solana-risk-engine 0.4.2 → 0.4.4

package/src/tokens.js

@@ -34,13 +34,33 @@ export async function getMint(client, mint) {
   const r = await client.rpc("getAccountInfo", [mint, { encoding: "jsonParsed" }]);
   const p = r && r.value && r.value.data && r.value.data.parsed && r.value.data.parsed.info;
   if (!p) return null;
+  const exts = p.extensions || [];
+  const state = function (name) { const e = exts.find(function (x) { return x.extension === name; }); return (e && e.state) || {}; };
+  const hook = state("transferHook");
   return {
     mintAuth: p.mintAuthority || null, freezeAuth: p.freezeAuthority || null,
     supply: Number(p.supply || 0), decimals: Number(p.decimals || 0),
-    ext: (p.extensions || []).map(function (e) { return e.extension; })
+    ext: exts.map(function (e) { return e.extension; }),
+    // what the extensions are set to: a transfer hook with no program and no authority does nothing, and
+    // "default account state" only matters when new accounts are born frozen
+    hook: { program: hook.programId || null, auth: hook.authority || null },
+    defaultState: state("defaultAccountState").accountState || null,
+    // every key that controls something in the extensions (delegate, hook, pause, metadata...)
+    extKeys: extKeys(exts)
   };
 }
 
+function extKeys(exts) {
+  const out = [];
+  exts.forEach(function (e) {
+    Object.keys(e.state || {}).forEach(function (k) {
+      const v = e.state[k];
+      if (typeof v === "string" && /authority$|^delegate$|^programId$/i.test(k) && out.indexOf(v) < 0) out.push(v);
+    });
+  });
+  return out;
+}
+
 // A key off the ed25519 curve has no private key: only a program can sign for it (a PDA), whoever
 // owns its account. PDAs that hold SOL (stake pool and AMM authorities) are owned by the System
 // Program like any wallet, so the owner alone would count them as people.

