solana-risk-engine 0.1.0 → 0.3.0

package/README.md

@@ -24,11 +24,12 @@ for (const l of r.lights)  // the four traffic lights
 
 | Check | How |
 |---|---|
-| **Creator control** | Mint/freeze authority still active, and whether it sits in a person's wallet or a program (bridge/protocol). For keys with no account, it checks whether the key is on the ed25519 curve. Risky Token-2022 extensions: permanent delegate, transfer hook, transfer fee, non-transferable, default-frozen accounts. |
+| **Creator control** | Mint/freeze authority still active, and whether it sits in a person's wallet or a program (bridge, protocol, staking pool). A key off the ed25519 curve is always a program (PDA), even when the System Program owns its account. Risky Token-2022 extensions: permanent delegate, transfer hook, transfer fee, non-transferable, default-frozen accounts. |
 | **Real concentration** | Largest accounts are traced to their owners. Pools and programs are separated from people, so `w1`/`w10` measure *people*, not AMM vaults. |
-| **Inflated liquidity** | DexScreener values both sides of a pool at the pool's price. A pool with 4B of a token against 2 USDC shows "$4,000M liquidity". The engine recomputes it from the real side (USDC/USDT/SOL) only. |
-| **Unlocked LP** | % of LP locked/burned via RugCheck. It only counts for markets under 90 days old, so veteran tokens don't get false positives. |
-| **Impostors** | Tokens using the symbol or name of a famous token (USDC, JUP, BONK, WIF...) with a different address. |
+| **Inflated liquidity** | DexScreener values both sides of a pool at the pool's price. A pool with 4B of a token against 2 USDC shows "$4,000M liquidity". The engine recomputes it from the real side (USDC/USDT/SOL). It only flags extreme gaps (real side under 5%), because concentrated-liquidity pools are lopsided by nature. |
+| **Unlocked LP** | % of LP locked/burned via RugCheck. It only counts for markets under 90 days old, so veteran tokens don't get false positives, and never while a token is on Pump.fun's bonding curve, where there is no LP to pull. |
+| **Serial creators** | For markets under 7 days: how many other tokens the creator launched in the last 24 h (RugCheck). 2 or more is a warning, 5 or more a red flag. `recentLaunches(client, wallet)` counts the same on chain for the wallet that *paid* a launch, which catches farms that name a fresh creator each time. |
+| **Impostors** | Tokens using the symbol or name of a famous token (USDC, JUP, BONK, WIF, BTC, ETH...) with a different address. |
 | **Token type** | `STABLE`, `TOKENIZED`, `BRIDGED`, `CREATOR`, `OPEN`. Each type is judged by the rules that fit it: a bridged token normally has a program as mint authority, a memecoin does not. |
 | **Bots and exchanges** | Wallets that made 200 transactions in under 2 days are marked `active` and are not counted as whales. |
 | **Funder clusters** | The fee payer of each holder's *first* transaction reveals who created it. Holders sharing a funder are grouped, since that is often one team splitting the supply. Exchange hot wallets are excluded as sources. |
@@ -37,7 +38,16 @@ for (const l of r.lights)  // the four traffic lights
 | **Confluence** | Tokens held in common by a group of wallets, each one risk-assessed. Also the reverse: people who are top holders of several tokens. |
 | **Change tracking** | Snapshots and diffs (new / bought more / sold part / sold all) per wallet and aggregated across many wallets. |
 
-Anything that could not be checked is marked `na`. It never counts as "fine": a token with a missing check can be **medium** at best, and `dataOnly(r)` tells you when that is the only reason.
+### How the level is decided
+
+- Two red lights, or one red and one yellow, give **HIGH**.
+- One red, or two yellows, give **MEDIUM**.
+- Otherwise the level is **LOW**, with two exceptions that raise it to **MEDIUM**:
+  - **A check could not run.** Lights that could not be checked are marked `na`, and they never count as "fine". `dataOnly(r)` tells you when this is the only reason.
+  - **The market is under 7 days old.** It has no track record yet.
+- An impostor of a famous token is always **HIGH**.
+
+A single yellow on an established token stays LOW, because those warnings are normal for its type (a staking pool's program-controlled mint, for example). This was measured on 62 real tokens: the 7-day rule moved 9 brand-new tokens from low to medium and no established one.
 
