solana-risk-engine 0.4.3 → 0.4.5

package/src/constants.js

@@ -1,78 +1,179 @@
-// api.mainnet-beta.solana.com answers 403 to anything coming from a browser. PublicNode serves almost
-// everything (accounts, signatures, transactions) quickly, but blocks token-by-owner and largest-holder
-// queries. Those go to Solana Vibe Station, which accepts them without a key but only at ~1 per second,
-// so they go through a queue (see client.js). With your own RPC URL everything goes to that URL.
-export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
-export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
-export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
-export const DEX_SEARCH = "https://api.dexscreener.com/latest/dex/search?q=";
-export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
-export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
-export const HELIUS_API = "https://api.helius.xyz/v0/addresses/";
-export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/market_chart?vs_currency=usd&days=365";
-
-export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-export const TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
-export const SYSTEM_PROGRAM = "11111111111111111111111111111111";
-export const PUMP_PROGRAM = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P";
-// dexId of a token still on Pump.fun's bonding curve: DexScreener says "pumpfun", GeckoTerminal "pump-fun"
-export const PUMP_CURVE_DEXES = ["pumpfun", "pump-fun"];
-
-export const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
-export const USDT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
-export const WSOL = "So11111111111111111111111111111111111111112";
-
-export const KNOWN = {
-  [WSOL]: "SOL (wrapped)",
-  [USDC]: "USDC",
-  [USDT]: "USDT"
-};
-
-// Symbols that scams usually copy, with their official address (checked on DexScreener)
-export const FAMOUS = {
-  USDC, USDT, SOL: WSOL, WSOL,
-  JUP: "JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN", BONK: "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
-  WIF: "EKpQGSJtjMFqKZ9KQanSqYXRcF8fBopzLHYxdM65zcjm", PYTH: "HZ1JovNiVvGrGNiiYvEozEVgZ58xaU3RKwX8eACQBCt3",
-  JTO: "jtojtomepa8beP8AuQc6eXt5FriJwfFMwQx2v2f9mCL", RAY: "4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R",
-  PYUSD: "2b1kV6DkPAnxd5ixfnxCpjxmKwqjjaYmCZfHsFu24GXo", MSOL: "mSoLzYCxHdYgdzU16g5QSh3i5K3z3KZK7ytfqcJm7So",
-  JITOSOL: "J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn", TRUMP: "6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN",
-  PUMP: "pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn", JLP: "27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4",
-  POPCAT: "7GCihgDB8fe6KNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr", HNT: "hntyVP6YFm1Hg25TN9WGLqM12b8TQmcknKrdu1oxWux",
-  RENDER: "rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof", ORCA: "orcaEKTdK7LKz57vaAYr9QeNsVEPfiu6QeMU1kektZE",
-  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7",
-  // Bitcoin and Ether only exist on Solana bridged: a Pump.fun token called "BTC" is never the real one
-  BTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh", WBTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh",
-  ETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs", WETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs"
-};
-
-// Real companies with no token of their own on Solana: a memecoin called "Spotify" is not Spotify. Their
-// genuine tokenized shares come from an issuer (xStocks, Backpack...) and are typed TOKENIZED, so they
-// are never matched. Names only, lower case: stock tickers clash with real crypto symbols (META, COIN...)
-export const BRANDS = {
-  spotify: "Spotify", shopify: "Shopify", tesla: "Tesla", apple: "Apple", nvidia: "Nvidia", amazon: "Amazon",
