solana-risk-engine 0.4.3 → 0.4.4

package/README.md

@@ -73,7 +73,8 @@ Methods (all accept `{ onProgress(step, fraction) }`):
 | `analyzeToken(mint, { skipCreator })` | `{ lvl, sev, type, lights, reasons, impostor, pair, creator, ... }` |
 | `analyzeWallet(wallet, { minUsd })` | `{ sol, balances, total, hidden, results: [token results] }` |
 | `analyzeAddress(addr)` | `{ kind: "token" \| "wallet", ... }`, detected automatically |
-| `analyzeHolders(mint)` | `{ rows, clusters, groups, hotGroups, creator, mode, ageDays, signals, ... }`. Young tokens (under 14 days) also trace busy wallets; a source over 100 tx/h counts as an exchange; a group over 10% (young) or 15% (mature) of the supply gives a `HOLD_GROUP` signal. Best with your own RPC. |
+| `analyzeHolders(mint)` | `{ rows, clusters, groups, hotGroups, creator, mode, ageDays, signals, ... }`. Young tokens (under 14 days) also trace busy wallets; a source over 100 tx/h counts as an exchange; a group over 10% (young) or 15% (mature) of the supply gives a `HOLD_GROUP` signal. With `{ base: true }` it also reads [SolFlag's wallet base](https://solflag.com/datos/base.json) (exchanges, launch farms, distributors and serial creators its collector has seen): known exchanges are recognised without measuring them, and rows and group sources get `known` / `knownSources`. Best with your own RPC. |
+| `loadWalletBase([url])` | SolFlag's wallet base `{ wallets: { addr: { t, ph, n, roles } } }`, or `null` if it cannot be read. Kept 10 minutes. `knownType(base, addr)` gives a wallet's type. |
 | `estimatePnl(wallets)` | `{ pnl: { [wallet]: { realized, unreal, total, ret, st, open } } }`. Needs Helius. |
 | `takeSnapshots(wallets)` | Today's holdings. Store them yourself and pass them to `diffSnapshots(prev, next)`. |
 | `confluence(wallets, { pct, withPnl, pnlFilter })` | Tokens held in common, with risk. |

package/package.json

@@ -1,47 +1,47 @@
-{
-  "name": "solana-risk-engine",
-  "version": "0.4.3",
-  "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
-  "type": "module",
-  "main": "./src/index.js",
-  "exports": {
-    ".": "./src/index.js",
-    "./i18n": "./src/i18n/index.js"
-  },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "bin"
-  ],
-  "bin": {
-    "solana-risk": "bin/solana-risk.js"
-  },
-  "scripts": {
-    "test": "node --test test/*.test.js",
-    "example": "node bin/solana-risk.js"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "solana",
-    "risk",
-    "rug-pull",
-    "scam-detection",
-    "token",
-    "spl-token",
-    "token-2022",
-    "holders",
-    "dexscreener",
-    "rugcheck"
-  ],
-  "license": "MIT",
-  "author": "panpontomate",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/panpontomate/solana-risk-engine.git"
-  },
-  "homepage": "https://github.com/panpontomate/solana-risk-engine#readme",
-  "bugs": "https://github.com/panpontomate/solana-risk-engine/issues"
-}
+{
+  "name": "solana-risk-engine",
+  "version": "0.4.4",
+  "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./i18n": "./src/i18n/index.js"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "bin"
+  ],
+  "bin": {
+    "solana-risk": "bin/solana-risk.js"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.js",
+    "example": "node bin/solana-risk.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "solana",
+    "risk",
+    "rug-pull",
+    "scam-detection",
+    "token",
+    "spl-token",
+    "token-2022",
+    "holders",
+    "dexscreener",
+    "rugcheck"
+  ],
+  "license": "MIT",
+  "author": "panpontomate",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/panpontomate/solana-risk-engine.git"
+  },
+  "homepage": "https://github.com/panpontomate/solana-risk-engine#readme",
+  "bugs": "https://github.com/panpontomate/solana-risk-engine/issues"
+}