package/src/wallet.js

@@ -1,94 +1,94 @@
-import { ADDRESS_RE, KNOWN, LEVELS, PUMP_CURVE_DEXES } from "./constants.js";
-import { ScanError } from "./errors.js";
-import { pool, progress } from "./util.js";
-import { getTokens, isMint } from "./tokens.js";
-import { getMarkets, geckoLiquidity, geckoPair } from "./markets.js";
-import { assess } from "./risk.js";
-
-function checkAddress(addr) {
-  if (!ADDRESS_RE.test(addr || "")) throw new ScanError("INVALID_ADDRESS", "not a Solana address");
-}
-
-export function sortResults(list) {
-  return list.sort(function (a, b) {
-    return LEVELS.indexOf(a.lvl) - LEVELS.indexOf(b.lvl) || (b.sev || 0) - (a.sev || 0) || b.pts - a.pts || b.value - a.value;
-  });
-}
-
-/**
- * Risk of a single token. Throws IS_NFT for NFTs.
- * @param [opts.noGecko]  do not fill DexScreener's Pump.fun gaps from GeckoTerminal (also for analyzeWallet)
- */
-export async function analyzeToken(client, mint, opts) {
-  opts = opts || {};
-  checkAddress(mint);
-  progress(opts.onProgress, "markets", 0.15);
-  const mkr = await getMarkets(client, [mint]);
-  // Pump.fun gaps in DexScreener: not listed yet (seconds old) or $0 liquidity on the bonding curve
-  if (!opts.noGecko) {
-    if (!mkr.data[mint] && !mkr.failed.length) { const gp = await geckoPair(client, mint); if (gp) mkr.data[mint] = gp; }
-    await geckoLiquidity(client, mkr.data[mint]);
-  }
-  progress(opts.onProgress, "token", 0.45);
-  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
-  if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
-  progress(opts.onProgress, "done", 1);
-  return r;
-}
-
-/**
- * Risk of every token a wallet holds.
- *
- * @param [opts.minUsd=1]      hide priced tokens worth less than this (dust)
- * @param [opts.concurrency=3]
- * @returns {wallet, sol, balances, total, hidden, results}
- */
-export async function analyzeWallet(client, wallet, opts) {
-  opts = opts || {};
-  checkAddress(wallet);
-  const minUsd = opts.minUsd === undefined ? 1 : opts.minUsd;
-  const onProgress = opts.onProgress;
-  progress(onProgress, "wallet", 0.02);
-  const w = await getTokens(client, wallet);
-  const mints = Object.keys(w.tokens);
-  const res = { wallet: wallet, sol: w.sol, balances: w.tokens, total: mints.length, hidden: 0, results: [] };
-  if (!mints.length) return res;
-  progress(onProgress, "markets", 0.08);
-  const mkr = await getMarkets(client, mints, function (d, n) { progress(onProgress, "markets", 0.08 + 0.12 * d / n, { done: d, total: n }); });
-  const mk = mkr.data, failedMk = {};
-  mkr.failed.forEach(function (m) { failedMk[m] = 1; });
-  // Bonding-curve tokens show $0 liquidity on DexScreener; ask GeckoTerminal for a few (its free API
-  // allows ~30 requests a minute, and wallets full of airdropped spam would use them up)
-  if (!opts.noGecko) {
-    const curve = mints.filter(function (m) { const p = mk[m]; return p && PUMP_CURVE_DEXES.indexOf(p.dexId) >= 0 && !(p.liquidity && p.liquidity.usd); }).slice(0, 10);
-    await pool(curve, 2, async function (m) { await geckoLiquidity(client, mk[m]); });
-  }
-
-  const out = [], todo = [];
-  mints.forEach(function (m) {
-    const pair = mk[m], price = Number((pair && pair.priceUsd) || 0);
-    let value = w.tokens[m] * price;
-    if (pair && pair.liqRaw) value = Math.min(value, pair.liquidity.usd);   // with inflated liquidity the price is fake too
-    if (KNOWN[m]) { out.push({ mint: m, sym: KNOWN[m], name: "", pts: 0, sev: 0, lvl: "LOW", known: true, type: null, lights: null, reasons: [{ code: "KNOWN_TOKEN", s: "ok" }], value: value, pair: pair, img: null }); return; }
-    if (price > 0 && value < minUsd) { res.hidden++; return; }
-    todo.push({ mint: m, pair: pair, value: value, unknown: !!failedMk[m] });
-  });
-
-  let done = 0;
-  await pool(todo, opts.concurrency || 3, async function (t) {
-    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
-    if (r) out.push(r);
-    done++;
-    progress(onProgress, "tokens", 0.2 + 0.8 * done / Math.max(1, todo.length), { done: done, total: todo.length });
-  });
-  res.results = sortResults(out);
-  return res;
-}
-
-/** Detects whether the address is a token mint or a wallet and analyses it accordingly. */
-export async function analyzeAddress(client, addr, opts) {
-  checkAddress(addr);
-  progress(opts && opts.onProgress, "address", 0.01);
-  if (await isMint(client, addr)) return { kind: "token", token: await analyzeToken(client, addr, opts) };
-  return { kind: "wallet", wallet: await analyzeWallet(client, addr, opts) };