-  google: "Google", alphabet: "Alphabet", microsoft: "Microsoft", facebook: "Facebook", instagram: "Instagram",
-  whatsapp: "WhatsApp", netflix: "Netflix", coinbase: "Coinbase", robinhood: "Robinhood", gamestop: "GameStop",
-  microstrategy: "MicroStrategy", paypal: "PayPal", visa: "Visa", mastercard: "Mastercard", nike: "Nike",
-  disney: "Disney", starbucks: "Starbucks", mcdonalds: "McDonald's", walmart: "Walmart", uber: "Uber",
-  airbnb: "Airbnb", tiktok: "TikTok", youtube: "YouTube", openai: "OpenAI", chatgpt: "ChatGPT", blackrock: "BlackRock",
-  jpmorgan: "JPMorgan", samsung: "Samsung", sony: "Sony", nintendo: "Nintendo", playstation: "PlayStation",
-  ferrari: "Ferrari", lamborghini: "Lamborghini", "red bull": "Red Bull", "coca cola": "Coca-Cola", pepsi: "Pepsi",
-  adidas: "Adidas", gucci: "Gucci", louis_vuitton: "Louis Vuitton", rolex: "Rolex", spacex: "SpaceX", neuralink: "Neuralink"
-};
-
-// Token-2022 extensions that add risk, with the points they add to the no-market spam score
-export const EXT_POINTS = {
-  permanentDelegate: 25,
-  transferHook: 15,
-  transferFeeConfig: 10,
-  nonTransferable: 10,
-  defaultAccountState: 10
-};
-
-// Risk levels, from worst to best (also the default sort order of results)
-export const LEVELS = ["HIGH", "MEDIUM", "LOW", "SPAM", "NO_DATA", "NO_MARKET"];
-export const TYPES = ["STABLE", "TOKENIZED", "BRIDGED", "CREATOR", "OPEN"];
-export const LIGHTS = ["control", "concentration", "market", "dependency"];
-export const RANKS = { ok: 0, na: 0, warn: 1, bad: 2 };
-
-export const ADDRESS_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+// api.mainnet-beta.solana.com answers 403 to anything coming from a browser. PublicNode serves almost
+// everything (accounts, signatures, transactions) quickly, but blocks token-by-owner and largest-holder
+// queries. Those go to Solana Vibe Station, which accepts them without a key but only at ~1 per second,
+// so they go through a queue (see client.js). With your own RPC URL everything goes to that URL.
+export const PUBLIC_RPC = "https://solana-rpc.publicnode.com";
+export const VIBE_RPC = "https://public.rpc.solanavibestation.com";
+export const DEX = "https://api.dexscreener.com/tokens/v1/solana/";
+// SolFlag's wallet base (see base.js)
+export const WALLET_BASE_URL = "https://solflag.com/datos/base.json";
+export const DEX_SEARCH = "https://api.dexscreener.com/latest/dex/search?q=";
+export const RUGCHECK = "https://api.rugcheck.xyz/v1/tokens/";
+export const GECKO = "https://api.geckoterminal.com/api/v2/networks/solana/";
+export const HELIUS_API = "https://api.helius.xyz/v0/addresses/";
+export const COINGECKO_SOL = "https://api.coingecko.com/api/v3/coins/solana/market_chart?vs_currency=usd&days=365";
+
+export const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+export const TOKEN_2022 = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
+export const SYSTEM_PROGRAM = "11111111111111111111111111111111";
+export const PUMP_PROGRAM = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P";
+// dexId of a token still on Pump.fun's bonding curve: DexScreener says "pumpfun", GeckoTerminal "pump-fun"
+export const PUMP_CURVE_DEXES = ["pumpfun", "pump-fun"];
+
+export const USDC = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+export const USDT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
+export const WSOL = "So11111111111111111111111111111111111111112";
+
+export const KNOWN = {
+  [WSOL]: "SOL (wrapped)",
+  [USDC]: "USDC",
+  [USDT]: "USDT"
+};
+
+// Symbols that scams usually copy, with their official address (checked on DexScreener)
+export const FAMOUS = {
+  USDC, USDT, SOL: WSOL, WSOL,
+  JUP: "JUPyiwrYJFskUPiHa7hkeR8VUtAeFoSYbKedZNsDvCN", BONK: "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
