solana-risk-engine 0.4.11 → 0.4.12

package/README.md

@@ -28,7 +28,7 @@ for (const l of r.lights)  // the four traffic lights
 | **Real concentration** | Largest accounts are traced to their owners. Pools and programs are separated from people, so `w1`/`w10` measure *people*, not AMM vaults. |
 | **Inflated liquidity** | DexScreener values both sides of a pool at the pool's price. A pool with 4B of a token against 2 USDC shows "$4,000M liquidity". The engine recomputes it from the real side (USDC/USDT/SOL). It only flags extreme gaps (real side under 5%), because concentrated-liquidity pools are lopsided by nature. |
 | **Unlocked LP** | % of LP locked/burned via RugCheck. It only counts for markets under 90 days old, so veteran tokens don't get false positives, and never while a token is on Pump.fun's bonding curve, where there is no LP to pull. |
-| **Serial creators** | For markets under 7 days: how many other tokens the creator launched in the last 24 h (RugCheck). 2 or more is a warning, 5 or more a red flag. `recentLaunches(client, wallet)` counts the same on chain for the wallet that *paid* a launch, which catches farms that name a fresh creator each time. |
+| **Serial creators** | For markets under 7 days: how many other tokens the creator launched in the last 24 h (RugCheck). 2 or more is a warning, 5 or more a red flag. `recentLaunches(client, wallet)` counts the same on chain for the wallet that *paid* a launch, which catches farms that name a fresh creator each time. When RugCheck has no report yet (it often answers 400 for tokens a few minutes old) the analysis falls back to `chainLaunches(client, mint)`: that count for the first signer of the token's creation transaction. |
 | **Impostors** | Tokens using the symbol or name of a famous token (USDC, JUP, BONK, WIF, BTC, ETH...) with a different address. |
 | **Real brands** | About 320 real companies with no token on Solana (Spotify, Nike, Zara, Ferrari...). A token called just that is a red flag and **HIGH**; the brand as one word of a longer name is a warning. Everyday words that are also brands (Shell, Target, Puma) are left out, and markets at least 30 days old with $100k+ liquidity are not checked. |
 | **Known issuers and official tokens** | Stablecoins from Paxos (PYUSD, USDG), Circle (USDC, EURC) and Tether (USDT), tokenized shares from xStocks (all recognised by their control keys, taken from mints the issuer lists on its own pages) and official tokens from exchanges and Socios.com (bnSOL, bbSOL, cbBTC, club fan tokens..., by mint address) are shown as dependency on the issuer. Their large holders (treasury, custodians, exchanges) are shown but do not count as concentration, a 0% transfer fee is not a warning, and a tiny Solana pool is a warning, not a red flag. A short **trusted** list (Circle, Paxos, Tether, xStocks; `trustedIssuer()`) goes further: every light green, holders not checked. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solana-risk-engine",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
   "type": "module",
   "main": "./src/index.js",

package/src/index.js

@@ -49,7 +49,7 @@ export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf
 export { getMarkets, realLiq, impostorOf, INFLATED_RATIO, geckoLiquidity, geckoPair, brandOf, copiesOf, fakeLiquidity, FAKE_LIQ_RATIO } from "./markets.js";
 export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches, CREATOR_DEAD_MCAP } from "./rugcheck.js";
 export { score, issuerOf, trustedIssuer, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
-export { recentLaunches } from "./launch.js";
+export { recentLaunches, chainLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
 export { holderBase, markBusy, onlyReceives, PASSIVE_SAMPLE, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders,
   perHour, sourceRates, groupList, EXCHANGE_PER_HOUR, YOUNG_DAYS, HOLD_GROUP_YOUNG, HOLD_GROUP_MATURE } from "./holders.js";

package/src/launch.js

@@ -42,3 +42,27 @@ export async function recentLaunches(client, wallet, opts) {
   });
   return { n: mints.length, mints: mints, scanned: day.length, more: sigs.length >= limit && day.length === sigs.length };
 }
+
+/**
+ * The creator's recent launches read on chain, for when RugCheck does not know the token yet (it answers
+ * 400 "unable to generate report" for most tokens a few minutes old, 2026-11-02) or does not answer.
+ * The launcher is the first signer of the token's creation transaction: the wallet that paid, as in
+ * recentLaunches (farms name a fresh creator each time but pay from one wallet). Only new tokens: past
+ * 1000 transactions the creation is too far back to find cheaply.
+ * Same shape as creatorLaunches, without the history of older launches (that needs market caps):
+ * @returns {creator, day, total, old: 0, dead: 0, best: null, chain: true, more} or null
+ */
+export async function chainLaunches(client, mint, opts) {
+  opts = opts || {};
+  const sigs = (await client.rpc("getSignaturesForAddress", [mint, { limit: 1000 }])) || [];
+  if (!sigs.length || sigs.length >= 1000) return null;
+  const p = { encoding: "jsonParsed", maxSupportedTransactionVersion: 1, commitment: "confirmed" };
+  const tx = await client.rpc("getTransaction", [sigs[sigs.length - 1].signature, p]);
+  const keys = tx && tx.transaction && tx.transaction.message && tx.transaction.message.accountKeys;
+  const first = keys && keys.filter(function (k) { return k.signer; })[0];
+  const wallet = first && (first.pubkey || first);
+  if (!wallet || wallet === mint) return null;
+  const r = await recentLaunches(client, wallet, { now: opts.now, limit: opts.limit });
+  const day = r.mints.filter(function (m) { return m !== mint; }).length;
+  return { creator: wallet, day: day, total: day, old: 0, dead: 0, best: null, chain: true, more: r.more };
+}

package/src/risk.js

@@ -4,6 +4,7 @@ import { short, sleep } from "./util.js";
 import { getMint, getAuthKinds, getConc } from "./tokens.js";
 import { impostorOf, brandOf, copiesOf, fakeLiquidity } from "./markets.js";
 import { rugcheckSummary, creatorLaunches } from "./rugcheck.js";
+import { chainLaunches } from "./launch.js";
 
 // Every finding is a "signal": {code, s, data}. `s` is ok | na | warn | bad, `data` holds the numbers
 // behind it. Turning signals into sentences is i18n's job (describe / explainLight), never the engine's.
@@ -264,7 +265,10 @@ export async function assess(client, mint, pair, opts) {
   const rcPromise = pair ? rugcheckSummary(client, mint) : Promise.resolve(null);   // in parallel with the RPC calls below
   // Serial launching only matters while a token is new; RugCheck's full report is small (~10 KB) then
   const fresh = pair && !opts.skipCreator && (!pair.pairCreatedAt || Date.now() - pair.pairCreatedAt < 7 * DAY);
-  const launchPromise = fresh ? creatorLaunches(client, mint) : Promise.resolve(null);
+  // when RugCheck does not know the creator (new tokens often get a 400) the launches are counted on chain
+  const launchPromise = fresh ? creatorLaunches(client, mint).then(function (r) {
+    return r || chainLaunches(client, mint).catch(function (e) { if (isCancel(e)) throw e; return null; });
+  }) : Promise.resolve(null);
   // Copies of the same name and ticker: one search per token, so only when asked (a single token, not a wallet)
   const copiesPromise = pair && opts.copies && !OFFICIAL_TOKENS[mint] ? copiesOf(client, mint, pair).catch(function (e) { if (isCancel(e)) throw e; return null; }) : Promise.resolve(null);
   let info = null, conc = null;