 ## Install
 
@@ -60,7 +70,7 @@ Methods (all accept `{ onProgress(step, fraction) }`):
 
 | Method | Returns |
 |---|---|
-| `analyzeToken(mint)` | `{ lvl, sev, type, lights, reasons, impostor, pair, ... }` |
+| `analyzeToken(mint, { skipCreator })` | `{ lvl, sev, type, lights, reasons, impostor, pair, creator, ... }` |
 | `analyzeWallet(wallet, { minUsd })` | `{ sol, balances, total, hidden, results: [token results] }` |
 | `analyzeAddress(addr)` | `{ kind: "token" \| "wallet", ... }`, detected automatically |
 | `analyzeHolders(mint)` | `{ rows, clusters, hotGroups, creator, ... }`. Best with your own RPC. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solana-risk-engine",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
   "type": "module",
   "main": "./src/index.js",

package/src/client.js

@@ -139,5 +139,5 @@ export function createClient(opts) {
     return rpcAt(vibeRpc, method, params, 6);   // more retries: its limit sometimes trips even when the queue is respected
   }
 
-  return { rpc: rpc, jfetch: jfetch, softJson: softJson, ownRpc: ownRpc, heliusKey: heliusKey, checkAbort: checkAbort, rpcUrl: rpcUrl };
+  return { rpc: rpc, jfetch: jfetch, softJson: softJson, ownRpc: ownRpc, heliusKey: heliusKey, checkAbort: checkAbort, rpcUrl: rpcUrl, retryDelayMs: opts.retryDelayMs };
 }

package/src/constants.js

@@ -12,6 +12,9 @@ export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/mark
 export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
 export const TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
 export const SYSTEM_PROGRAM = "11111111111111111111111111111111";
+export const PUMP_PROGRAM = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P";
+// dexId of a token still on Pump.fun's bonding curve: DexScreener says "pumpfun", GeckoTerminal "pump-fun"
+export const PUMP_CURVE_DEXES = ["pumpfun", "pump-fun"];
 
 export const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 export const USDT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
@@ -34,7 +37,10 @@ export const FAMOUS = {
   PUMP: "pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn", JLP: "27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4",
   POPCAT: "7GCihgDB8fe6KNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr", HNT: "hntyVP6YFm1Hg25TN9WGLqM12b8TQmcknKrdu1oxWux",
   RENDER: "rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof", ORCA: "orcaEKTdK7LKz57vaAYr9QeNsVEPfiu6QeMU1kektZE",
-  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7"
+  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7",
+  // Bitcoin and Ether only exist on Solana bridged: a Pump.fun token called "BTC" is never the real one
+  BTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh", WBTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh",
+  ETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs", WETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs"
 };
 
 // Token-2022 extensions that add risk, with the points they add to the no-market spam score

package/src/i18n/en.js

@@ -36,6 +36,7 @@ export default {
     CTL_DEFAULT_FROZEN: () => "New accounts can be created frozen",
     CTL_ONLY_PROGRAMS: () => "Only program-controlled authorities (see dependency)",
     CTL_NONE: () => "No active authorities: nobody can mint more or freeze",
+    CTL_SERIAL_CREATOR: (d) => "The creator launched " + d.n + " other tokens in the last 24 h (per RugCheck): a serial launcher, who usually drops each token as soon as buyers arrive",
     IMPOSTOR: (d) => "Impersonates " + d.symbol + ": the real " + d.symbol + " has another address (" + short(d.real) + "). It is a copy, almost certainly a scam",
 