package/src/base.js

@@ -0,0 +1,28 @@
+import { WALLET_BASE_URL } from "./constants.js";
+
+// SolFlag's wallet base: what its collector learns from every launch it checks (exchanges, launch farms,
+// distributors, serial creators), refreshed every 30 minutes. A known exchange is recognised at once,
+// without asking the RPC how many transactions it makes
+
+export const WALLET_TYPES = ["exchange", "granja", "repartidor", "creador en serie", "sniper"];
+const BASE_TTL = 600000;
+const caches = new WeakMap();
+
+// The base, or null when it cannot be read (it is an extra: nothing depends on it). Each client keeps it
+// 10 minutes per URL
+export async function loadWalletBase(client, url) {
+  url = url || WALLET_BASE_URL;
+  if (!caches.has(client)) caches.set(client, {});
+  const cache = caches.get(client), c = cache[url];
+  if (c && Date.now() - c.at < BASE_TTL) return c.data;
+  const j = await client.softJson(url, 8000);
+  const data = j && j.wallets && typeof j.wallets === "object" ? j : null;
+  cache[url] = { at: Date.now(), data: data };
+  return data;
+}
+
+// Type of a wallet in the base ("exchange", "granja"...) or null
+export function knownType(base, addr) {
+  const w = base && base.wallets && base.wallets[addr];
+  return (w && WALLET_TYPES.indexOf(w.t) >= 0) ? w.t : null;
+}

package/src/constants.js

@@ -5,6 +5,8 @@
 export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
 export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
 export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
+// SolFlag's wallet base (see base.js)
+export const WALLET_BASE_URL = "https://solflag.com/datos/base.json";
 export const DEX_SEARCH = "https://api.dexscreener.com/latest/dex/search?q=";
 export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
 export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
@@ -60,6 +62,19 @@ export const BRANDS = {
   adidas: "Adidas", gucci: "Gucci", louis_vuitton: "Louis Vuitton", rolex: "Rolex", spacex: "SpaceX", neuralink: "Neuralink"
 };
 
+// Known issuers of tokenized assets: every key that controls their tokens (mint, freeze, permanent delegate,
+// hook, pause, scaling). A token is theirs only if ALL its control keys are in the list, so copying one key
+// (anyone can hand the mint authority to someone else's wallet) is not enough. Their control is the point of
+// the product: it is shown as dependency on the issuer, not as a creator who can rug
+export const ISSUERS = [
+  { name: "xStocks (Backed)", keys: [
+    "7pt9tkctJPK7PPNQJ77GKg8ZffSF6QxoMiCFYHxrtaCj",   // mint
+    "JDq14BWvqCRFNu1krb12bcRpbGtJZ1FLEakMw6FdxJNs",   // freeze and pause (program)
+    "5aMNNLQJwAEeoemTEMkv5NVjqKwvvefRYCQ5Z67HFvEq",   // permanent delegate, transfer hook, confidential transfers
+    "S7vYFFWH6BjJyEsdrPQpqpYTqLTrPRK6KW3VwsJuRaS"     // share-split multiplier (scaled UI amount)
+  ] }
+];
+
 // Token-2022 extensions that add risk, with the points they add to the no-market spam score
 export const EXT_POINTS = {
   permanentDelegate: 25,

package/src/holders.js

@@ -4,6 +4,7 @@ import { pool, progress, short, uniq } from "./util.js";
 import { getMint, accountKinds } from "./tokens.js";
 import { getMarkets } from "./markets.js";
 import { rugcheckReport, rugcheckGraph, rugcheckSummary, netBalances } from "./rugcheck.js";
+import { loadWalletBase, knownType } from "./base.js";
 
