solana-risk-engine 0.2.0 → 0.3.1

package/README.md

@@ -27,8 +27,9 @@ for (const l of r.lights)  // the four traffic lights
 | **Creator control** | Mint/freeze authority still active, and whether it sits in a person's wallet or a program (bridge, protocol, staking pool). A key off the ed25519 curve is always a program (PDA), even when the System Program owns its account. Risky Token-2022 extensions: permanent delegate, transfer hook, transfer fee, non-transferable, default-frozen accounts. |
 | **Real concentration** | Largest accounts are traced to their owners. Pools and programs are separated from people, so `w1`/`w10` measure *people*, not AMM vaults. |
 | **Inflated liquidity** | DexScreener values both sides of a pool at the pool's price. A pool with 4B of a token against 2 USDC shows "$4,000M liquidity". The engine recomputes it from the real side (USDC/USDT/SOL). It only flags extreme gaps (real side under 5%), because concentrated-liquidity pools are lopsided by nature. |
-| **Unlocked LP** | % of LP locked/burned via RugCheck. It only counts for markets under 90 days old, so veteran tokens don't get false positives. |
-| **Impostors** | Tokens using the symbol or name of a famous token (USDC, JUP, BONK, WIF...) with a different address. |
+| **Unlocked LP** | % of LP locked/burned via RugCheck. It only counts for markets under 90 days old, so veteran tokens don't get false positives, and never while a token is on Pump.fun's bonding curve, where there is no LP to pull. |
+| **Serial creators** | For markets under 7 days: how many other tokens the creator launched in the last 24 h (RugCheck). 2 or more is a warning, 5 or more a red flag. `recentLaunches(client, wallet)` counts the same on chain for the wallet that *paid* a launch, which catches farms that name a fresh creator each time. |
+| **Impostors** | Tokens using the symbol or name of a famous token (USDC, JUP, BONK, WIF, BTC, ETH...) with a different address. |
 | **Token type** | `STABLE`, `TOKENIZED`, `BRIDGED`, `CREATOR`, `OPEN`. Each type is judged by the rules that fit it: a bridged token normally has a program as mint authority, a memecoin does not. |
 | **Bots and exchanges** | Wallets that made 200 transactions in under 2 days are marked `active` and are not counted as whales. |
 | **Funder clusters** | The fee payer of each holder's *first* transaction reveals who created it. Holders sharing a funder are grouped, since that is often one team splitting the supply. Exchange hot wallets are excluded as sources. |
@@ -69,7 +70,7 @@ Methods (all accept `{ onProgress(step, fraction) }`):
 
 | Method | Returns |
 |---|---|
-| `analyzeToken(mint)` | `{ lvl, sev, type, lights, reasons, impostor, pair, ... }` |
+| `analyzeToken(mint, { skipCreator })` | `{ lvl, sev, type, lights, reasons, impostor, pair, creator, ... }` |
 | `analyzeWallet(wallet, { minUsd })` | `{ sol, balances, total, hidden, results: [token results] }` |
 | `analyzeAddress(addr)` | `{ kind: "token" \| "wallet", ... }`, detected automatically |
 | `analyzeHolders(mint)` | `{ rows, clusters, hotGroups, creator, ... }`. Best with your own RPC. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solana-risk-engine",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
   "type": "module",
   "main": "./src/index.js",

package/src/constants.js

@@ -6,12 +6,16 @@ export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
 export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
 export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
 export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
+export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
 export const HELIUS_API = "https://api.helius.xyz/v0/addresses/";
 export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/market_chart?vs_currency=usd&days=365";
 
 export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
 export const TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
 export const SYSTEM_PROGRAM = "11111111111111111111111111111111";
+export const PUMP_PROGRAM = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P";
+// dexId of a token still on Pump.fun's bonding curve: DexScreener says "pumpfun", GeckoTerminal "pump-fun"
+export const PUMP_CURVE_DEXES = ["pumpfun", "pump-fun"];
 