     CON_SKIPPED: () => "Holder concentration not checked",

package/src/i18n/es.js

@@ -39,6 +39,7 @@ export default {
     CTL_DEFAULT_FROZEN: () => "Las cuentas nuevas pueden crearse congeladas",
     CTL_ONLY_PROGRAMS: () => "Solo hay autoridades controladas por un programa (ver dependencia)",
     CTL_NONE: () => "Sin autoridades activas: nadie puede crear más ni congelar",
+    CTL_SERIAL_CREATOR: (d) => "El creador ha lanzado " + d.n + " tokens más en las últimas 24 h (según RugCheck): es un lanzador en serie, que suele abandonar cada token en cuanto llegan compradores",
     IMPOSTOR: (d) => "Se hace pasar por " + d.symbol + ": el " + d.symbol + " de verdad tiene otra dirección (" + short(d.real) + "). Es una copia, casi seguro una estafa",
 
     CON_SKIPPED: () => "Sin comprobar la concentración de holders",

package/src/index.js

@@ -43,10 +43,11 @@ export { createClient };
 export { ScanError, isCancel } from "./errors.js";
 export * from "./constants.js";
 export { isOnCurve, onCurve, b58bytes } from "./curve.js";
-export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds } from "./tokens.js";
-export { getMarkets, realLiq, impostorOf } from "./markets.js";
-export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances } from "./rugcheck.js";
-export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess } from "./risk.js";
+export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf } from "./tokens.js";
+export { getMarkets, realLiq, impostorOf, INFLATED_RATIO } from "./markets.js";
+export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches } from "./rugcheck.js";
+export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD } from "./risk.js";
+export { recentLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
 export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders } from "./holders.js";
 export { fetchSwaps, solHistory, priceSeries, parseTrades, pnlFromTrades, pnlStatus, estimatePnl } from "./pnl.js";

package/src/launch.js

@@ -0,0 +1,44 @@
+import { PUMP_PROGRAM } from "./constants.js";
+import { isCancel } from "./errors.js";
+import { pool } from "./util.js";
+
+/**
+ * Pump.fun tokens a wallet launched in the last 24 h, read on chain from its latest transactions.
+ *
+ * Launch farms often pay every launch from one wallet but name a fresh "creator" each time, so
+ * RugCheck (which follows the creator) sees one token per creator. The wallet that pays is the first
+ * signer of the creation transaction: this counts what else it created.
+ *
+ * @param [opts.limit=40]  latest transactions to read (each one is a request)
+ * @param [opts.now]
+ * @returns {n, mints, scanned, more}  more = every transaction read was a launch-day one, there may be more
+ */
+export async function recentLaunches(client, wallet, opts) {
+  opts = opts || {};
+  const limit = opts.limit || 40, now = opts.now || Date.now();
+  const sigs = (await client.rpc("getSignaturesForAddress", [wallet, { limit: limit }])) || [];
+  const day = sigs.filter(function (s) { return !s.err && s.blockTime && now / 1000 - s.blockTime < 86400; });
+  const mints = [];
+  await pool(day, 4, async function (s) {
+    const p = { encoding: "jsonParsed", maxSupportedTransactionVersion: 1, commitment: "confirmed" };
+    let tx = null;
+    try { tx = await client.rpc("getTransaction", [s.signature, p]); }
+    catch (e) {
+      if (isCancel(e)) throw e;
+      // an older RPC that does not know version 1 transactions yet
+      if (!/version|invalid param/i.test(e.message || "")) return;
+      p.maxSupportedTransactionVersion = 0;
+      try { tx = await client.rpc("getTransaction", [s.signature, p]); } catch (e2) { if (isCancel(e2)) throw e2; return; }
+    }
+    const meta = tx && tx.meta, keys = tx && tx.transaction && tx.transaction.message && tx.transaction.message.accountKeys;
+    if (!meta || !keys) return;
+    const pump = keys.some(function (k) { return (k.pubkey || k) === PUMP_PROGRAM; });
+    const create = (meta.logMessages || []).some(function (l) { return /^Program log: Instruction: Create(V2)?$/.test(l); });
+    if (!pump || !create) return;
+    const pre = (meta.preTokenBalances || []).map(function (b) { return b.mint; });
+    (meta.postTokenBalances || []).forEach(function (b) {
+      if (pre.indexOf(b.mint) < 0 && mints.indexOf(b.mint) < 0) mints.push(b.mint);
+    });
+  });
+  return { n: mints.length, mints: mints, scanned: day.length, more: sigs.length >= limit && day.length === sigs.length };
+}