+  WIF: "EKpQGSJtjMFqKZ9KQanSqYXRcF8fBopzLHYxdM65zcjm", PYTH: "HZ1JovNiVvGrGNiiYvEozEVgZ58xaU3RKwX8eACQBCt3",
+  JTO: "jtojtomepa8beP8AuQc6eXt5FriJwfFMwQx2v2f9mCL", RAY: "4k3Dyjzvzp8eMZWUXbBCjEvwSkkk59S5iCNLY3QrkX6R",
+  PYUSD: "2b1kV6DkPAnxd5ixfnxCpjxmKwqjjaYmCZfHsFu24GXo", MSOL: "mSoLzYCxHdYgdzU16g5QSh3i5K3z3KZK7ytfqcJm7So",
+  JITOSOL: "J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn", TRUMP: "6p6xgHyF7AeE6TZkSmFsko444wqoP15icUSqi2jfGiPN",
+  PUMP: "pumpCmXqMfrsAkQ5r49WcJnRayYRqmXz6ae8H7H9Dfn", JLP: "27G8MtK7VtTcCHkpASjSDdkWWYfoqT6ggEuKidVJidD4",
+  POPCAT: "7GCihgDB8fe6KNjn2MYtkzZcRjQy3t9GHdC8uHYmW2hr", HNT: "hntyVP6YFm1Hg25TN9WGLqM12b8TQmcknKrdu1oxWux",
+  RENDER: "rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof", ORCA: "orcaEKTdK7LKz57vaAYr9QeNsVEPfiu6QeMU1kektZE",
+  DRIFT: "DriFtupJYLTosbwoN8koMbEYSx54aFAVLddWsbksjwg7",
+  // Bitcoin and Ether only exist on Solana bridged: a Pump.fun token called "BTC" is never the real one
+  BTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh", WBTC: "3NZ9JMVBmGAqocybic2c7LQCJScmgsAZ6vQqTDzcqmJh",
+  ETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs", WETH: "7vfCXTUXx5WJV5JADk17DUJ4ksgau7utNKj4b963voxs"
+};
+
+// Real companies with no token of their own on Solana: a memecoin called "Spotify" is not Spotify. Clubs
+// with an official fan token on Solana (Barcelona, PSG, Juventus...) and Western Union (USDPT) are left out. Their
+// genuine tokenized shares come from an issuer (xStocks, Backpack...) and are typed TOKENIZED, so they
+// are never matched. Names only: stock tickers clash with real crypto symbols (META, COIN...). A name that
+// is also an everyday word or a first name (Shell, Target, Puma, Mango, Oracle, Corona, Hermes...) is left
+// out, since a token called just that would be marked HIGH. brandKey() normalises both sides
+export function brandKey(s) {
+  return String(s || "").normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase()
+    .replace(/[$'’.\-_]/g, " ").replace(/\s+/g, " ").trim();
+}
+const BRAND_NAMES = [
+  // tech, internet and AI
+  "Apple", "Google", "Alphabet", "Microsoft", "Amazon", "Nvidia", "Facebook", "Instagram", "WhatsApp", "Netflix",
+  "Spotify", "Shopify", "TikTok", "YouTube", "OpenAI", "ChatGPT", "Anthropic", "DeepSeek", "Midjourney", "Samsung",
+  "Sony", "Nintendo", "PlayStation", "Xbox", "Intel", "Qualcomm", "Broadcom", "Salesforce", "Adobe", "IBM", "Cisco",
+  "Dell", "Lenovo", "Huawei", "Xiaomi", "OnePlus", "Motorola", "Nokia", "Snapchat", "Pinterest", "Reddit", "LinkedIn",
+  "Twitter", "Telegram", "Discord", "Twitch", "Dropbox", "Airbnb", "Uber", "Lyft", "DoorDash", "Expedia", "eBay",
+  "Alibaba", "AliExpress", "Temu", "Shein", "Tencent", "Baidu", "ByteDance", "Palantir", "SpaceX", "Starlink",
+  "Neuralink", "Roblox", "Fortnite", "Epic Games", "Minecraft", "Ubisoft", "Activision", "Rockstar Games",
+  "Electronic Arts", "Panasonic", "Philips", "Siemens", "Bosch", "Nikon", "GoPro", "Bose", "Dyson", "Garmin",
+  "Fitbit", "Peloton", "Logitech", "Razer", "Asus", "Xerox", "Vodafone", "Verizon", "AT&T", "T-Mobile", "Comcast",
+  "Movistar", "Telefonica", "Wikipedia", "Duolingo",
+  // finance and payments
+  "Visa", "Mastercard", "PayPal", "American Express", "JPMorgan", "Goldman Sachs", "Morgan Stanley", "BlackRock",
+  "Vanguard", "Fidelity", "Citibank", "Wells Fargo", "Bank of America", "HSBC", "Barclays", "Santander", "BBVA",
+  "CaixaBank", "Deutsche Bank", "Revolut", "Stripe", "Klarna", "Robinhood", "Charles Schwab", "Nasdaq", "NYSE",
+  "Berkshire Hathaway", "MoneyGram", "Venmo", "Cash App", "Zelle", "Monzo", "N26", "Nubank",
+  "Mapfre", "Bankinter",
+  // crypto companies with no token on Solana
