solana-risk-engine 0.3.1 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solana-risk-engine",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
   "type": "module",
   "main": "./src/index.js",

package/src/i18n/en.js

@@ -37,6 +37,7 @@ export default {
     CTL_ONLY_PROGRAMS: () => "Only program-controlled authorities (see dependency)",
     CTL_NONE: () => "No active authorities: nobody can mint more or freeze",
     CTL_SERIAL_CREATOR: (d) => "The creator launched " + d.n + " other tokens in the last 24 h (per RugCheck): a serial launcher, who usually drops each token as soon as buyers arrive",
+    CTL_CREATOR_HISTORY: (d) => "Of the " + d.old + " tokens the creator launched before (over 24 h ago), " + d.dead + " stayed under $10,000 market cap (per RugCheck): their launches rarely take off",
     IMPOSTOR: (d) => "Impersonates " + d.symbol + ": the real " + d.symbol + " has another address (" + short(d.real) + "). It is a copy, almost certainly a scam",
 
     CON_SKIPPED: () => "Holder concentration not checked",

package/src/i18n/es.js

@@ -40,6 +40,7 @@ export default {
     CTL_ONLY_PROGRAMS: () => "Solo hay autoridades controladas por un programa (ver dependencia)",
     CTL_NONE: () => "Sin autoridades activas: nadie puede crear más ni congelar",
     CTL_SERIAL_CREATOR: (d) => "El creador ha lanzado " + d.n + " tokens más en las últimas 24 h (según RugCheck): es un lanzador en serie, que suele abandonar cada token en cuanto llegan compradores",
+    CTL_CREATOR_HISTORY: (d) => "De los " + d.old + " tokens que el creador lanzó antes (hace más de 24 h), " + d.dead + " se quedaron por debajo de 10.000 $ de capitalización (según RugCheck): sus lanzamientos no suelen despegar",
     IMPOSTOR: (d) => "Se hace pasar por " + d.symbol + ": el " + d.symbol + " de verdad tiene otra dirección (" + short(d.real) + "). Es una copia, casi seguro una estafa",
 
     CON_SKIPPED: () => "Sin comprobar la concentración de holders",

package/src/index.js

@@ -45,8 +45,8 @@ export * from "./constants.js";
 export { isOnCurve, onCurve, b58bytes } from "./curve.js";
 export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf } from "./tokens.js";
 export { getMarkets, realLiq, impostorOf, INFLATED_RATIO, geckoLiquidity, geckoPair } from "./markets.js";
-export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches } from "./rugcheck.js";
-export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD } from "./risk.js";
+export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches, CREATOR_DEAD_MCAP } from "./rugcheck.js";
+export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
 export { recentLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
 export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders } from "./holders.js";

package/src/risk.js

@@ -16,6 +16,8 @@ function sig(code, s, data) {
 const DAY = 86400000;
 // Other tokens launched by the same creator in the last 24 h that make it a serial launcher
 export const SERIAL_WARN = 2, SERIAL_BAD = 5;
+// Creator track record: at least HISTORY_MIN older tokens and this share of them never took off
+export const HISTORY_MIN = 3, HISTORY_WARN = 0.8, HISTORY_BAD_MIN = 10, HISTORY_BAD = 0.9;
 
 /* ---------- old point score: only for tokens without a market, to spot spam ---------- */
 export function score(info) {
@@ -73,7 +75,7 @@ function mkLight(k, items, okSignal) {
  * @param value  USD value the analysed wallet holds (0 when checking a token alone)
  * @param type   tokenType(info, pair)
  * @param rc     RugCheck summary or null
- * @param launches  creatorLaunches result or null: other tokens the creator launched in the last 24 h
+ * @param launches  creatorLaunches result or null: what else the creator launched (last 24 h, and how older ones did)
  * @returns      [control, concentration, market, dependency]
  */
 export function buildLights(info, conc, pair, value, type, rc, now, launches) {
@@ -95,6 +97,11 @@ export function buildLights(info, conc, pair, value, type, rc, now, launches) {
   // Launch farms put out a token every few minutes and drop each one as soon as buyers arrive: in a
   // 100-token Pump.fun sample one wallet launched 7 copies of "GMS" in 10 minutes
   if (launches && launches.day >= SERIAL_WARN) it.push(sig("CTL_SERIAL_CREATOR", launches.day >= SERIAL_BAD ? "bad" : "warn", { n: launches.day, creator: launches.creator }));
+  // Older launches that went nowhere: farms that spread their tokens over days escape the 24 h count
+  if (launches && launches.old >= HISTORY_MIN && launches.dead / launches.old >= HISTORY_WARN) {
+    const bad = launches.old >= HISTORY_BAD_MIN && launches.dead / launches.old >= HISTORY_BAD;
+    it.push(sig("CTL_CREATOR_HISTORY", bad ? "bad" : "warn", { old: launches.old, dead: launches.dead, best: launches.best, creator: launches.creator }));
+  }
   const control = mkLight("control", it, sig((info && (info.mintAuth || info.freezeAuth)) ? "CTL_ONLY_PROGRAMS" : "CTL_NONE", "ok"));
 