 export const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
 export const USDT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
@@ -34,7 +38,10 @@ export const FAMOUS = {
   PUMP: "pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn", JLP: "27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4",
   POPCAT: "7GCihgDB8fe6KNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr", HNT: "hntyVP6YFm1Hg25TN9WGLqM12b8TQmcknKrdu1oxWux",
   RENDER: "rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof", ORCA: "orcaEKTdK7LKz57vaAYr9QeNsVEPfiu6QeMU1kektZE",
-  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7"
+  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7",
+  // Bitcoin and Ether only exist on Solana bridged: a Pump.fun token called "BTC" is never the real one
+  BTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh", WBTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh",
+  ETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs", WETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs"
 };
 
 // Token-2022 extensions that add risk, with the points they add to the no-market spam score

package/src/i18n/en.js

@@ -36,6 +36,7 @@ export default {
     CTL_DEFAULT_FROZEN: () => "New accounts can be created frozen",
     CTL_ONLY_PROGRAMS: () => "Only program-controlled authorities (see dependency)",
     CTL_NONE: () => "No active authorities: nobody can mint more or freeze",
+    CTL_SERIAL_CREATOR: (d) => "The creator launched " + d.n + " other tokens in the last 24 h (per RugCheck): a serial launcher, who usually drops each token as soon as buyers arrive",
     IMPOSTOR: (d) => "Impersonates " + d.symbol + ": the real " + d.symbol + " has another address (" + short(d.real) + "). It is a copy, almost certainly a scam",
 
     CON_SKIPPED: () => "Holder concentration not checked",

package/src/i18n/es.js

@@ -39,6 +39,7 @@ export default {
     CTL_DEFAULT_FROZEN: () => "Las cuentas nuevas pueden crearse congeladas",
     CTL_ONLY_PROGRAMS: () => "Solo hay autoridades controladas por un programa (ver dependencia)",
     CTL_NONE: () => "Sin autoridades activas: nadie puede crear más ni congelar",
+    CTL_SERIAL_CREATOR: (d) => "El creador ha lanzado " + d.n + " tokens más en las últimas 24 h (según RugCheck): es un lanzador en serie, que suele abandonar cada token en cuanto llegan compradores",
     IMPOSTOR: (d) => "Se hace pasar por " + d.symbol + ": el " + d.symbol + " de verdad tiene otra dirección (" + short(d.real) + "). Es una copia, casi seguro una estafa",
 
     CON_SKIPPED: () => "Sin comprobar la concentración de holders",

package/src/index.js

@@ -44,9 +44,10 @@ export { ScanError, isCancel } from "./errors.js";
 export * from "./constants.js";
 export { isOnCurve, onCurve, b58bytes } from "./curve.js";
 export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf } from "./tokens.js";
-export { getMarkets, realLiq, impostorOf, INFLATED_RATIO } from "./markets.js";
-export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances } from "./rugcheck.js";
-export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess } from "./risk.js";
+export { getMarkets, realLiq, impostorOf, INFLATED_RATIO, geckoLiquidity, geckoPair } from "./markets.js";
+export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches } from "./rugcheck.js";
+export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD } from "./risk.js";
+export { recentLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
 export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders } from "./holders.js";
 export { fetchSwaps, solHistory, priceSeries, parseTrades, pnlFromTrades, pnlStatus, estimatePnl } from "./pnl.js";