package/src/markets.js

@@ -5,14 +5,19 @@ import { sleep } from "./util.js";
 // DexScreener values both sides of a pool at the pool's own price. A scammer creates a pool with
 // 4 billion of their token against 2 real USDC and it shows "liquidity $4,000M". What you can actually
 // take out when selling is the real-token side (USDC, USDT or SOL): if that is much smaller, it wins.
+// Concentrated-liquidity pools (Orca Whirlpools, Raydium CLMM, Meteora DLMM) are lopsided by nature,
+// often 10-20% real side, so only an extreme gap counts: real side under 5% of the reported value.
+// The scams this targets sit far below that (2 USDC against "$4,000M" is 0.00000005%).
 // Mutates the pair: keeps the reported figure in liqRaw and replaces liquidity.usd with the real one.
+export const INFLATED_RATIO = 0.05;
+
 export function realLiq(p) {
   const l = p.liquidity, qa = p.quoteToken && p.quoteToken.address;
   if (!l || !l.usd || (qa !== USDC && qa !== USDT && qa !== WSOL)) return;
   const pn = Number(p.priceNative), pu = Number(p.priceUsd), q = Number(l.quote);
   if (!(pn > 0 && pu > 0 && q >= 0)) return;
   const real = 2 * q * pu / pn;   // pu/pn = USD price of the real token
-  if (real < 0.25 * l.usd) { p.liqRaw = l.usd; p.liquidity = Object.assign({}, l, { usd: real }); }
+  if (real < INFLATED_RATIO * l.usd) { p.liqRaw = l.usd; p.liquidity = Object.assign({}, l, { usd: real }); }
 }
 
 // A token using the symbol (or name) of a famous one but with another address is a copy

package/src/risk.js

@@ -1,9 +1,9 @@
-import { EXT_POINTS, RANKS } from "./constants.js";
+import { EXT_POINTS, RANKS, PUMP_CURVE_DEXES } from "./constants.js";
 import { isCancel } from "./errors.js";
 import { short, sleep } from "./util.js";
 import { getMint, getAuthKinds, getConc } from "./tokens.js";
 import { impostorOf } from "./markets.js";
-import { rugcheckSummary } from "./rugcheck.js";
+import { rugcheckSummary, creatorLaunches } from "./rugcheck.js";
 
 // Every finding is a "signal": {code, s, data}. `s` is ok | na | warn | bad, `data` holds the numbers
 // behind it. Turning signals into sentences is i18n's job (describe / explainLight), never the engine's.
@@ -14,6 +14,8 @@ function sig(code, s, data) {
 }
 
 const DAY = 86400000;
+// Other tokens launched by the same creator in the last 24 h that make it a serial launcher
+export const SERIAL_WARN = 2, SERIAL_BAD = 5;
 