+  "Coinbase", "Binance", "Bybit", "OKX", "KuCoin", "Bitget", "Upbit", "Bithumb", "Bitpanda", "eToro",
+  "MicroStrategy", "Grayscale", "MetaMask", "Trezor", "Solflare",
+  // fashion, retail and consumer goods
+  "Nike", "Adidas", "Reebok", "New Balance", "Under Armour", "Zara", "Inditex", "H&M", "Uniqlo", "Levi's", "Lacoste",
+  "Ralph Lauren", "Tommy Hilfiger", "Calvin Klein", "Gucci", "Louis Vuitton", "Chanel", "Prada", "Dior", "Versace",
+  "Balenciaga", "Burberry", "Fendi", "Givenchy", "Yves Saint Laurent", "Armani", "Dolce & Gabbana", "Rolex",
+  "Cartier", "Patek Philippe", "Audemars Piguet", "Swatch", "Ray-Ban", "Sephora", "L'Oreal", "Nivea", "Gillette",
+  "Colgate", "Pampers", "IKEA", "Lego", "Mattel", "Barbie", "Hot Wheels", "Hasbro", "Pokemon", "Hello Kitty",
+  "Sanrio", "Walmart", "Costco", "Carrefour", "Mercadona", "El Corte Ingles", "Lidl", "Aldi", "Tesco",
+  "Home Depot", "Best Buy", "7-Eleven", "Wallapop", "Glovo", "Cabify",
+  // food and drink
+  "Coca-Cola", "Pepsi", "Red Bull", "Monster Energy", "Starbucks", "McDonald's", "Burger King", "KFC", "Domino's",
+  "Pizza Hut", "Taco Bell", "Wendy's", "Chipotle", "Dunkin", "Krispy Kreme", "Nestle", "Nutella", "Ferrero",
+  "Doritos", "Pringles", "Cheetos", "Heinz", "Kellogg's", "Heineken", "Budweiser", "Guinness",
+  "Jack Daniel's", "Johnnie Walker", "Hennessy", "Moet", "Dom Perignon", "Smirnoff", "Bacardi", "Gatorade", "Fanta",
+  "Nespresso", "Haribo", "Snickers", "M&M's", "Hershey", "Cadbury", "Lindt",
+  // cars and motorbikes
+  "Tesla", "Ferrari", "Lamborghini", "Porsche", "Bugatti", "McLaren", "Bentley", "Rolls-Royce", "Aston Martin",
+  "Maserati", "BMW", "Mercedes-Benz", "Audi", "Volkswagen", "Toyota", "Honda", "Nissan", "Hyundai", "Chevrolet",
+  "Cadillac", "Volvo", "Peugeot", "Renault", "Harley-Davidson", "Ducati", "Yamaha", "Kawasaki", "Suzuki", "Rivian",
+  "Polestar",
+  // media, entertainment and sport
+  "Disney", "Pixar", "Marvel", "Warner Bros", "HBO", "Paramount", "Universal Studios", "DreamWorks", "Hulu",
+  "Fox News", "CNN", "ESPN", "National Geographic", "Playboy", "Nickelodeon", "Cartoon Network",
+  "Star Wars", "NBA", "NFL", "FIFA", "UEFA", "WWE", "Formula 1", "Real Madrid", "Manchester United",
+  "Bayern Munich",
+  // travel, transport, energy and health
+  "Emirates", "Qatar Airways", "Ryanair", "Lufthansa", "Boeing", "Airbus", "Marriott", "FedEx", "DHL",
+  "ExxonMobil", "Chevron", "Aramco", "Repsol", "Iberdrola", "Pfizer", "Moderna", "Johnson & Johnson",
+  "Procter & Gamble", "Unilever"
+];
+// Products that companies (or their partners) really put on Solana carry the name too: exchange staked SOL,
+// fund shares, wrapped BTC. They trade for weeks with real liquidity, while copies are new and thin, so a
+// market at least this old AND this deep is not checked for brand names
+export const BRAND_MATURE_DAYS = 30;
+export const BRAND_MATURE_LIQ = 100000;
+export const BRANDS = Object.fromEntries(BRAND_NAMES.map(function (n) { return [brandKey(n), n]; }));
+
+// Official tokens put on Solana by exchanges and by Socios.com, by mint address (a copy always has another
+// address). They are bought and sold mostly on their exchange, so Solana pools are tiny and the issuer's
+// custody wallet holds most of the supply: read as a stranger's token that gave HIGH (bnSOL, the Barcelona
+// fan token). They are shown as dependency on the issuer, like ISSUERS below
+export const OFFICIAL_TOKENS = {
+  BNso1VUJnh4zcfpZa6986Ea66P6TCp59hvtNJ8b1X85: "Binance",   // Binance Staked SOL
+  Bybit2vBJGhPF52GBdNaQfUJ6ZpThSgHBobjWZpLPb4B: "Bybit",   // Bybit Staked SOL
+  bgSoLfRx1wRPehwC9TyG568AGjnf1sQG1MYa8s3FbfY: "Bitget",   // Bitget Staked SOL
+  "7cBuurYDdaqxnem7KyMTci6SWhjJKroZ6NUjqH2ewEPB": "MEXC",   // MEXC Staked SOL