package/src/launch.js

@@ -0,0 +1,44 @@
+import { PUMP_PROGRAM } from "./constants.js";
+import { isCancel } from "./errors.js";
+import { pool } from "./util.js";
+
+/**
+ * Pump.fun tokens a wallet launched in the last 24 h, read on chain from its latest transactions.
+ *
+ * Launch farms often pay every launch from one wallet but name a fresh "creator" each time, so
+ * RugCheck (which follows the creator) sees one token per creator. The wallet that pays is the first
+ * signer of the creation transaction: this counts what else it created.
+ *
+ * @param [opts.limit=40]  latest transactions to read (each one is a request)
+ * @param [opts.now]
+ * @returns {n, mints, scanned, more}  more = every transaction read was a launch-day one, there may be more
+ */
+export async function recentLaunches(client, wallet, opts) {
+  opts = opts || {};
+  const limit = opts.limit || 40, now = opts.now || Date.now();
+  const sigs = (await client.rpc("getSignaturesForAddress", [wallet, { limit: limit }])) || [];
+  const day = sigs.filter(function (s) { return !s.err && s.blockTime && now / 1000 - s.blockTime < 86400; });
+  const mints = [];
+  await pool(day, 4, async function (s) {
+    const p = { encoding: "jsonParsed", maxSupportedTransactionVersion: 1, commitment: "confirmed" };
+    let tx = null;
+    try { tx = await client.rpc("getTransaction", [s.signature, p]); }
+    catch (e) {
+      if (isCancel(e)) throw e;
+      // an older RPC that does not know version 1 transactions yet
+      if (!/version|invalid param/i.test(e.message || "")) return;
+      p.maxSupportedTransactionVersion = 0;
+      try { tx = await client.rpc("getTransaction", [s.signature, p]); } catch (e2) { if (isCancel(e2)) throw e2; return; }
+    }
+    const meta = tx && tx.meta, keys = tx && tx.transaction && tx.transaction.message && tx.transaction.message.accountKeys;
+    if (!meta || !keys) return;
+    const pump = keys.some(function (k) { return (k.pubkey || k) === PUMP_PROGRAM; });
+    const create = (meta.logMessages || []).some(function (l) { return /^Program log: Instruction: Create(V2)?$/.test(l); });
+    if (!pump || !create) return;
+    const pre = (meta.preTokenBalances || []).map(function (b) { return b.mint; });
+    (meta.postTokenBalances || []).forEach(function (b) {
+      if (pre.indexOf(b.mint) < 0 && mints.indexOf(b.mint) < 0) mints.push(b.mint);
+    });
+  });
+  return { n: mints.length, mints: mints, scanned: day.length, more: sigs.length >= limit && day.length === sigs.length };
+}

package/src/markets.js

@@ -1,4 +1,4 @@
-import { DEX, USDC, USDT, WSOL, FAMOUS } from "./constants.js";
+import { DEX, GECKO, USDC, USDT, WSOL, FAMOUS } from "./constants.js";
 import { ScanError, isCancel } from "./errors.js";
 import { sleep } from "./util.js";
 
@@ -56,3 +56,32 @@ export async function getMarkets(client, mints, onStep) {
   }
   return { data: best, failed: failed };
 }
+
+/* ---------- GeckoTerminal: fills two DexScreener gaps on Pump.fun ---------- */
+// Both are optional extras: on any failure the market stays exactly as DexScreener gave it.
+
+// DexScreener reports $0 liquidity for tokens still on Pump.fun's bonding curve. GeckoTerminal has the
+// real figure for the same pool (its pool address is DexScreener's pairAddress). Mutates the pair.
+export async function geckoLiquidity(client, pair) {
+  if (!pair || (pair.liquidity && pair.liquidity.usd) || !pair.pairAddress) return pair;
+  const j = await client.softJson(GECKO + "pools/" + pair.pairAddress, 6000);
+  const v = Number(j && j.data && j.data.attributes && j.data.attributes.reserve_in_usd) || 0;
+  if (v > 0) pair.liquidity = Object.assign({}, pair.liquidity, { usd: v });
+  return pair;
+}
+
+// A token seconds old is not on DexScreener yet but is on GeckoTerminal: its most liquid pool, shaped
+// like a DexScreener pair (what the engine reads: price, liquidity, volume, age, symbol), or null
+export async function geckoPair(client, mint) {
+  const j = await client.softJson(GECKO + "tokens/" + mint + "/pools?page=1&include=base_token", 6000);
+  const p = j && j.data && j.data[0];
+  if (!p || !p.attributes) return null;
+  const a = p.attributes, rel = p.relationships || {}, t = ((j.included || [])[0] || {}).attributes || {};
+  return {
+    pairAddress: a.address, dexId: (rel.dex && rel.dex.data && rel.dex.data.id) || "",
+    baseToken: { address: mint, symbol: t.symbol, name: t.name },
+    priceUsd: String(a.base_token_price_usd || 0), liquidity: { usd: Number(a.reserve_in_usd) || 0 },
+    volume: { h24: Number(a.volume_usd && a.volume_usd.h24) || 0 }, pairCreatedAt: Date.parse(a.pool_created_at) || 0,
+    info: { imageUrl: t.image_url && !/missing/.test(t.image_url) ? t.image_url : null }, source: "geckoterminal"
+  };
+}

