Prices are not taken from one source — they are reconciled across channels. The price service queries CoinGecko, CoinMarketCap and CryptoCompare in parallel, takes the median as the consensus, measures the max pairwise discrepancy, and only marks a price verified when at least two sources agree within 2%. When no public price exists it falls through a six-channel chain — CoinPaprika → Birdeye → DexScreener → on-chain swap parse → implied — and every source is persisted as its own row so a price can be audited later.

Balances are double-checked two independent ways. One ledger is recomputed from the raw transaction stream (inflows minus outflows minus gas); a second is summed from the tax-lot remaining amounts. The two are reconciled per wallet+asset down to 1e-8 and any drift is surfaced as a data-integrity issue — so the cost-basis math can never quietly disagree with what actually moved on-chain.

Cost-basis engine on decimal.js: FIFO / LIFO / HIFO lot matching plus full IRC §1091 wash-sale detection — losses inside a 30-day window are disallowed, the basis shifts to the replacement lot, each replacement share is used at most once — feeding a 13-check cross-validation gauntlet (genesis-aware timestamps, sold-≤-acquired, duplicate tx_hash, stablecoin off-peg, >20% swap-value mismatch, …) that grades issues critical / warning / info. Form 8949 (PDF + CSV) and Schedule D are filled against the real 2025 IRS PDF templates via pdf-lib.

Three-pass transfer matching keeps internal reshuffles off the disposal ledger: (1) same-chain tx_hash matching across wallets, (2) cross-chain bridge matching by wrapped↔native asset equivalence within 1% amount and a 2-hour window (with clock-skew tolerance), (3) hashless Coinbase-CSV ↔ on-chain matching within 5%. A matched transfer-in preserves the original cost basis instead of opening a phantom lot.

Two-stage on-chain scam defense. An algorithmic scorer weighs ten signals (unsolicited airdrop, zero value, hex/homoglyph names, batch arrivals, dust, no liquidity, never-interacted) into a recommended action; an investigator then goes on-chain — Blockscout for mass-airdrop transfer counts, contract verification, proxy detection, contract age, and deployer profiling (how many tokens that address has spawned → serial-scammer), and Solana RPC for mint/freeze authority and Token-2022 honeypot extensions. Flagged tokens are dropped from lot generation before the 8949 is computed.

SvelteKit 5 UI: drag-and-drop CSV import with blockchain auto-detect and live sync, a Review page that renders each validation issue as an actionable card (wallet, chain, explorer link, amounts), a Report page for export, and a wallet-graph fund-flow visualizer. 374 Vitest tests cover the cost-basis, wash-sale, reconciliation, and matching paths end to end.