 // Largest accounts of a token, each traced to its owner, and whether each owner is a wallet or a program
 export async function holderBase(client, mint, onProgress) {
@@ -203,6 +204,9 @@ export async function creatorInfo(client, mint, onProgress) {
  * over 10% of the supply in a young token (bad) or 15% in a mature one (warn) is a HOLD_GROUP signal.
  *
  * @param [opts.creator=true]  also look up the creator and insider networks on RugCheck
+ * @param [opts.base]          SolFlag's wallet base: true to load it (solflag.com/datos/base.json), or the base
+ *                             itself. Known exchanges are taken as such without measuring them, and every row
+ *                             it knows gets known: "exchange" | "granja" | "repartidor" | "creador en serie" | "sniper"
  * @param [opts.createdAt]     ms when its market started, if the caller knows it
  * @param [opts.now]
  * @returns {..., mode: "young"|"mature", ageDays, groups, signals}
@@ -215,6 +219,13 @@ export async function analyzeHolders(client, mint, opts) {
   const wal = b.uniq.filter(function (o) { return b.kind[o] === "wallet"; });
   const busy = await markBusy(client, b.kind, wal, function (c, n) { progress(onProgress, "bots", 0.65 + 0.15 * c / Math.max(1, n), { done: c, total: n }); });
   const hr = holderRows(b, busy), pair = b.pair;
+  const base = opts.base === true ? await loadWalletBase(client) : (opts.base || null);
+  hr.rows.forEach(function (r) {
+    const t = knownType(base, r.owner);
+    if (!t) return;
+    r.known = t;
+    if (t === "exchange" && r.kind === "wallet") r.kind = "active";   // quiet hours made it look like a person
+  });
   const now = opts.now || Date.now();
   let created = opts.createdAt || (pair && pair.pairCreatedAt) || null;
   if (!created) {
@@ -234,9 +245,9 @@ export async function analyzeHolders(client, mint, opts) {
     if (srcs.length) {
       // a source is an exchange when it moves more than EXCHANGE_PER_HOUR transactions an hour (the bot
       // test, 200 in 2 days, also caught distributors doing ~50 an hour and hid their groups)
-      const rates = await sourceRates(client, srcs, function (c, n) { progress(onProgress, "exchangeSources", 0.88 + 0.02 * c / Math.max(1, n), { done: c, total: n }); });
-      const hot = {};
-      srcs.forEach(function (f) { if (rates[f] > EXCHANGE_PER_HOUR) hot[f] = true; });
+      const hot = {}, ask = srcs.filter(function (f) { if (knownType(base, f) === "exchange") { hot[f] = true; return false; } return true; });
+      const rates = ask.length ? await sourceRates(client, ask, function (c, n) { progress(onProgress, "exchangeSources", 0.88 + 0.02 * c / Math.max(1, n), { done: c, total: n }); }) : {};
+      ask.forEach(function (f) { if (rates[f] > EXCHANGE_PER_HOUR) hot[f] = true; });
       hotGroups = srcs.filter(function (f) { return hot[f]; }).length;
       if (hotGroups) clusters = clusterByFunder(funders, hot);
     }
@@ -255,6 +266,9 @@ export async function analyzeHolders(client, mint, opts) {
     mint: mint, sym: (pair && pair.baseToken && pair.baseToken.symbol) || short(mint),
     name: (pair && pair.baseToken && pair.baseToken.name) || "", price: hr.price, rows: hr.rows,
     mintAuth: !!b.info.mintAuth, freezeAuth: !!b.info.freezeAuth, clusters: clusters, hotGroups: hotGroups, creator: creator,
-    mode: mode, ageDays: ageDays, groups: groups, signals: signals
+    mode: mode, ageDays: ageDays, groups: groups, signals: signals,
+    // sources of groups the base knows (a known distributor or farm behind a group is worth saying)
+    knownSources: base ? uniq(groups.map(function (g) { return g.funder; })).filter(function (f) { return knownType(base, f); })
+      .reduce(function (o, f) { o[f] = knownType(base, f); return o; }, {}) : {}
   };
 }

package/src/i18n/en.js

@@ -35,6 +35,7 @@ export default {
     CTL_NON_TRANSFERABLE: () => "Cannot be transferred",
     CTL_DEFAULT_FROZEN: () => "New accounts can be created frozen",
     CTL_ONLY_PROGRAMS: () => "Only program-controlled authorities (see dependency)",
+    CTL_KNOWN_ISSUER: (d) => "Controlled by its issuer, " + d.issuer + " (see dependency)",
     CTL_NONE: () => "No active authorities: nobody can mint more or freeze",
     CTL_SERIAL_CREATOR: (d) => "The creator launched " + d.n + " other tokens in the last 24 h (per RugCheck): a serial launcher, who usually drops each token as soon as buyers arrive",
     BRAND_COPY: (d) => "Uses the name of " + d.brand + ", a real company with no token on Solana: it is not official, almost certainly an imitation to draw buyers",
@@ -64,6 +65,7 @@ export default {
     DEP_PROGRAM_AUTHORITY: () => "A program controls the mint or freeze (bridge or protocol): you have to trust its code",
     DEP_PERMANENT_DELEGATE: () => "The issuer can move or burn your tokens (permanent delegate): you trust the issuer",
     DEP_STABLE_ISSUER: () => "Its value depends on whoever issues and backs it",
+    DEP_KNOWN_ISSUER: (d) => "Issued by " + d.issuer + ": it can mint, freeze or move tokens, like any regulated issuer. You trust the issuer",
     DEP_NONE: () => "Does not depend on an issuer or a bridge"
   },
   offSolana: " and its main market may be outside Solana",