 /* ---------- old point score: only for tokens without a market, to spot spam ---------- */
 export function score(info) {
@@ -71,9 +73,10 @@ function mkLight(k, items, okSignal) {
  * @param value  USD value the analysed wallet holds (0 when checking a token alone)
  * @param type   tokenType(info, pair)
  * @param rc     RugCheck summary or null
+ * @param launches  creatorLaunches result or null: other tokens the creator launched in the last 24 h
  * @returns      [control, concentration, market, dependency]
  */
-export function buildLights(info, conc, pair, value, type, rc, now) {
+export function buildLights(info, conc, pair, value, type, rc, now, launches) {
   now = now || Date.now();
   const ak = (info && info.authKind) || {};
   let it;
@@ -89,6 +92,9 @@ export function buildLights(info, conc, pair, value, type, rc, now) {
     if (info.ext.indexOf("nonTransferable") >= 0) it.push(sig("CTL_NON_TRANSFERABLE", "warn"));
     if (info.ext.indexOf("defaultAccountState") >= 0) it.push(sig("CTL_DEFAULT_FROZEN", "warn"));
   }
+  // Launch farms put out a token every few minutes and drop each one as soon as buyers arrive: in a
+  // 100-token Pump.fun sample one wallet launched 7 copies of "GMS" in 10 minutes
+  if (launches && launches.day >= SERIAL_WARN) it.push(sig("CTL_SERIAL_CREATOR", launches.day >= SERIAL_BAD ? "bad" : "warn", { n: launches.day, creator: launches.creator }));
   const control = mkLight("control", it, sig((info && (info.mintAuth || info.freezeAuth)) ? "CTL_ONLY_PROGRAMS" : "CTL_NONE", "ok"));
 
   // 2) concentration in people (pools and programs do not count)
@@ -125,7 +131,10 @@ export function buildLights(info, conc, pair, value, type, rc, now) {
   // veteran tokens (JUP, WIF...) many market makers provide it and unlocked LP is not a signal: applying
   // it there gave false positives (JUP scored worse than a new memecoin)
   const young = !pair.pairCreatedAt || (now - pair.pairCreatedAt) / DAY < 90;
-  if (rc && !soft && young && liq > 0 && typeof rc.lpLockedPct === "number" && isFinite(rc.lpLockedPct)) {
+  // On Pump.fun's bonding curve there is no LP at all: the curve program holds the liquidity and nobody
+  // can pull it (RugCheck reports 0% locked, which flagged 49 of 75 curve tokens in a 100-token sample)
+  const onCurve = PUMP_CURVE_DEXES.indexOf(pair.dexId) >= 0;
+  if (rc && !soft && young && !onCurve && liq > 0 && typeof rc.lpLockedPct === "number" && isFinite(rc.lpLockedPct)) {
     if (rc.lpLockedPct < 20) it.push(sig("MKT_LP_UNLOCKED", "bad", { pct: rc.lpLockedPct }));
     else if (rc.lpLockedPct < 60) it.push(sig("MKT_LP_PARTLY_LOCKED", "warn", { pct: rc.lpLockedPct }));
   }
@@ -151,6 +160,11 @@ export function levelFrom(lights) {
   let lvl = (b >= 2 || (b === 1 && w >= 1)) ? "HIGH" : ((b === 1 || w >= 2) ? "MEDIUM" : "LOW");
   // What could not be checked does not count as "fine": with a check missing, at best it is medium risk
   if (lvl === "LOW" && na > 0) lvl = "MEDIUM";
+  // A market under 7 days old has no track record: it is never "low risk", even with nothing else wrong.
+  // Other single warnings stay low: on established tokens they are normal for their type (a staking pool's
+  // program-controlled mint, a transfer hook...); measured on 62 real tokens, this rule moved 9 brand-new
+  // tokens from low to medium and no established one
+  if (lvl === "LOW" && lights.some(function (l) { return (l.items || []).some(function (x) { return x.code === "MKT_NEW"; }); })) lvl = "MEDIUM";
   return { lvl: lvl, sev: 3 * b + w + (na && !b && !w ? 1 : 0) };
 }
 