+  CDCSoLckzozyktpAp9FWT3w92KFJVEUxAU7cNu2Jn3aX: "Crypto.com",   // Crypto.com Staked SOL
+  FDLkS4zH5rGmD7q7qGfzhmzPgQJ88jcX1JFT5nfdNTjg: "Socios.com (Chiliz)",   // Olympique de Marseille Fan Token
+  BjXGwMnWWUkS9JrXEkkamszu4oX8oqo3kNqFr3ifNk1F: "Socios.com (Chiliz)",   // Napoli Fan Token
+  BX8VbHBf8DUHeGJjJsSW2HCviGyQSF5SVCEnN7vXUkwM: "Socios.com (Chiliz)",   // Argentine Football Association Fan Token
+  AiYi7HyVVXnDSuj8BoPirDsuuWgddeKkD5MQN35VpwNz: "Socios.com (Chiliz)",   // Portugal National Team Fan Token
+  HD9i9C2Pw6hWXm354i3SWkYG8ZtfikUJn2bNPzwQZcEK: "Socios.com (Chiliz)",   // SL Benfica Fan Token
+  cbbtcf3aa214zXHbiAZQwf4122FBYbraNdFqgw4iMij: "Coinbase",   // Coinbase Wrapped BTC
+  gtBTCGWvSRYYoZpU9UZj6i3eUGUpgksXzzsbHk2K9So: "Gate",   // Gate Wrapped BTC
+  CtzPWv73Sn1dMGVU3ZtLv9yWSyUAanBni19YWDaznnkn: "OKX",   // OKX Wrapped BTC
+  BtjXf3LA7Z3jxAcQkKUqKYpLFS5B7GuB7pfjzeas1tdB: "Socios.com (Chiliz)",   // OG Fan Token
+  "6VdpC1hcx7byFtJ5M6Xhspa6Uup5rZHruzXvuJhXAyXm": "Socios.com (Chiliz)",   // Atletico Madrid Fan Token
+  EDzhmkPa5gToYGowjH66xycCRgPmfWNzfqpXdCzsYb8M: "Socios.com (Chiliz)",   // Galatasaray Fan Token
+  "82DNsTK61ZrgCHP6pfP32Eubcsp9h38d64E6X9ETEBBe": "Socios.com (Chiliz)",   // FC Barcelona Fan Token
+  "5eyib4qghYGHNh7VvxSFGYLFJSanjq9hug9fR52kksnm": "Socios.com (Chiliz)",   // Paris Saint-Germain Fan Token
+  "3cVuTnMj8FeqK82PDgK4JzKnLP7LM6GauqTyqnxtcSk1": "Socios.com (Chiliz)",   // AS Roma Fan Token
+  HE6bLNs16qgQo2jVSMXDSCnxQahjdVrww7qQPrHrZtEw: "Socios.com (Chiliz)",   // Juventus Fan Token
+  "8WbNQtY7QmXMVKJFTSqFudierVZZtbuoyeepZEqJ1B2w": "Socios.com (Chiliz)",   // Manchester City Fan Token
+  H5qGPniSX2uCNtAnxr7RpdfFAZcGkr6dknjgpa1AKHe1: "Socios.com (Chiliz)",   // AC Milan Fan Token
+  Dst93spXQEXxFzwYbFrQRnFYBYpw7AzB2QyALEeP4NGQ: "Socios.com (Chiliz)",   // Arsenal Fan Token
+  HagS3VmAuhx5QJnHcuMAJF4wwVDE58CiX5SFZCYFrVe: "Socios.com (Chiliz)",   // Inter Milan Fan Token
+  AMnbxhGifp3gm2YsNwmfcF2ZCLsZN6iP3LdzBPZgGpzW: "Socios.com (Chiliz)",   // Trabzonspor Fan Token
+  GDNoEjfSAUAvManoEaT3vStGcvwKkcUcSTvUwfvwhqXf: "Socios.com (Chiliz)",   // Tottenham Hotspur FC Fan Token
+  FG44Jffowai8hqQifkwtNLbADkH3EjG5txMc54yaJ4cN: "Socios.com (Chiliz)",   // UFC Fan Token
+};
+
+// Known issuers of tokenized assets: every key that controls their tokens (mint, freeze, permanent delegate,
+// hook, pause, scaling). A token is theirs only if ALL its control keys are in the list, so copying one key
+// (anyone can hand the mint authority to someone else's wallet) is not enough. Their control is the point of
+// the product: it is shown as dependency on the issuer, not as a creator who can rug
+export const ISSUERS = [
+  { name: "xStocks (Backed)", keys: [
+    "7pt9tkctJPK7PPNQJ77GKg8ZffSF6QxoMiCFYHxrtaCj",   // mint
+    "JDq14BWvqCRFNu1krb12bcRpbGtJZ1FLEakMw6FdxJNs",   // freeze and pause (program)
+    "5aMNNLQJwAEeoemTEMkv5NVjqKwvvefRYCQ5Z67HFvEq",   // permanent delegate, transfer hook, confidential transfers
+    "S7vYFFWH6BjJyEsdrPQpqpYTqLTrPRK6KW3VwsJuRaS"     // share-split multiplier (scaled UI amount)
+  ] }
+];
+
+// Token-2022 extensions that add risk, with the points they add to the no-market spam score
+export const EXT_POINTS = {
+  permanentDelegate: 25,
+  transferHook: 15,
+  transferFeeConfig: 10,
+  nonTransferable: 10,
+  defaultAccountState: 10
+};
+
+// Risk levels, from worst to best (also the default sort order of results)
+export const LEVELS = ["HIGH", "MEDIUM", "LOW", "SPAM", "NO_DATA", "NO_MARKET"];
+export const TYPES = ["STABLE", "TOKENIZED", "BRIDGED", "CREATOR", "OPEN"];
+export const LIGHTS = ["control", "concentration", "market", "dependency"];
+export const RANKS = { ok: 0, na: 0, warn: 1, bad: 2 };
+
+export const ADDRESS_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;