package/src/risk.js

@@ -1,9 +1,9 @@
-import { EXT_POINTS, RANKS } from "./constants.js";
+import { EXT_POINTS, RANKS, PUMP_CURVE_DEXES } from "./constants.js";
 import { isCancel } from "./errors.js";
 import { short, sleep } from "./util.js";
 import { getMint, getAuthKinds, getConc } from "./tokens.js";
 import { impostorOf } from "./markets.js";
-import { rugcheckSummary } from "./rugcheck.js";
+import { rugcheckSummary, creatorLaunches } from "./rugcheck.js";
 
 // Every finding is a "signal": {code, s, data}. `s` is ok | na | warn | bad, `data` holds the numbers
 // behind it. Turning signals into sentences is i18n's job (describe / explainLight), never the engine's.
@@ -14,6 +14,8 @@ function sig(code, s, data) {
 }
 
 const DAY = 86400000;
+// Other tokens launched by the same creator in the last 24 h that make it a serial launcher
+export const SERIAL_WARN = 2, SERIAL_BAD = 5;
 
 /* ---------- old point score: only for tokens without a market, to spot spam ---------- */
 export function score(info) {
@@ -71,9 +73,10 @@ function mkLight(k, items, okSignal) {
  * @param value  USD value the analysed wallet holds (0 when checking a token alone)
  * @param type   tokenType(info, pair)
  * @param rc     RugCheck summary or null
+ * @param launches  creatorLaunches result or null: other tokens the creator launched in the last 24 h
  * @returns      [control, concentration, market, dependency]
  */
-export function buildLights(info, conc, pair, value, type, rc, now) {
+export function buildLights(info, conc, pair, value, type, rc, now, launches) {
   now = now || Date.now();
   const ak = (info && info.authKind) || {};
   let it;
@@ -89,6 +92,9 @@ export function buildLights(info, conc, pair, value, type, rc, now) {
     if (info.ext.indexOf("nonTransferable") >= 0) it.push(sig("CTL_NON_TRANSFERABLE", "warn"));
     if (info.ext.indexOf("defaultAccountState") >= 0) it.push(sig("CTL_DEFAULT_FROZEN", "warn"));
   }
+  // Launch farms put out a token every few minutes and drop each one as soon as buyers arrive: in a
+  // 100-token Pump.fun sample one wallet launched 7 copies of "GMS" in 10 minutes
+  if (launches && launches.day >= SERIAL_WARN) it.push(sig("CTL_SERIAL_CREATOR", launches.day >= SERIAL_BAD ? "bad" : "warn", { n: launches.day, creator: launches.creator }));
   const control = mkLight("control", it, sig((info && (info.mintAuth || info.freezeAuth)) ? "CTL_ONLY_PROGRAMS" : "CTL_NONE", "ok"));
 