   // 2) concentration in people (pools and programs do not count)

package/src/rugcheck.js

@@ -7,8 +7,22 @@ import { pool } from "./util.js";
 // which on-chain data does not show without decoding each DEX's binary layout (Raydium, Orca, Meteora
 // and pump.fun all differ). It is an extra, never a requirement: on failure these return null and the
 // rest of the analysis is exactly the same.
-export function rugcheckSummary(client, mint) {
-  return client.softJson(RUGCHECK + mint + "/report/summary", 6000);
+// RugCheck sometimes answers lpLockedPct 0 for a pool that is ~100% locked (5 of 40 calls on a
+// Raydium CPMM token, 2026-10-26; a watched token flipped high/medium every check). A low value is
+// therefore asked again up to twice and the highest answer wins: a pool that really is unlocked
+// reads low every time, so only the false alarm goes away.
+export const LP_RECHECK_BELOW = 60;
+export async function rugcheckSummary(client, mint) {
+  const url = RUGCHECK + mint + "/report/summary";
+  let best = await client.softJson(url, 6000);
+  for (let i = 0; i < 2 && lowLp(best); i++) {
+    const again = await client.softJson(url, 6000);
+    if (again && typeof again.lpLockedPct === "number" && again.lpLockedPct > best.lpLockedPct) best = again;
+  }
+  return best;
+}
+function lowLp(rc) {
+  return !!rc && typeof rc.lpLockedPct === "number" && rc.lpLockedPct < LP_RECHECK_BELOW;
 }
 
 // Full report (~700 KB, so ask once per holder search, never per token of a wallet): who created the
@@ -18,16 +32,27 @@ export function rugcheckReport(client, mint) {
   return client.softJson(RUGCHECK + mint + "/report", 10000);
 }
 
-// How many other tokens the creator launched in the last 24 h. Only for new tokens: their full report
+// A creator token older than a day still under this market cap never took off: a Pump.fun token
+// starts at ~28 SOL (~$2,800 at $100/SOL). In a 43-token farm (2026-10-27) all sat at $2,800-4,400
+export const CREATOR_DEAD_MCAP = 10000;
+
+// What else the creator launched: how many in the last 24 h and, of the older ones RugCheck has a
+// market cap for, how many stayed under CREATOR_DEAD_MCAP. Only for new tokens: their full report
 // is ~10 KB (the 700 KB ones are old tokens with many markets and holders).
-// @returns {creator, day, total} or null when RugCheck does not answer or does not know the creator
+// @returns {creator, day, total, old, dead, best} or null when RugCheck does not answer or does not know the creator
 export async function creatorLaunches(client, mint, now) {
   const rc = await rugcheckReport(client, mint);
   if (!rc || !rc.creator) return null;
   now = now || Date.now();
   const others = (rc.creatorTokens || []).filter(function (t) { return t && t.mint !== mint; });
   const day = others.filter(function (t) { const at = Date.parse(t.createdAt); return at && now - at < 86400000; }).length;
-  return { creator: rc.creator, day: day, total: others.length };
+  const old = others.filter(function (t) {
+    const at = Date.parse(t.createdAt);
+    return at && now - at >= 86400000 && typeof t.marketCap === "number" && isFinite(t.marketCap);
+  });
+  const dead = old.filter(function (t) { return t.marketCap < CREATOR_DEAD_MCAP; }).length;
+  const best = old.reduce(function (m, t) { return Math.max(m, t.marketCap); }, 0);
+  return { creator: rc.creator, day: day, total: others.length, old: old.length, dead: dead, best: old.length ? best : null };
 }
 
 // The report only gives each network's size; this endpoint gives its wallets and holdings