solana-risk-engine 0.4.5 → 0.4.7

package/src/tokens.js

@@ -1,123 +1,123 @@
-import { TOKEN_PROGRAM, TOKEN_2022, SYSTEM_PROGRAM } from "./constants.js";
-import { isCancel } from "./errors.js";
-import { onCurve, b58bytes } from "./curve.js";
-import { uniq } from "./util.js";
-
-// SOL balance and every token the wallet holds (classic SPL + Token-2022), summed by mint
-export async function getTokens(client, wallet) {
-  const res = await Promise.all([
-    client.rpc("getBalance", [wallet]),
-    client.rpc("getTokenAccountsByOwner", [wallet, { programId: TOKEN_PROGRAM }, { encoding: "jsonParsed" }]),
-    client.rpc("getTokenAccountsByOwner", [wallet, { programId: TOKEN_2022 }, { encoding: "jsonParsed" }])
-  ]);
-  const tokens = {};
-  [res[1], res[2]].forEach(function (r) {
-    r.value.forEach(function (c) {
-      const info = c.account.data.parsed.info;
-      const q = Number(info.tokenAmount.uiAmount || 0);
-      if (q > 0) tokens[info.mint] = (tokens[info.mint] || 0) + q;
-    });
-  });
-  return { sol: res[0].value / 1e9, tokens: tokens };
-}
-
-// A mint account belongs to a token program; a wallet belongs to the System Program
-export async function isMint(client, addr) {
-  try {
-    const r = await client.rpc("getAccountInfo", [addr, { encoding: "jsonParsed" }]);
-    const v = r && r.value;
-    return !!(v && (v.owner === TOKEN_PROGRAM || v.owner === TOKEN_2022) && v.data && v.data.parsed && v.data.parsed.type === "mint");
-  } catch (e) { if (isCancel(e)) throw e; return false; }   // if it cannot be known, treat it as a wallet
-}
-
-export async function getMint(client, mint) {
-  const r = await client.rpc("getAccountInfo", [mint, { encoding: "jsonParsed" }]);
-  const p = r && r.value && r.value.data && r.value.data.parsed && r.value.data.parsed.info;
-  if (!p) return null;
-  const exts = p.extensions || [];
-  const state = function (name) { const e = exts.find(function (x) { return x.extension === name; }); return (e && e.state) || {}; };
-  const hook = state("transferHook");
-  return {
-    mintAuth: p.mintAuthority || null, freezeAuth: p.freezeAuthority || null,
-    supply: Number(p.supply || 0), decimals: Number(p.decimals || 0),
-    ext: exts.map(function (e) { return e.extension; }),
-    // what the extensions are set to: a transfer hook with no program and no authority does nothing, and
-    // "default account state" only matters when new accounts are born frozen
-    hook: { program: hook.programId || null, auth: hook.authority || null },
-    defaultState: state("defaultAccountState").accountState || null,
-    // every key that controls something in the extensions (delegate, hook, pause, metadata...)
-    extKeys: extKeys(exts)
-  };
-}
-
-function extKeys(exts) {
-  const out = [];
-  exts.forEach(function (e) {
-    Object.keys(e.state || {}).forEach(function (k) {
-      const v = e.state[k];
-      if (typeof v === "string" && /authority$|^delegate$|^programId$/i.test(k) && out.indexOf(v) < 0) out.push(v);
-    });
-  });
-  return out;
-}
-
-// A key off the ed25519 curve has no private key: only a program can sign for it (a PDA), whoever
-// owns its account. PDAs that hold SOL (stake pool and AMM authorities) are owned by the System
-// Program like any wallet, so the owner alone would count them as people.
-export function kindOf(key, account, missingIsWallet) {
-  if (!onCurve(b58bytes(key))) return "program";
-  if (account) return account.owner === SYSTEM_PROGRAM ? "wallet" : "program";
-  return missingIsWallet ? "wallet" : "program";
-}
-
-// "wallet" or "program" for each address
-export async function accountKinds(client, addrs, missingIsWallet) {
-  if (!addrs.length) return {};
-  const r = await client.rpc("getMultipleAccounts", [addrs, { encoding: "base64", dataSlice: { offset: 0, length: 0 } }]);
-  const out = {};
-  addrs.forEach(function (k, i) { out[k] = kindOf(k, r.value[i], missingIsWallet); });
-  return out;
-}
-
-// Who controls the mint and freeze authorities: a person's wallet or a program (bridge, protocol)
-export async function getAuthKinds(client, info) {
-  const keys = [];
-  [info.mintAuth, info.freezeAuth].forEach(function (a) { if (a && keys.indexOf(a) < 0) keys.push(a); });
-  if (!keys.length) return {};
-  return accountKinds(client, keys, true);   // no account but on the curve: an empty wallet
-}
-
-// Concentration of the supply. Each large account is traced to its owner: a pool or a program
-// holding tokens is not a whale, so w1/w10 count only people's wallets.
