> ## Documentation Index
> Fetch the complete documentation index at: https://docs.extractor.live/llms.txt
> Use this file to discover all available pages before exploring further.

# Block Anomaly

> The Block Anomaly detector monitors blocks for abnormal transaction counts, event counts, block sizes, and gas usage that may signal network attacks.

The Block Anomaly detector watches every produced block and fires when key metrics fall outside their expected ranges. It catches network-level anomalies that often precede or accompany on-chain attacks.

## What it monitors

<Tabs>
  <Tab title="Transactions">
    Fires when the number of transactions in a block is unusually **low** (possible censorship or validator downtime) or unusually **high** (spam attack, MEV flood).
  </Tab>

  <Tab title="Events">
    Fires when the number of emitted events is abnormal. A spike in events can indicate flash-loan attacks, mass token distributions, or event spam.
  </Tab>

  <Tab title="Block size">
    Fires when the raw block size is outside the configured range. Oversized blocks may signal data-stuffing attacks; undersized blocks may indicate chain stall.
  </Tab>

  <Tab title="Gas">
    Fires when gas usage per block or per transaction is outside expected bounds. High gas can indicate a DoS attempt; low gas may signal abnormal validator behavior.
  </Tab>
</Tabs>

## Use cases

<AccordionGroup>
  <Accordion title="Network health & stability monitoring" icon="heart-pulse">
    A chain suddenly producing blocks with abnormally low transaction counts or gas usage can signal network congestion, validator downtime, or censorship attacks. The detector flags these in real time so infra teams can investigate immediately.
  </Accordion>

  <Accordion title="Exploit & attack detection" icon="bug">
    MEV spam, denial-of-service attacks, and reorg attempts all produce blocks with extreme metrics. The detector correlates anomalies with known attack patterns (repeated reverts, flash-loan spam, flood of small transfers).
  </Accordion>

  <Accordion title="Compliance & forensics" icon="scale-balanced">
    Auditors and compliance teams need structured logs of abnormal block patterns. The detector provides these for cross-referencing with suspicious addresses and regulatory reporting.
  </Accordion>
</AccordionGroup>

## Configuration

| Parameter                | Description                                             |
| ------------------------ | ------------------------------------------------------- |
| **Name**                 | Descriptive label for this detector instance            |
| **Transactions min/max** | Acceptable transaction count range per block            |
| **Events min/max**       | Acceptable event count range per block                  |
| **Block size min/max**   | Acceptable block size range (bytes)                     |
| **Gas min/max**          | Acceptable total gas usage range per block              |
| **Gas min/max (Tx)**     | Acceptable gas usage range per individual transaction   |
| **Block Freq min/max**   | Expected block interval in milliseconds                 |
| **Cron**                 | Schedule for evaluation (leave empty for real-time)     |
| **Track Latency**        | Whether to include block production latency in analysis |

<Tip>
  Start with wide min/max ranges and tighten them over time as you learn your network's baseline. Too-narrow ranges will produce noisy alerts early on.
</Tip>