solana-risk-engine 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solana-risk-engine",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
   "type": "module",
   "main": "./src/index.js",

package/src/constants.js

@@ -6,6 +6,7 @@ export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
 export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
 export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
 export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
+export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
 export const HELIUS_API = "https://api.helius.xyz/v0/addresses/";
 export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/market_chart?vs_currency=usd&days=365";
 

package/src/index.js

@@ -44,7 +44,7 @@ export { ScanError, isCancel } from "./errors.js";
 export * from "./constants.js";
 export { isOnCurve, onCurve, b58bytes } from "./curve.js";
 export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf } from "./tokens.js";
-export { getMarkets, realLiq, impostorOf, INFLATED_RATIO } from "./markets.js";
+export { getMarkets, realLiq, impostorOf, INFLATED_RATIO, geckoLiquidity, geckoPair } from "./markets.js";
 export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches } from "./rugcheck.js";
 export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD } from "./risk.js";
 export { recentLaunches } from "./launch.js";

package/src/markets.js

@@ -1,4 +1,4 @@
-import { DEX, USDC, USDT, WSOL, FAMOUS } from "./constants.js";
+import { DEX, GECKO, USDC, USDT, WSOL, FAMOUS } from "./constants.js";
 import { ScanError, isCancel } from "./errors.js";
 import { sleep } from "./util.js";
 
@@ -56,3 +56,32 @@ export async function getMarkets(client, mints, onStep) {
   }
   return { data: best, failed: failed };
 }
+
+/* ---------- GeckoTerminal: fills two DexScreener gaps on Pump.fun ---------- */
+// Both are optional extras: on any failure the market stays exactly as DexScreener gave it.
+
+// DexScreener reports $0 liquidity for tokens still on Pump.fun's bonding curve. GeckoTerminal has the
+// real figure for the same pool (its pool address is DexScreener's pairAddress). Mutates the pair.
+export async function geckoLiquidity(client, pair) {
+  if (!pair || (pair.liquidity && pair.liquidity.usd) || !pair.pairAddress) return pair;
+  const j = await client.softJson(GECKO + "pools/" + pair.pairAddress, 6000);
+  const v = Number(j && j.data && j.data.attributes && j.data.attributes.reserve_in_usd) || 0;
+  if (v > 0) pair.liquidity = Object.assign({}, pair.liquidity, { usd: v });
+  return pair;
+}
+
+// A token seconds old is not on DexScreener yet but is on GeckoTerminal: its most liquid pool, shaped
+// like a DexScreener pair (what the engine reads: price, liquidity, volume, age, symbol), or null
+export async function geckoPair(client, mint) {
+  const j = await client.softJson(GECKO + "tokens/" + mint + "/pools?page=1&include=base_token", 6000);
+  const p = j && j.data && j.data[0];
+  if (!p || !p.attributes) return null;
+  const a = p.attributes, rel = p.relationships || {}, t = ((j.included || [])[0] || {}).attributes || {};
+  return {
+    pairAddress: a.address, dexId: (rel.dex && rel.dex.data && rel.dex.data.id) || "",
+    baseToken: { address: mint, symbol: t.symbol, name: t.name },
+    priceUsd: String(a.base_token_price_usd || 0), liquidity: { usd: Number(a.reserve_in_usd) || 0 },
+    volume: { h24: Number(a.volume_usd && a.volume_usd.h24) || 0 }, pairCreatedAt: Date.parse(a.pool_created_at) || 0,
+    info: { imageUrl: t.image_url && !/missing/.test(t.image_url) ? t.image_url : null }, source: "geckoterminal"
+  };
+}