-}
+import { ADDRESS_RE, KNOWN, LEVELS, PUMP_CURVE_DEXES } from "./constants.js";
+import { ScanError } from "./errors.js";
+import { pool, progress } from "./util.js";
+import { getTokens, isMint } from "./tokens.js";
+import { getMarkets, geckoLiquidity, geckoPair } from "./markets.js";
+import { assess } from "./risk.js";
+
+function checkAddress(addr) {
+  if (!ADDRESS_RE.test(addr || "")) throw new ScanError("INVALID_ADDRESS", "not a Solana address");
+}
+
+export function sortResults(list) {
+  return list.sort(function (a, b) {
+    return LEVELS.indexOf(a.lvl) - LEVELS.indexOf(b.lvl) || (b.sev || 0) - (a.sev || 0) || b.pts - a.pts || b.value - a.value;
+  });
+}
+
+/**
+ * Risk of a single token. Throws IS_NFT for NFTs.
+ * @param [opts.noGecko]  do not fill DexScreener's Pump.fun gaps from GeckoTerminal (also for analyzeWallet)
+ */
+export async function analyzeToken(client, mint, opts) {
+  opts = opts || {};
+  checkAddress(mint);
+  progress(opts.onProgress, "markets", 0.15);
+  const mkr = await getMarkets(client, [mint]);
+  // Pump.fun gaps in DexScreener: not listed yet (seconds old) or $0 liquidity on the bonding curve
+  if (!opts.noGecko) {
+    if (!mkr.data[mint] && !mkr.failed.length) { const gp = await geckoPair(client, mint); if (gp) mkr.data[mint] = gp; }
+    await geckoLiquidity(client, mkr.data[mint]);
+  }
+  progress(opts.onProgress, "token", 0.45);
+  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator, copies: opts.copies !== false });
+  if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
+  progress(opts.onProgress, "done", 1);
+  return r;
+}
+
+/**
+ * Risk of every token a wallet holds.
+ *
+ * @param [opts.minUsd=1]      hide priced tokens worth less than this (dust)
+ * @param [opts.concurrency=3]
+ * @returns {wallet, sol, balances, total, hidden, results}
+ */
+export async function analyzeWallet(client, wallet, opts) {
+  opts = opts || {};
+  checkAddress(wallet);
+  const minUsd = opts.minUsd === undefined ? 1 : opts.minUsd;
+  const onProgress = opts.onProgress;
+  progress(onProgress, "wallet", 0.02);
+  const w = await getTokens(client, wallet);
+  const mints = Object.keys(w.tokens);
+  const res = { wallet: wallet, sol: w.sol, balances: w.tokens, total: mints.length, hidden: 0, results: [] };
+  if (!mints.length) return res;
+  progress(onProgress, "markets", 0.08);
+  const mkr = await getMarkets(client, mints, function (d, n) { progress(onProgress, "markets", 0.08 + 0.12 * d / n, { done: d, total: n }); });
+  const mk = mkr.data, failedMk = {};
+  mkr.failed.forEach(function (m) { failedMk[m] = 1; });
+  // Bonding-curve tokens show $0 liquidity on DexScreener; ask GeckoTerminal for a few (its free API
+  // allows ~30 requests a minute, and wallets full of airdropped spam would use them up)
+  if (!opts.noGecko) {
+    const curve = mints.filter(function (m) { const p = mk[m]; return p && PUMP_CURVE_DEXES.indexOf(p.dexId) >= 0 && !(p.liquidity && p.liquidity.usd); }).slice(0, 10);
+    await pool(curve, 2, async function (m) { await geckoLiquidity(client, mk[m]); });
+  }
+
+  const out = [], todo = [];
+  mints.forEach(function (m) {
+    const pair = mk[m], price = Number((pair && pair.priceUsd) || 0);
+    let value = w.tokens[m] * price;
+    if (pair && pair.liqRaw) value = Math.min(value, pair.liquidity.usd);   // with inflated liquidity the price is fake too
+    if (KNOWN[m]) { out.push({ mint: m, sym: KNOWN[m], name: "", pts: 0, sev: 0, lvl: "LOW", known: true, type: null, lights: null, reasons: [{ code: "KNOWN_TOKEN", s: "ok" }], value: value, pair: pair, img: null }); return; }
+    if (price > 0 && value < minUsd) { res.hidden++; return; }
+    todo.push({ mint: m, pair: pair, value: value, unknown: !!failedMk[m] });
+  });
+
+  let done = 0;
+  await pool(todo, opts.concurrency || 3, async function (t) {
+    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
+    if (r) out.push(r);
+    done++;
+    progress(onProgress, "tokens", 0.2 + 0.8 * done / Math.max(1, todo.length), { done: done, total: todo.length });
+  });
+  res.results = sortResults(out);
+  return res;
+}
+
+/** Detects whether the address is a token mint or a wallet and analyses it accordingly. */
+export async function analyzeAddress(client, addr, opts) {
+  checkAddress(addr);
+  progress(opts && opts.onProgress, "address", 0.01);
+  if (await isMint(client, addr)) return { kind: "token", token: await analyzeToken(client, addr, opts) };
+  return { kind: "wallet", wallet: await analyzeWallet(client, addr, opts) };
+}