package/src/i18n/es.js

@@ -38,6 +38,7 @@ export default {
     CTL_NON_TRANSFERABLE: () => "No se puede transferir",
     CTL_DEFAULT_FROZEN: () => "Las cuentas nuevas pueden crearse congeladas",
     CTL_ONLY_PROGRAMS: () => "Solo hay autoridades controladas por un programa (ver dependencia)",
+    CTL_KNOWN_ISSUER: (d) => "Lo controla su emisor, " + d.issuer + " (ver dependencia)",
     CTL_NONE: () => "Sin autoridades activas: nadie puede crear más ni congelar",
     CTL_SERIAL_CREATOR: (d) => "El creador ha lanzado " + d.n + " tokens más en las últimas 24 h (según RugCheck): es un lanzador en serie, que suele abandonar cada token en cuanto llegan compradores",
     BRAND_COPY: (d) => "Usa el nombre de " + d.brand + ", una empresa real que no tiene token en Solana: no es oficial, casi seguro una imitación para atraer compradores",
@@ -67,6 +68,7 @@ export default {
     DEP_PROGRAM_AUTHORITY: () => "Un programa controla el mint o el freeze (puente o protocolo): hay que confiar en su código",
     DEP_PERMANENT_DELEGATE: () => "El emisor puede mover o quemar tus tokens (delegado permanente): confías en el emisor",
     DEP_STABLE_ISSUER: () => "Su valor depende de quien la emite y la respalda",
+    DEP_KNOWN_ISSUER: (d) => "Lo emite " + d.issuer + ": puede crear, congelar o mover tokens, como cualquier emisor regulado. Confías en el emisor",
     DEP_NONE: () => "No depende de un emisor ni de un puente"
   },
   offSolana: " y su mercado principal puede estar fuera de Solana",

package/src/index.js

@@ -5,6 +5,7 @@ import { estimatePnl } from "./pnl.js";
 import { takeSnapshots } from "./changes.js";
 import { confluence, commonHolders } from "./confluence.js";
 import { getTokens } from "./tokens.js";
+import { loadWalletBase } from "./base.js";
 
 /**
  * The easy entry point: one object with every high-level analysis bound to one network client.
@@ -35,7 +36,8 @@ export function createScanner(opts) {
     },
     takeSnapshots: (wallets, o) => takeSnapshots(client, wallets, o),
     confluence: (wallets, o) => confluence(client, wallets, o),
-    commonHolders: (mints, o) => commonHolders(client, mints, o)
+    commonHolders: (mints, o) => commonHolders(client, mints, o),
+    loadWalletBase: (url) => loadWalletBase(client, url)
   };
 }
 
@@ -46,7 +48,7 @@ export { isOnCurve, onCurve, b58bytes } from "./curve.js";
 export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf } from "./tokens.js";
 export { getMarkets, realLiq, impostorOf, INFLATED_RATIO, geckoLiquidity, geckoPair, brandOf, copiesOf, fakeLiquidity, FAKE_LIQ_RATIO } from "./markets.js";
 export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches, CREATOR_DEAD_MCAP } from "./rugcheck.js";
-export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
+export { score, issuerOf, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
 export { recentLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
 export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders,
@@ -54,4 +56,5 @@ export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderR
 export { fetchSwaps, solHistory, priceSeries, parseTrades, pnlFromTrades, pnlStatus, estimatePnl } from "./pnl.js";
 export { capSnap, chgDiff, chgAgg, takeSnapshots, diffSnapshots } from "./changes.js";
 export { confluence, commonHolders } from "./confluence.js";
+export { loadWalletBase, knownType, WALLET_TYPES } from "./base.js";
 export { describe, explainLight, lightLabel, levelLabel, missingText, typeInfo, describeStep, describeNote, describeError, format, addLanguage } from "./i18n/index.js";

