The Ghost in the Graph: Catching Unbounded Recursion & Taint Drift with Gemini 1.5 Pro

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.

FluxTrace is an open-source real-time financial security engine designed to trace illicit funds across graph databases (Neo4j) using Dynamic Taint Scores. It ingests thousands of dynamic financial events per second, mapping transaction topologies and assigning risk scores to connected wallets to expose complex money laundering schemes before funds can be laundered through mixers.

During high-throughput synthetic testing, our telemetry pipeline began silently degrading under dense cyclic transaction topologies (e.g., wallet circular routing or "smurfing" rings).

The issues manifested as:

[Transaction Event Ingest] ---> [Recursive Taint Engine]

│

┌─────────────────────┴─────────────────────┐

▼ ▼

[Cyclic Graph Detected] [Unbounded Stack Growth]

│ │

▼ ▼

(Infinite Propagation) (OOM Worker Crash)

We diagnosed the issue by a 2M-node cyclic graph dataset into Google AI Studio alongside our recursive graph traversal engine using Gemini 1.5 Pro.

To isolate the exact stack behavior, we prompted Gemini 1.5 Pro in Google AI Studio with our recursive execution path:

System Prompt / User Query:

"Analyze the Python graph traversal function below. In cyclic topologies (A -> B -> C -> A), worker memory escalates exponentially, and floating-point taint scores exceed 1.0. Identify why cycle detection fails to halt memory growth during high-concurrency event loops, and refactor the method using memoization and a strictly bounded iterative stack."

Google AI Studio identified that our visited-node cache was scoped locally to individual recursive calls rather than globally across the propagation path.

We refactored the dynamic calculation from recursive execution to an iterative Breadth-First Traversal (BFS) pattern with explicit cycle bounds and decay limits:

python
def propagate_taint_score(node_id, current_score, visited=None):
    if visited is None:
        visited = set()
    visited.add(node_id) # Bug: Scoped locally in recursive chain, fails in cyclic networks

    neighbors = get_connected_wallets(node_id)
    for neighbor in neighbors:
        new_score = current_score * DECAY_FACTOR
        propagate_taint_score(neighbor.id, new_score, visited)
from collections import deque

def propagate_taint_score_iterative(start_node_id: str, initial_score: float, max_depth: int = 10) -> None:
    queue = deque([(start_node_id, initial_score, 0)])
    visited_state = {}  # Map node_id -> max_seen_score

    while queue:
        curr_node, curr_score, depth = queue.popleft()

        if depth >= max_depth or curr_score < 0.01:
            continue

        if curr_node in visited_state and visited_state[curr_node] >= curr_score:
            continue

        visited_state[curr_node] = curr_score

        clamped_score = min(curr_score, 1.0)
        update_wallet_risk(curr_node, clamped_score)

        for neighbor in get_connected_wallets(curr_node):
            next_score = clamped_score * DECAY_FACTOR
            queue.append((neighbor.id, next_score, depth + 1))

Best Use of Sentry
We leveraged Sentry Performance Monitoring and Distributed Tracing to locate and confirm the fix:

Custom Span Profiling: Created Sentry spans (sentry_sdk.start_span(op="taint.propagation")) to record execution duration and stack depth across graph nodes.

Memory & Out-of-Memory Tracking: Monitored worker RAM trends via Sentry's profile visualizer to confirm memory usage stabilized at a flat ~140 MB footprint down from exponential spikes >4 GB.

Python
import sentry_sdk

def process_transaction_event(event):
    with sentry_sdk.start_span(op="graph.taint_analysis", description="Process cyclic taint propagation"):
        propagate_taint_score_iterative(event.sender, event.initial_risk)