5, which need 10x more time to produce the results. SJ-Tree [13] and IEDyn [30, 31] cannot output the results within the time limit. The reason is that SJ-Tree encounters memory exhaustion in the majority of cases, and IEDyn’s index update bears too much overhead because of the maintenance for constant-delay enumeration. Furthermore, the number of matched subgraphs increase from pattern 1 to pattern 5, however the query time does not have too much difference in almost all the frameworks. We can conclude that these four frameworks are applicable to large-scale graphs with dense structures. They can effectively serve as a bridge to generate ground truth for continuous subgraph matching, providing valuable support for the training of deep graph learning models.