Ethereum Internal Transactions (With Examples)

I am interested in Ethereum internal transactions because Etherscan doesn't send me an alert of internal transactions in my wallet which worries me if my tokens are transferred out without my knowledge.

What is an ETH internal transaction? An Ethereum internal transaction is a message call outside the blockchain performed via a smart contract (e.g. splitting tokens to multiple parties equally). A special node needs to be run (e.g. Etherscan) to look at the actual effects as an "internal transaction" since the result of the value transfer or contract call is not stored on the blockchain.

To be precise, ethereum internal transaction is wrongly called a transaction, since it does not happened on the blockchain. Unlike standard transactions, internal transactions have no cryptographic signature and are mostly held off-chain, i.e. they are not included in the blockchain itself. 

Ethereum internal transactions examples include these type of transactions:

• Using Disperse to split tokens among multiple parties equally
• Using an NFT aggregator like GEM.xyz to bulk purchase NFTs
• Airdrops distribution to a host of wallet

Source: Etherscan

A single transaction on a smart contract can result in dozens or even hundreds of internal transactions that interact with numerous other smart contracts, or simply distribute value to a host of wallets via an airdrop. 

All sample transactions are performed via calling the "smart contract". 

Another explanation of internal transaction mentioned by CoinMarketCap

Smart contract transactions are normally both irreversible and traceable, and they are sent through externally owned accounts, also known as EOAs, which are often private and held by individuals. Smart contract interactions like this are fascinating because they trigger certain predefined procedures and produce side effects or byproducts that are called “internal transactions”. A single smart contract engagement can result in tens or even hundreds of internal transactions. These are value transfers that occur when a smart contract or a token transfer is executed.

 How do you find internal transactions in ETH

The only way to find internal transaction in ETH is running a modified Ethereum with tracing enabled. There is no way to retrieve internal transactions using the web3 API but you might find paid APIs for internal transactions. 

Block explorer, Etherscan, run a modified node with an instrumented Ethereum Virtual Machine (EVM) to re-execute the transactions and trace the calls and value transfers that took place in the transaction execution.

• Parity provides a very nice eth_tracetransaction RPC command (and related calls). (https://openethereum.github.io/JSONRPC-trace-module) 
• Geth provides traces, but they're not as easy to use as Parity. (https://geth.ethereum.org/docs/dapp/tracing)

It is CPU extensive to perform such tracing of internal transactions and very slow for the node. It also requires a lots of resources have available all historical state accessed by the transaction:

• Balance, nonce, bytecode and storage of both the recipient as well as all internally invoked contracts.
• Block metadata referenced during execution of both the outer as well as all internally created transactions.
• Intermediate state generated by all preceding transactions contained in the same block as the one being traced.

Depending on your node’s mode of synchronization and pruning, different configurations result in different capabilities:

• An archive node retaining all historical data can trace arbitrary transactions at any point in time. Tracing a single transaction also entails reexecuting all preceding transactions in the same block.
• A full synced node retaining all historical data after initial sync can only trace transactions from blocks following the initial sync point. Tracing a single transaction also entails reexecuting all preceding transactions in the same block.
• A fast synced node retaining only periodic state data after initial sync can only trace transactions from blocks following the initial sync point. Tracing a single transaction entails reexecuting all preceding transactions both in the same block, as well as all preceding blocks until the previous stored snapshot.
• A light synced node retrieving data on demand can in theory trace transactions for which all required historical state is readily available in the network. In practice, data availability is not a feasible assumption.

Below is a example found on StackOverflow explaining further on internal transactions:-

The EOA address A wants to send some ERC-20 tokens to the EOA address C. To do this, the EOA address A should make a transfer transaction to the ERC-20 Contract address B, with these parameters:

tx_obj = {
'from'      : EOA_address_A,
'to'        : ERC_20_Contract_address_B,
'value'     : 0,
'data'      : data,
'gas'       : estimated_gas,
'gasPrice'  : web3.eth.gas_price,
'nonce'     : web3.eth.get_transaction_count(EOA_address_A),
'chainId'   : web3.eth.chain_id
}

wherein

estimated_gas = self.w3.eth.estimate_gas({
'from'      : EOA_address_A,
'to'        : ERC_20_Contract_address_B,
'value'     : 0,
'data'      : data,
'nonce'     : web3.eth.get_transaction_count(EOA_address_A),
'chainId'   : web3.eth.chain_id
})

and

data = contract_token.encodeABI(fn_name="transfer", args=[EOA_address_C, to_wei(amount, 'ether')])

wherein

contract_token = web3.eth.contract(address=ERC_20_Contract_address_B, abi=ERC_20_Contract_address_B_abi)

In the above example from StackOverflow, the EVM recognizes tx_obj as transaction parameters : 0 amount from EOA_address_A to ERC_20_Contract_address_B with "data" as data. This is called a transaction.

The Internal transaction is the consequence of this transaction. i.e., with this transaction made, by triggering the transfer function in the ERC_20_Contract_address_B and passing the "data" provided by this transaction, ERC_20_Contract_address_B's transfer function will be run and tokens will be transferred to EOA_address_C.

Running this function does not change the blockchain state, the EVM won't recognize this as a transaction and people conventionally call this an internal transaction.