package/src/risk.js

@@ -1,4 +1,4 @@
-import { EXT_POINTS, RANKS, PUMP_CURVE_DEXES } from "./constants.js";
+import { EXT_POINTS, RANKS, PUMP_CURVE_DEXES, ISSUERS } from "./constants.js";
 import { isCancel } from "./errors.js";
 import { short, sleep } from "./util.js";
 import { getMint, getAuthKinds, getConc } from "./tokens.js";
@@ -16,8 +16,10 @@ function sig(code, s, data) {
 const DAY = 86400000;
 // Other tokens launched by the same creator in the last 24 h that make it a serial launcher
 export const SERIAL_WARN = 2, SERIAL_BAD = 5;
-// Creator track record: at least HISTORY_MIN older tokens and this share of them never took off
-export const HISTORY_MIN = 3, HISTORY_WARN = 0.8, HISTORY_BAD_MIN = 10, HISTORY_BAD = 0.9;
+// Creator track record: at least HISTORY_MIN older tokens and this share of them never took off. Red needs
+// 95%: 86% of all new tokens never reach $10k (149-token sample, 28/10), so one launch that took off out of
+// ten is already better than chance and must not raise the verdict
+export const HISTORY_MIN = 3, HISTORY_WARN = 0.8, HISTORY_BAD_MIN = 10, HISTORY_BAD = 0.95;
 
 /* ---------- old point score: only for tokens without a market, to spot spam ---------- */
 export function score(info) {
@@ -58,6 +60,23 @@ export function tokenType(info, pair, now) {
   return "OPEN";
 }
 
+/* ---------- known issuers ---------- */
+// Name of the known issuer that holds every control key of this mint, or null. Needs the extension keys
+// read by getMint (extKeys): without them a permanent delegate or a hook could belong to anyone
+export function issuerOf(info) {
+  if (!info || !info.extKeys) return null;
+  const keys = [info.mintAuth, info.freezeAuth].concat(info.extKeys).filter(Boolean);
+  if (!keys.length) return null;
+  const found = ISSUERS.find(function (i) { return keys.every(function (k) { return i.keys.indexOf(k) >= 0; }); });
+  return found ? found.name : null;
+}
+
+// Extensions that only matter as they are set: a hook with no program and nobody able to add one does
+// nothing, and new accounts are only born frozen when the default state says "frozen". Mint info without
+// those details (older callers) keeps the old behaviour: the extension alone is enough
+function hookActive(info) { return !info.hook || !!(info.hook.program || info.hook.auth); }
+function bornFrozen(info) { return !info.defaultState || info.defaultState === "frozen"; }
+
 /* ---------- the four traffic lights ---------- */
 function mkLight(k, items, okSignal) {
   if (!items.length) return { k: k, s: "ok", items: [okSignal] };
@@ -81,18 +100,22 @@ function mkLight(k, items, okSignal) {
 export function buildLights(info, conc, pair, value, type, rc, now, launches) {
   now = now || Date.now();
   const ak = (info && info.authKind) || {};
+  const issuer = issuerOf(info);
   let it;
 