package/src/rugcheck.js

@@ -7,8 +7,22 @@ import { pool } from "./util.js";
 // which on-chain data does not show without decoding each DEX's binary layout (Raydium, Orca, Meteora
 // and pump.fun all differ). It is an extra, never a requirement: on failure these return null and the
 // rest of the analysis is exactly the same.
-export function rugcheckSummary(client, mint) {
-  return client.softJson(RUGCHECK + mint + "/report/summary", 6000);
+// RugCheck sometimes answers lpLockedPct 0 for a pool that is ~100% locked (5 of 40 calls on a
+// Raydium CPMM token, 2026-10-26; a watched token flipped high/medium every check). A low value is
+// therefore asked again up to twice and the highest answer wins: a pool that really is unlocked
+// reads low every time, so only the false alarm goes away.
+export const LP_RECHECK_BELOW = 60;
+export async function rugcheckSummary(client, mint) {
+  const url = RUGCHECK + mint + "/report/summary";
+  let best = await client.softJson(url, 6000);
+  for (let i = 0; i < 2 && lowLp(best); i++) {
+    const again = await client.softJson(url, 6000);
+    if (again && typeof again.lpLockedPct === "number" && again.lpLockedPct > best.lpLockedPct) best = again;
+  }
+  return best;
+}
+function lowLp(rc) {
+  return !!rc && typeof rc.lpLockedPct === "number" && rc.lpLockedPct < LP_RECHECK_BELOW;
 }
 
 // Full report (~700 KB, so ask once per holder search, never per token of a wallet): who created the

package/src/wallet.js

@@ -1,8 +1,8 @@
-import { ADDRESS_RE, KNOWN, LEVELS } from "./constants.js";
+import { ADDRESS_RE, KNOWN, LEVELS, PUMP_CURVE_DEXES } from "./constants.js";
 import { ScanError } from "./errors.js";
 import { pool, progress } from "./util.js";
 import { getTokens, isMint } from "./tokens.js";
-import { getMarkets } from "./markets.js";
+import { getMarkets, geckoLiquidity, geckoPair } from "./markets.js";
 import { assess } from "./risk.js";
 
 function checkAddress(addr) {
@@ -15,12 +15,20 @@ export function sortResults(list) {
   });
 }
 
-/** Risk of a single token. Throws IS_NFT for NFTs. */
+/**
+ * Risk of a single token. Throws IS_NFT for NFTs.
+ * @param [opts.noGecko]  do not fill DexScreener's Pump.fun gaps from GeckoTerminal (also for analyzeWallet)
+ */
 export async function analyzeToken(client, mint, opts) {
   opts = opts || {};
   checkAddress(mint);
   progress(opts.onProgress, "markets", 0.15);
   const mkr = await getMarkets(client, [mint]);
+  // Pump.fun gaps in DexScreener: not listed yet (seconds old) or $0 liquidity on the bonding curve
+  if (!opts.noGecko) {
+    if (!mkr.data[mint] && !mkr.failed.length) { const gp = await geckoPair(client, mint); if (gp) mkr.data[mint] = gp; }
+    await geckoLiquidity(client, mkr.data[mint]);
+  }
   progress(opts.onProgress, "token", 0.45);
   const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
   if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
@@ -49,6 +57,12 @@ export async function analyzeWallet(client, wallet, opts) {
   const mkr = await getMarkets(client, mints, function (d, n) { progress(onProgress, "markets", 0.08 + 0.12 * d / n, { done: d, total: n }); });
   const mk = mkr.data, failedMk = {};
   mkr.failed.forEach(function (m) { failedMk[m] = 1; });
+  // Bonding-curve tokens show $0 liquidity on DexScreener; ask GeckoTerminal for a few (its free API
+  // allows ~30 requests a minute, and wallets full of airdropped spam would use them up)
+  if (!opts.noGecko) {
+    const curve = mints.filter(function (m) { const p = mk[m]; return p && PUMP_CURVE_DEXES.indexOf(p.dexId) >= 0 && !(p.liquidity && p.liquidity.usd); }).slice(0, 10);
+    await pool(curve, 2, async function (m) { await geckoLiquidity(client, mk[m]); });
+  }
 
   const out = [], todo = [];
   mints.forEach(function (m) {