package/src/holders.js

@@ -4,6 +4,7 @@ import { pool, progress, short, uniq } from "./util.js";
 import { getMint, accountKinds } from "./tokens.js";
 import { getMarkets } from "./markets.js";
 import { rugcheckReport, rugcheckGraph, rugcheckSummary, netBalances } from "./rugcheck.js";
+import { loadWalletBase, knownType } from "./base.js";
 
 // Largest accounts of a token, each traced to its owner, and whether each owner is a wallet or a program
 export async function holderBase(client, mint, onProgress) {
@@ -203,6 +204,9 @@ export async function creatorInfo(client, mint, onProgress) {
  * over 10% of the supply in a young token (bad) or 15% in a mature one (warn) is a HOLD_GROUP signal.
  *
  * @param [opts.creator=true]  also look up the creator and insider networks on RugCheck
+ * @param [opts.base]          SolFlag's wallet base: true to load it (solflag.com/datos/base.json), or the base
+ *                             itself. Known exchanges are taken as such without measuring them, and every row
+ *                             it knows gets known: "exchange" | "granja" | "repartidor" | "creador en serie" | "sniper"
  * @param [opts.createdAt]     ms when its market started, if the caller knows it
  * @param [opts.now]
  * @returns {..., mode: "young"|"mature", ageDays, groups, signals}
@@ -215,6 +219,13 @@ export async function analyzeHolders(client, mint, opts) {
   const wal = b.uniq.filter(function (o) { return b.kind[o] === "wallet"; });
   const busy = await markBusy(client, b.kind, wal, function (c, n) { progress(onProgress, "bots", 0.65 + 0.15 * c / Math.max(1, n), { done: c, total: n }); });
   const hr = holderRows(b, busy), pair = b.pair;
+  const base = opts.base === true ? await loadWalletBase(client) : (opts.base || null);
+  hr.rows.forEach(function (r) {
+    const t = knownType(base, r.owner);
+    if (!t) return;
+    r.known = t;
+    if (t === "exchange" && r.kind === "wallet") r.kind = "active";   // quiet hours made it look like a person
+  });
   const now = opts.now || Date.now();
   let created = opts.createdAt || (pair && pair.pairCreatedAt) || null;
   if (!created) {
@@ -234,9 +245,9 @@ export async function analyzeHolders(client, mint, opts) {
     if (srcs.length) {
       // a source is an exchange when it moves more than EXCHANGE_PER_HOUR transactions an hour (the bot
       // test, 200 in 2 days, also caught distributors doing ~50 an hour and hid their groups)
-      const rates = await sourceRates(client, srcs, function (c, n) { progress(onProgress, "exchangeSources", 0.88 + 0.02 * c / Math.max(1, n), { done: c, total: n }); });
-      const hot = {};
-      srcs.forEach(function (f) { if (rates[f] > EXCHANGE_PER_HOUR) hot[f] = true; });
+      const hot = {}, ask = srcs.filter(function (f) { if (knownType(base, f) === "exchange") { hot[f] = true; return false; } return true; });
+      const rates = ask.length ? await sourceRates(client, ask, function (c, n) { progress(onProgress, "exchangeSources", 0.88 + 0.02 * c / Math.max(1, n), { done: c, total: n }); }) : {};
+      ask.forEach(function (f) { if (rates[f] > EXCHANGE_PER_HOUR) hot[f] = true; });
       hotGroups = srcs.filter(function (f) { return hot[f]; }).length;
       if (hotGroups) clusters = clusterByFunder(funders, hot);
     }
@@ -255,6 +266,9 @@ export async function analyzeHolders(client, mint, opts) {
     mint: mint, sym: (pair && pair.baseToken && pair.baseToken.symbol) || short(mint),
     name: (pair && pair.baseToken && pair.baseToken.name) || "", price: hr.price, rows: hr.rows,
     mintAuth: !!b.info.mintAuth, freezeAuth: !!b.info.freezeAuth, clusters: clusters, hotGroups: hotGroups, creator: creator,
-    mode: mode, ageDays: ageDays, groups: groups, signals: signals
+    mode: mode, ageDays: ageDays, groups: groups, signals: signals,
+    // sources of groups the base knows (a known distributor or farm behind a group is worth saying)
+    knownSources: base ? uniq(groups.map(function (g) { return g.funder; })).filter(function (f) { return knownType(base, f); })
+      .reduce(function (o, f) { o[f] = knownType(base, f); return o; }, {}) : {}
   };
 }