   // 1) creator control
   it = [];
   if (!info) it.push(sig("NO_INFO", "warn"));
   else {
-    if (info.mintAuth && ak[info.mintAuth] !== "program") it.push(sig("CTL_MINT_ACTIVE", "bad"));
-    if (info.freezeAuth && ak[info.freezeAuth] !== "program") it.push(sig("CTL_FREEZE_ACTIVE", "warn"));
-    if (info.ext.indexOf("transferHook") >= 0) it.push(sig("CTL_TRANSFER_HOOK", "warn"));
+    // a known issuer's mint, freeze, hook and pause are how the product works (see dependency)
+    if (!issuer) {
+      if (info.mintAuth && ak[info.mintAuth] !== "program") it.push(sig("CTL_MINT_ACTIVE", "bad"));
+      if (info.freezeAuth && ak[info.freezeAuth] !== "program") it.push(sig("CTL_FREEZE_ACTIVE", "warn"));
+      if (info.ext.indexOf("transferHook") >= 0 && hookActive(info)) it.push(sig("CTL_TRANSFER_HOOK", "warn"));
+      if (info.ext.indexOf("defaultAccountState") >= 0 && bornFrozen(info)) it.push(sig("CTL_DEFAULT_FROZEN", "warn"));
+    }
     if (info.ext.indexOf("transferFeeConfig") >= 0) it.push(sig("CTL_TRANSFER_FEE", "warn"));
     if (info.ext.indexOf("nonTransferable") >= 0) it.push(sig("CTL_NON_TRANSFERABLE", "warn"));
-    if (info.ext.indexOf("defaultAccountState") >= 0) it.push(sig("CTL_DEFAULT_FROZEN", "warn"));
   }
   // Launch farms put out a token every few minutes and drop each one as soon as buyers arrive: in a
   // 100-token Pump.fun sample one wallet launched 7 copies of "GMS" in 10 minutes
@@ -102,7 +125,8 @@ export function buildLights(info, conc, pair, value, type, rc, now, launches) {
     const bad = launches.old >= HISTORY_BAD_MIN && launches.dead / launches.old >= HISTORY_BAD;
     it.push(sig("CTL_CREATOR_HISTORY", bad ? "bad" : "warn", { old: launches.old, dead: launches.dead, best: launches.best, creator: launches.creator }));
   }
-  const control = mkLight("control", it, sig((info && (info.mintAuth || info.freezeAuth)) ? "CTL_ONLY_PROGRAMS" : "CTL_NONE", "ok"));
+  const control = mkLight("control", it, issuer ? sig("CTL_KNOWN_ISSUER", "ok", { issuer: issuer })
+    : sig((info && (info.mintAuth || info.freezeAuth)) ? "CTL_ONLY_PROGRAMS" : "CTL_NONE", "ok"));
 
   // 2) concentration in people (pools and programs do not count)
   let concentration;
@@ -150,7 +174,8 @@ export function buildLights(info, conc, pair, value, type, rc, now, launches) {
 
   // 4) dependency on an issuer or a bridge
   it = [];
-  if (info) {
+  if (issuer) it.push(sig("DEP_KNOWN_ISSUER", "warn", { issuer: issuer }));
+  else if (info) {
     if ((info.mintAuth && ak[info.mintAuth] === "program") || (info.freezeAuth && ak[info.freezeAuth] === "program"))
       it.push(sig("DEP_PROGRAM_AUTHORITY", "warn"));
     if (info.ext.indexOf("permanentDelegate") >= 0) it.push(sig("DEP_PERMANENT_DELEGATE", "warn"));

package/src/tokens.js

@@ -34,13 +34,33 @@ export async function getMint(client, mint) {
   const r = await client.rpc("getAccountInfo", [mint, { encoding: "jsonParsed" }]);
   const p = r && r.value && r.value.data && r.value.data.parsed && r.value.data.parsed.info;
   if (!p) return null;
+  const exts = p.extensions || [];
+  const state = function (name) { const e = exts.find(function (x) { return x.extension === name; }); return (e && e.state) || {}; };
+  const hook = state("transferHook");
   return {
     mintAuth: p.mintAuthority || null, freezeAuth: p.freezeAuthority || null,
     supply: Number(p.supply || 0), decimals: Number(p.decimals || 0),
-    ext: (p.extensions || []).map(function (e) { return e.extension; })
+    ext: exts.map(function (e) { return e.extension; }),
+    // what the extensions are set to: a transfer hook with no program and no authority does nothing, and
+    // "default account state" only matters when new accounts are born frozen
+    hook: { program: hook.programId || null, auth: hook.authority || null },
+    defaultState: state("defaultAccountState").accountState || null,
+    // every key that controls something in the extensions (delegate, hook, pause, metadata...)
+    extKeys: extKeys(exts)
   };
 }
 
+function extKeys(exts) {
+  const out = [];
+  exts.forEach(function (e) {
+    Object.keys(e.state || {}).forEach(function (k) {
+      const v = e.state[k];
+      if (typeof v === "string" && /authority$|^delegate$|^programId$/i.test(k) && out.indexOf(v) < 0) out.push(v);
+    });
+  });
+  return out;
+}
+
 // A key off the ed25519 curve has no private key: only a program can sign for it (a PDA), whoever
 // owns its account. PDAs that hold SOL (stake pool and AMM authorities) are owned by the System
 // Program like any wallet, so the owner alone would count them as people.