   // 2) concentration in people (pools and programs do not count)
@@ -125,7 +131,10 @@ export function buildLights(info, conc, pair, value, type, rc, now) {
   // veteran tokens (JUP, WIF...) many market makers provide it and unlocked LP is not a signal: applying
   // it there gave false positives (JUP scored worse than a new memecoin)
   const young = !pair.pairCreatedAt || (now - pair.pairCreatedAt) / DAY < 90;
-  if (rc && !soft && young && liq > 0 && typeof rc.lpLockedPct === "number" && isFinite(rc.lpLockedPct)) {
+  // On Pump.fun's bonding curve there is no LP at all: the curve program holds the liquidity and nobody
+  // can pull it (RugCheck reports 0% locked, which flagged 49 of 75 curve tokens in a 100-token sample)
+  const onCurve = PUMP_CURVE_DEXES.indexOf(pair.dexId) >= 0;
+  if (rc && !soft && young && !onCurve && liq > 0 && typeof rc.lpLockedPct === "number" && isFinite(rc.lpLockedPct)) {
     if (rc.lpLockedPct < 20) it.push(sig("MKT_LP_UNLOCKED", "bad", { pct: rc.lpLockedPct }));
     else if (rc.lpLockedPct < 60) it.push(sig("MKT_LP_PARTLY_LOCKED", "warn", { pct: rc.lpLockedPct }));
   }
@@ -181,6 +190,7 @@ export function reasonsFrom(lights) {
  * @param [opts.value]           USD the analysed wallet holds of it (for the "heavy position" check)
  * @param [opts.marketUnknown]   the DexScreener batch for this mint failed: no data, not "no market"
  * @param [opts.skipConcentration]
+ * @param [opts.skipCreator]     do not ask RugCheck what else the creator launched (markets under 7 days only)
  * @returns null for NFTs, otherwise {mint, sym, name, lvl, sev, pts, type, lights, reasons, impostor, value, pair, img}
  */
 export async function assess(client, mint, pair, opts) {
@@ -193,6 +203,9 @@ export async function assess(client, mint, pair, opts) {
     };
   }
   const rcPromise = pair ? rugcheckSummary(client, mint) : Promise.resolve(null);   // in parallel with the RPC calls below
+  // Serial launching only matters while a token is new; RugCheck's full report is small (~10 KB) then
+  const fresh = pair && !opts.skipCreator && (!pair.pairCreatedAt || Date.now() - pair.pairCreatedAt < 7 * DAY);
+  const launchPromise = fresh ? creatorLaunches(client, mint) : Promise.resolve(null);
   let info = null, conc = null;
   try { info = await getMint(client, mint); } catch (e) { if (isCancel(e)) throw e; }
   if (info && info.decimals === 0 && info.supply === 1) return null;   // NFT
@@ -208,12 +221,12 @@ export async function assess(client, mint, pair, opts) {
       catch (e) { if (isCancel(e)) throw e; conc = null; if (!tryC) await sleep(client.retryDelayMs === undefined ? 1500 : client.retryDelayMs); }
     }
   }
-  const rc = await rcPromise;
+  const rc = await rcPromise, launches = await launchPromise;
   const base = (pair && pair.baseToken) || {};
   let lvl, sev = 0, reasons = [], lights = null, type = null, pts = 0, imp = null;
   if (pair) {
     type = tokenType(info, pair);
-    lights = buildLights(info, conc, pair, value, type, rc);
+    lights = buildLights(info, conc, pair, value, type, rc, null, launches);
     imp = impostorOf(mint, pair);
     if (imp) {
       const prev = lights[0];
@@ -229,6 +242,7 @@ export async function assess(client, mint, pair, opts) {
     mint: mint, sym: base.symbol || short(mint), name: base.name || "", pts: pts, sev: sev,
     lvl: lvl, type: type, lights: lights, reasons: reasons, impostor: imp, value: value, pair: pair,
     rugcheck: rc ? { lpLockedPct: rc.lpLockedPct, score: rc.score_normalised !== undefined ? rc.score_normalised : rc.score } : null,
+    creator: launches,
     img: (pair && pair.info && pair.info.imageUrl) || null
   };
 }

package/src/rugcheck.js

@@ -18,6 +18,18 @@ export function rugcheckReport(client, mint) {
   return client.softJson(RUGCHECK + mint + "/report", 10000);
 }
 