package/src/i18n/en.js

@@ -35,6 +35,7 @@ export default {
     CTL_NON_TRANSFERABLE: () => "Cannot be transferred",
     CTL_DEFAULT_FROZEN: () => "New accounts can be created frozen",
     CTL_ONLY_PROGRAMS: () => "Only program-controlled authorities (see dependency)",
+    CTL_KNOWN_ISSUER: (d) => "Controlled by its issuer, " + d.issuer + " (see dependency)",
     CTL_NONE: () => "No active authorities: nobody can mint more or freeze",
     CTL_SERIAL_CREATOR: (d) => "The creator launched " + d.n + " other tokens in the last 24 h (per RugCheck): a serial launcher, who usually drops each token as soon as buyers arrive",
     BRAND_COPY: (d) => "Uses the name of " + d.brand + ", a real company with no token on Solana: it is not official, almost certainly an imitation to draw buyers",
@@ -64,6 +65,7 @@ export default {
     DEP_PROGRAM_AUTHORITY: () => "A program controls the mint or freeze (bridge or protocol): you have to trust its code",
     DEP_PERMANENT_DELEGATE: () => "The issuer can move or burn your tokens (permanent delegate): you trust the issuer",
     DEP_STABLE_ISSUER: () => "Its value depends on whoever issues and backs it",
+    DEP_KNOWN_ISSUER: (d) => "Issued by " + d.issuer + ": it can mint, freeze or move tokens, like any regulated issuer. You trust the issuer",
     DEP_NONE: () => "Does not depend on an issuer or a bridge"
   },
   offSolana: " and its main market may be outside Solana",

package/src/i18n/es.js

@@ -38,6 +38,7 @@ export default {
     CTL_NON_TRANSFERABLE: () => "No se puede transferir",
     CTL_DEFAULT_FROZEN: () => "Las cuentas nuevas pueden crearse congeladas",
     CTL_ONLY_PROGRAMS: () => "Solo hay autoridades controladas por un programa (ver dependencia)",
+    CTL_KNOWN_ISSUER: (d) => "Lo controla su emisor, " + d.issuer + " (ver dependencia)",
     CTL_NONE: () => "Sin autoridades activas: nadie puede crear más ni congelar",
     CTL_SERIAL_CREATOR: (d) => "El creador ha lanzado " + d.n + " tokens más en las últimas 24 h (según RugCheck): es un lanzador en serie, que suele abandonar cada token en cuanto llegan compradores",
     BRAND_COPY: (d) => "Usa el nombre de " + d.brand + ", una empresa real que no tiene token en Solana: no es oficial, casi seguro una imitación para atraer compradores",
@@ -67,6 +68,7 @@ export default {
     DEP_PROGRAM_AUTHORITY: () => "Un programa controla el mint o el freeze (puente o protocolo): hay que confiar en su código",
     DEP_PERMANENT_DELEGATE: () => "El emisor puede mover o quemar tus tokens (delegado permanente): confías en el emisor",
     DEP_STABLE_ISSUER: () => "Su valor depende de quien la emite y la respalda",
+    DEP_KNOWN_ISSUER: (d) => "Lo emite " + d.issuer + ": puede crear, congelar o mover tokens, como cualquier emisor regulado. Confías en el emisor",
     DEP_NONE: () => "No depende de un emisor ni de un puente"
   },
   offSolana: " y su mercado principal puede estar fuera de Solana",

package/src/index.js

@@ -5,6 +5,7 @@ import { estimatePnl } from "./pnl.js";
 import { takeSnapshots } from "./changes.js";
 import { confluence, commonHolders } from "./confluence.js";
 import { getTokens } from "./tokens.js";
+import { loadWalletBase } from "./base.js";
 
