Methodology

A Leeri verdict is derived, never asserted. Every number in it traces back to findings, and every finding traces back to a source you can open. This page explains that chain. The individual rules are documented, one page per rule, in the rule catalogue.

A verdict is an input to your own risk decision. It is not a legal or compliance determination.

From findings to a verdict

1. Findings. Each rule that fires against the checked address or transaction produces a finding with a category, a weight and a source.
2. Weights. The ruleset the verdict is pinned to assigns weights per category. Weights are decimal strings, and all score arithmetic is exact: no floating point is used for score or money.
3. Score. The weighted findings and the address's exposure give a score from 0 to 100.
4. Band. The score falls in a band: low, medium, high or severe. The boundaries belong to the ruleset version, so read the band field instead of recomputing it from the score.
5. Recommended action. Each band maps to an action that Rederive returns as recommended_action.

Band	Recommended action
low	accept
medium	manual_review
high	reject
severe	reject

The recommendation is a default for automation. Your policy decides what you do with it.

Wallet security warnings

Warnings that address the owner of the checked address, such as address poisoning or counterfeit tokens, are listed separately under wallet_security_warnings. They say nothing about the address being risky and never change the score, the band or a finding. See Address checks.

Where a finding comes from

A finding is never an unexplained number. Each one carries a source_url that always resolves and a source_kind that says what kind of page it is:

source_kind	What source_url opens	Typical origin
document	A public source document.	An authority list entry, a court document, an issuer freeze event, or a curated contract registry entry.
methodology	A versioned page on https://leeri.ai/rules that states what the rule detects and why it fired at that ruleset version.	A heuristic of the screening engine, or the answer of a third-party data source.

Neither kind stands in for the other. A finding that rests on a third-party data source is marked source: "provider" and links its methodology page; the source itself is never named.

Authority lists

These public sanctions lists are screened:

• OFAC SDN
• EU Consolidated list
• UN Security Council list
• UK HMT list

Beyond the lists, findings come from Leeri's own label set, in which every entry carries a dereferenceable source, a confidence and the time it was observed, and from heuristics that read the on-chain behaviour of the address.

Exposure

Exposure states where the money of the checked address came from or went, by category, distance and direction. Exposure is reported for direct counterparties (hop 0) and for the intermediaries behind them, one hop at a time up to hop 8 and in ranges beyond that.

• Exposure is weighted by value: a slice counts by its share of the total amount in USD, not by the number of addresses.
• When our own traversal and a third-party data source report the same category, hop and direction, the larger share counts once, never the sum.
• Funds that sit behind an identified entity are priced as that entity's, never twice.
• Funds that could not be traced to a source are never priced. When more than half of the incoming volume could not be traced, the verdict says so in coverage_limitations, so that a low score is not read as a clean one.

Coverage and limits, stated

A verdict says what it could not see, in fields rather than in silence.

Statement	Where	Meaning
analysis_depth	Every verdict	full for assets screened with traversal and exposure by hop, label_only for assets matched against labels without traversal. See Supported assets.
partial, partial_reasons, degraded_sources	Every verdict	The verdict has less evidence than a complete one, and why. An outage produces a partial verdict, never a server error.
coverage_limitations	Every verdict	What the chain data source cannot show for this asset: for example internal transfers on EVM chains, a majority of untraced incoming funds, or an asset that could not be valued in USD. These are statements about the verdict, not partial results.

Treat a partial verdict, or a label_only one, as a verdict with less evidence, not as a clean one. The fields are described in Address checks.

Pinning and reproducibility

Every verdict records three coordinates:

Coordinate	What it fixes
ruleset_version	The version of the scoring rules applied.
label_snapshot_id	The position in the label history the verdict read.
chain_height	The chain height the verdict was derived at.

Labels are only ever added: an entry is superseded by a newer one and never edited or deleted, so a position in the label history always means the same thing. A verdict keeps its findings and the references to their evidence, so Rederive can replay it under its own pin and return the score it had, not the score today's rules would give.

A ruleset version changes only by publication. A new version applies to checks made after it is published and never re-scores a stored verdict. Only released rulesets are documented here; the rule catalogue lists each rule per version.

What to read next

• How it works: the path of a check from request to webhook.
• Evidence reports: the PDF and JSON record of a verdict, with a public check of its authenticity.
• Rule catalogue: what each rule detects and when it fires.