@@ -176,6 +190,7 @@ export function reasonsFrom(lights) {
  * @param [opts.value]           USD the analysed wallet holds of it (for the "heavy position" check)
  * @param [opts.marketUnknown]   the DexScreener batch for this mint failed: no data, not "no market"
  * @param [opts.skipConcentration]
+ * @param [opts.skipCreator]     do not ask RugCheck what else the creator launched (markets under 7 days only)
  * @returns null for NFTs, otherwise {mint, sym, name, lvl, sev, pts, type, lights, reasons, impostor, value, pair, img}
  */
 export async function assess(client, mint, pair, opts) {
@@ -188,6 +203,9 @@ export async function assess(client, mint, pair, opts) {
     };
   }
   const rcPromise = pair ? rugcheckSummary(client, mint) : Promise.resolve(null);   // in parallel with the RPC calls below
+  // Serial launching only matters while a token is new; RugCheck's full report is small (~10 KB) then
+  const fresh = pair && !opts.skipCreator && (!pair.pairCreatedAt || Date.now() - pair.pairCreatedAt < 7 * DAY);
+  const launchPromise = fresh ? creatorLaunches(client, mint) : Promise.resolve(null);
   let info = null, conc = null;
   try { info = await getMint(client, mint); } catch (e) { if (isCancel(e)) throw e; }
   if (info && info.decimals === 0 && info.supply === 1) return null;   // NFT
@@ -200,15 +218,15 @@ export async function assess(client, mint, pair, opts) {
     // In tokens with millions of holders (BONK) getTokenLargestAccounts sometimes times out: a second try usually works
     for (let tryC = 0; tryC < 2 && !conc; tryC++) {
       try { conc = await getConc(client, mint, info.supply); }
-      catch (e) { if (isCancel(e)) throw e; conc = null; if (!tryC) await sleep(opts.retryDelayMs === undefined ? 1500 : opts.retryDelayMs); }
+      catch (e) { if (isCancel(e)) throw e; conc = null; if (!tryC) await sleep(client.retryDelayMs === undefined ? 1500 : client.retryDelayMs); }
     }
   }
-  const rc = await rcPromise;
+  const rc = await rcPromise, launches = await launchPromise;
   const base = (pair && pair.baseToken) || {};
   let lvl, sev = 0, reasons = [], lights = null, type = null, pts = 0, imp = null;
   if (pair) {
     type = tokenType(info, pair);
-    lights = buildLights(info, conc, pair, value, type, rc);
+    lights = buildLights(info, conc, pair, value, type, rc, null, launches);
     imp = impostorOf(mint, pair);
     if (imp) {
       const prev = lights[0];
@@ -224,6 +242,7 @@ export async function assess(client, mint, pair, opts) {
     mint: mint, sym: base.symbol || short(mint), name: base.name || "", pts: pts, sev: sev,
     lvl: lvl, type: type, lights: lights, reasons: reasons, impostor: imp, value: value, pair: pair,
     rugcheck: rc ? { lpLockedPct: rc.lpLockedPct, score: rc.score_normalised !== undefined ? rc.score_normalised : rc.score } : null,
+    creator: launches,
     img: (pair && pair.info && pair.info.imageUrl) || null
   };
 }

package/src/rugcheck.js

@@ -1,6 +1,6 @@
-import { RUGCHECK, SYSTEM_PROGRAM } from "./constants.js";
+import { RUGCHECK } from "./constants.js";
 import { isCancel } from "./errors.js";
-import { onCurve, b58bytes } from "./curve.js";
+import { kindOf } from "./tokens.js";
 import { pool } from "./util.js";
 
 // Extra signal from RugCheck.xyz (public API, no key): mainly the % of liquidity locked or burned,
@@ -18,6 +18,18 @@ export function rugcheckReport(client, mint) {
   return client.softJson(RUGCHECK + mint + "/report", 10000);
 }
 