 /**
  * The easy entry point: one object with every high-level analysis bound to one network client.
@@ -35,7 +36,8 @@ export function createScanner(opts) {
     },
     takeSnapshots: (wallets, o) => takeSnapshots(client, wallets, o),
     confluence: (wallets, o) => confluence(client, wallets, o),
-    commonHolders: (mints, o) => commonHolders(client, mints, o)
+    commonHolders: (mints, o) => commonHolders(client, mints, o),
+    loadWalletBase: (url) => loadWalletBase(client, url)
   };
 }
 
@@ -46,7 +48,7 @@ export { isOnCurve, onCurve, b58bytes } from "./curve.js";
 export { getTokens, getMint, getConc, getAuthKinds, isMint, accountKinds, kindOf } from "./tokens.js";
 export { getMarkets, realLiq, impostorOf, INFLATED_RATIO, geckoLiquidity, geckoPair, brandOf, copiesOf, fakeLiquidity, FAKE_LIQ_RATIO } from "./markets.js";
 export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLaunches, CREATOR_DEAD_MCAP } from "./rugcheck.js";
-export { score, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
+export { score, issuerOf, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
 export { recentLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
 export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders,
@@ -54,4 +56,5 @@ export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderR
 export { fetchSwaps, solHistory, priceSeries, parseTrades, pnlFromTrades, pnlStatus, estimatePnl } from "./pnl.js";
 export { capSnap, chgDiff, chgAgg, takeSnapshots, diffSnapshots } from "./changes.js";
 export { confluence, commonHolders } from "./confluence.js";
+export { loadWalletBase, knownType, WALLET_TYPES } from "./base.js";
 export { describe, explainLight, lightLabel, levelLabel, missingText, typeInfo, describeStep, describeNote, describeError, format, addLanguage } from "./i18n/index.js";

package/src/markets.js

@@ -1,4 +1,4 @@
-import { DEX, DEX_SEARCH, GECKO, USDC, USDT, WSOL, FAMOUS, BRANDS } from "./constants.js";
+import { DEX, DEX_SEARCH, GECKO, USDC, USDT, WSOL, FAMOUS, BRANDS, brandKey, BRAND_MATURE_DAYS, BRAND_MATURE_LIQ } from "./constants.js";
 import { ScanError, isCancel } from "./errors.js";
 import { sleep } from "./util.js";
 
@@ -38,16 +38,18 @@ export function fakeLiquidity(pair) {
 }
 
 // A real company's name on a token that is not issued by anyone: {brand, exact}. exact = the name or the
-// symbol is just the brand ("Spotify"); otherwise the brand is one word of a longer name ("Spotify Cat")
-export function brandOf(pair, type) {
+// symbol is just the brand ("Spotify"); otherwise the brand is one word of a longer name ("Spotify Cat").
+// Established markets (see BRAND_MATURE_DAYS) are left alone
+export function brandOf(pair, type, now) {
   if (type === "TOKENIZED" || type === "BRIDGED" || type === "STABLE") return null;
+  const liq = (pair && pair.liquidity && pair.liquidity.usd) || 0;
+  const days = (pair && pair.pairCreatedAt) ? ((now || Date.now()) - pair.pairCreatedAt) / 86400000 : 0;
+  if (days >= BRAND_MATURE_DAYS && liq >= BRAND_MATURE_LIQ) return null;
   const b = (pair && pair.baseToken) || {};
-  const clean = function (s) { return String(s || "").toLowerCase().replace(/[$'’.\-_]/g, " ").replace(/\s+/g, " ").trim(); };
-  const name = clean(b.name), sym = clean(b.symbol);
-  for (const k of Object.keys(BRANDS)) {
-    const w = k.replace(/_/g, " ");
-    if (name === w || sym === w || name.replace(/ /g, "") === w.replace(/ /g, "")) return { brand: BRANDS[k], exact: true };
-    if ((" " + name + " ").indexOf(" " + w + " ") >= 0) return { brand: BRANDS[k], exact: false };
+  const name = brandKey(b.name), sym = brandKey(b.symbol);
+  for (const w of Object.keys(BRANDS)) {
+    if (name === w || sym === w || name.replace(/ /g, "") === w.replace(/ /g, "")) return { brand: BRANDS[w], exact: true };
+    if ((" " + name + " ").indexOf(" " + w + " ") >= 0) return { brand: BRANDS[w], exact: false };
   }
   return null;
 }