+// How many other tokens the creator launched in the last 24 h. Only for new tokens: their full report
+// is ~10 KB (the 700 KB ones are old tokens with many markets and holders).
+// @returns {creator, day, total} or null when RugCheck does not answer or does not know the creator
+export async function creatorLaunches(client, mint, now) {
+  const rc = await rugcheckReport(client, mint);
+  if (!rc || !rc.creator) return null;
+  now = now || Date.now();
+  const others = (rc.creatorTokens || []).filter(function (t) { return t && t.mint !== mint; });
+  const day = others.filter(function (t) { const at = Date.parse(t.createdAt); return at && now - at < 86400000; }).length;
+  return { creator: rc.creator, day: day, total: others.length };
+}
+
 // The report only gives each network's size; this endpoint gives its wallets and holdings
 export async function rugcheckGraph(client, mint) {
   const g = await client.softJson(RUGCHECK + mint + "/insiders/graph", 8000);

package/src/wallet.js

@@ -1,8 +1,8 @@
-import { ADDRESS_RE, KNOWN, LEVELS } from "./constants.js";
+import { ADDRESS_RE, KNOWN, LEVELS, PUMP_CURVE_DEXES } from "./constants.js";
 import { ScanError } from "./errors.js";
 import { pool, progress } from "./util.js";
 import { getTokens, isMint } from "./tokens.js";
-import { getMarkets } from "./markets.js";
+import { getMarkets, geckoLiquidity, geckoPair } from "./markets.js";
 import { assess } from "./risk.js";
 
 function checkAddress(addr) {
@@ -15,14 +15,22 @@ export function sortResults(list) {
   });
 }
 
-/** Risk of a single token. Throws IS_NFT for NFTs. */
+/**
+ * Risk of a single token. Throws IS_NFT for NFTs.
+ * @param [opts.noGecko]  do not fill DexScreener's Pump.fun gaps from GeckoTerminal (also for analyzeWallet)
+ */
 export async function analyzeToken(client, mint, opts) {
   opts = opts || {};
   checkAddress(mint);
   progress(opts.onProgress, "markets", 0.15);
   const mkr = await getMarkets(client, [mint]);
+  // Pump.fun gaps in DexScreener: not listed yet (seconds old) or $0 liquidity on the bonding curve
+  if (!opts.noGecko) {
+    if (!mkr.data[mint] && !mkr.failed.length) { const gp = await geckoPair(client, mint); if (gp) mkr.data[mint] = gp; }
+    await geckoLiquidity(client, mkr.data[mint]);
+  }
   progress(opts.onProgress, "token", 0.45);
-  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration });
+  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
   if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
   progress(opts.onProgress, "done", 1);
   return r;
@@ -49,6 +57,12 @@ export async function analyzeWallet(client, wallet, opts) {
   const mkr = await getMarkets(client, mints, function (d, n) { progress(onProgress, "markets", 0.08 + 0.12 * d / n, { done: d, total: n }); });
   const mk = mkr.data, failedMk = {};
   mkr.failed.forEach(function (m) { failedMk[m] = 1; });
+  // Bonding-curve tokens show $0 liquidity on DexScreener; ask GeckoTerminal for a few (its free API
+  // allows ~30 requests a minute, and wallets full of airdropped spam would use them up)
+  if (!opts.noGecko) {
+    const curve = mints.filter(function (m) { const p = mk[m]; return p && PUMP_CURVE_DEXES.indexOf(p.dexId) >= 0 && !(p.liquidity && p.liquidity.usd); }).slice(0, 10);
+    await pool(curve, 2, async function (m) { await geckoLiquidity(client, mk[m]); });
+  }
 
   const out = [], todo = [];
   mints.forEach(function (m) {
@@ -62,7 +76,7 @@ export async function analyzeWallet(client, wallet, opts) {
 
   let done = 0;
   await pool(todo, opts.concurrency || 3, async function (t) {
-    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration });
+    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
     if (r) out.push(r);
     done++;
     progress(onProgress, "tokens", 0.2 + 0.8 * done / Math.max(1, todo.length), { done: done, total: todo.length });