+// How many other tokens the creator launched in the last 24 h. Only for new tokens: their full report
+// is ~10 KB (the 700 KB ones are old tokens with many markets and holders).
+// @returns {creator, day, total} or null when RugCheck does not answer or does not know the creator
+export async function creatorLaunches(client, mint, now) {
+  const rc = await rugcheckReport(client, mint);
+  if (!rc || !rc.creator) return null;
+  now = now || Date.now();
+  const others = (rc.creatorTokens || []).filter(function (t) { return t && t.mint !== mint; });
+  const day = others.filter(function (t) { const at = Date.parse(t.createdAt); return at && now - at < 86400000; }).length;
+  return { creator: rc.creator, day: day, total: others.length };
+}
+
 // The report only gives each network's size; this endpoint gives its wallets and holdings
 export async function rugcheckGraph(client, mint) {
   const g = await client.softJson(RUGCHECK + mint + "/insiders/graph", 8000);
@@ -42,7 +54,7 @@ export async function netBalances(client, mint, graph) {
     const part = addrs.slice(i, i + 100);
     try {
       const oa = await client.rpc("getMultipleAccounts", [part, { encoding: "base64", dataSlice: { offset: 0, length: 0 } }]);
-      part.forEach(function (a, k) { const v = oa.value[k]; kind[a] = v ? (v.owner === SYSTEM_PROGRAM ? "wallet" : "program") : (onCurve(b58bytes(a)) ? "wallet" : "program"); });
+      part.forEach(function (a, k) { kind[a] = kindOf(a, oa.value[k], true); });
     } catch (e) { if (isCancel(e)) throw e; }
   }
   await pool(addrs, 4, async function (a) {

package/src/tokens.js

@@ -41,16 +41,21 @@ export async function getMint(client, mint) {
   };
 }
 
-// "wallet" or "program" for each address, from who owns its account (or the curve when it has none)
-export async function accountKinds(client, addrs, curveFallback) {
+// A key off the ed25519 curve has no private key: only a program can sign for it (a PDA), whoever
+// owns its account. PDAs that hold SOL (stake pool and AMM authorities) are owned by the System
+// Program like any wallet, so the owner alone would count them as people.
+export function kindOf(key, account, missingIsWallet) {
+  if (!onCurve(b58bytes(key))) return "program";
+  if (account) return account.owner === SYSTEM_PROGRAM ? "wallet" : "program";
+  return missingIsWallet ? "wallet" : "program";
+}
+
+// "wallet" or "program" for each address
+export async function accountKinds(client, addrs, missingIsWallet) {
   if (!addrs.length) return {};
   const r = await client.rpc("getMultipleAccounts", [addrs, { encoding: "base64", dataSlice: { offset: 0, length: 0 } }]);
   const out = {};
-  addrs.forEach(function (k, i) {
-    const v = r.value[i];
-    if (v) out[k] = v.owner === SYSTEM_PROGRAM ? "wallet" : "program";
-    else out[k] = curveFallback ? (onCurve(b58bytes(k)) ? "wallet" : "program") : "program";
-  });
+  addrs.forEach(function (k, i) { out[k] = kindOf(k, r.value[i], missingIsWallet); });
   return out;
 }
 
@@ -59,7 +64,7 @@ export async function getAuthKinds(client, info) {
   const keys = [];
   [info.mintAuth, info.freezeAuth].forEach(function (a) { if (a && keys.indexOf(a) < 0) keys.push(a); });
   if (!keys.length) return {};
-  return accountKinds(client, keys, true);   // no account: an empty wallet is on the curve, a PDA is not
+  return accountKinds(client, keys, true);   // no account but on the curve: an empty wallet
 }
 
 // Concentration of the supply. Each large account is traced to its owner: a pool or a program

package/src/wallet.js

@@ -22,7 +22,7 @@ export async function analyzeToken(client, mint, opts) {
   progress(opts.onProgress, "markets", 0.15);
   const mkr = await getMarkets(client, [mint]);
   progress(opts.onProgress, "token", 0.45);
-  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration });
+  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
   if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
   progress(opts.onProgress, "done", 1);
   return r;
@@ -62,7 +62,7 @@ export async function analyzeWallet(client, wallet, opts) {
 
   let done = 0;
   await pool(todo, opts.concurrency || 3, async function (t) {
-    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration });
+    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
     if (r) out.push(r);
     done++;
     progress(onProgress, "tokens", 0.2 + 0.8 * done / Math.max(1, todo.length), { done: done, total: todo.length });