-export async function getConc(client, mint, supply) {
-  const r = await client.rpc("getTokenLargestAccounts", [mint]);
-  const v = (r && r.value) || [];
-  if (!v.length || supply <= 0) throw new Error("no holder data");
-  const amts = v.map(function (x) { return Number(x.amount); });
-  const out = {
-    ok: false,
-    top1: amts[0] / supply * 100,
-    top10: amts.slice(0, 10).reduce(function (s, x) { return s + x; }, 0) / supply * 100
-  };
-  const addrs = v.map(function (x) { return x.address; });
-  if (addrs.some(function (x) { return !x; })) return out;
-  try {
-    const ta = await client.rpc("getMultipleAccounts", [addrs, { encoding: "jsonParsed" }]);
-    const owners = ta.value.map(function (x) {
-      return x && x.data && x.data.parsed && x.data.parsed.info && x.data.parsed.info.owner || null;
-    });
-    if (owners.some(function (o) { return !o; })) return out;
-    const kind = await accountKinds(client, uniq(owners), false);
-    const agg = {};
-    owners.forEach(function (o, i) { agg[o] = (agg[o] || 0) + amts[i]; });
-    const ws = [];
-    let prog = 0;
-    Object.keys(agg).forEach(function (o) { if (kind[o] === "wallet") ws.push(agg[o]); else prog += agg[o]; });
-    ws.sort(function (x, y) { return y - x; });
-    out.ok = true; out.nW = ws.length;
-    out.w1 = ws.length ? ws[0] / supply * 100 : 0;
-    out.w10 = ws.slice(0, 10).reduce(function (s, x) { return s + x; }, 0) / supply * 100;
-    out.prog = prog / supply * 100;
-  } catch (e) { if (isCancel(e)) throw e; }
-  return out;
-}
+import { TOKEN_PROGRAM, TOKEN_2022, SYSTEM_PROGRAM } from "./constants.js";
+import { isCancel } from "./errors.js";
+import { onCurve, b58bytes } from "./curve.js";
+import { uniq } from "./util.js";
+
+// SOL balance and every token the wallet holds (classic SPL + Token-2022), summed by mint
+export async function getTokens(client, wallet) {
+  const res = await Promise.all([
+    client.rpc("getBalance", [wallet]),
+    client.rpc("getTokenAccountsByOwner", [wallet, { programId: TOKEN_PROGRAM }, { encoding: "jsonParsed" }]),
+    client.rpc("getTokenAccountsByOwner", [wallet, { programId: TOKEN_2022 }, { encoding: "jsonParsed" }])
+  ]);
+  const tokens = {};
+  [res[1], res[2]].forEach(function (r) {
+    r.value.forEach(function (c) {
+      const info = c.account.data.parsed.info;
+      const q = Number(info.tokenAmount.uiAmount || 0);
+      if (q > 0) tokens[info.mint] = (tokens[info.mint] || 0) + q;
+    });
+  });
+  return { sol: res[0].value / 1e9, tokens: tokens };
+}
+
+// A mint account belongs to a token program; a wallet belongs to the System Program
+export async function isMint(client, addr) {
+  try {
+    const r = await client.rpc("getAccountInfo", [addr, { encoding: "jsonParsed" }]);
+    const v = r && r.value;
+    return !!(v && (v.owner === TOKEN_PROGRAM || v.owner === TOKEN_2022) && v.data && v.data.parsed && v.data.parsed.type === "mint");
+  } catch (e) { if (isCancel(e)) throw e; return false; }   // if it cannot be known, treat it as a wallet
+}
+
+export async function getMint(client, mint) {
+  const r = await client.rpc("getAccountInfo", [mint, { encoding: "jsonParsed" }]);
+  const p = r && r.value && r.value.data && r.value.data.parsed && r.value.data.parsed.info;
+  if (!p) return null;
+  const exts = p.extensions || [];
+  const state = function (name) { const e = exts.find(function (x) { return x.extension === name; }); return (e && e.state) || {}; };
+  const hook = state("transferHook");
+  return {
+    mintAuth: p.mintAuthority || null, freezeAuth: p.freezeAuthority || null,
+    supply: Number(p.supply || 0), decimals: Number(p.decimals || 0),
+    ext: exts.map(function (e) { return e.extension; }),
+    // what the extensions are set to: a transfer hook with no program and no authority does nothing, and
+    // "default account state" only matters when new accounts are born frozen
+    hook: { program: hook.programId || null, auth: hook.authority || null },
+    defaultState: state("defaultAccountState").accountState || null,
+    // every key that controls something in the extensions (delegate, hook, pause, metadata...)
+    extKeys: extKeys(exts)
+  };
+}
+
+function extKeys(exts) {
+  const out = [];
+  exts.forEach(function (e) {
+    Object.keys(e.state || {}).forEach(function (k) {
+      const v = e.state[k];
+      if (typeof v === "string" && /authority$|^delegate$|^programId$/i.test(k) && out.indexOf(v) < 0) out.push(v);
+    });
+  });
+  return out;
+}
+
+// A key off the ed25519 curve has no private key: only a program can sign for it (a PDA), whoever
+// owns its account. PDAs that hold SOL (stake pool and AMM authorities) are owned by the System
+// Program like any wallet, so the owner alone would count them as people.
+export function kindOf(key, account, missingIsWallet) {
+  if (!onCurve(b58bytes(key))) return "program";
+  if (account) return account.owner === SYSTEM_PROGRAM ? "wallet" : "program";
+  return missingIsWallet ? "wallet" : "program";
+}
+
+// "wallet" or "program" for each address
+export async function accountKinds(client, addrs, missingIsWallet) {
+  if (!addrs.length) return {};
+  const r = await client.rpc("getMultipleAccounts", [addrs, { encoding: "base64", dataSlice: { offset: 0, length: 0 } }]);
+  const out = {};
+  addrs.forEach(function (k, i) { out[k] = kindOf(k, r.value[i], missingIsWallet); });
+  return out;
+}
+
+// Who controls the mint and freeze authorities: a person's wallet or a program (bridge, protocol)
+export async function getAuthKinds(client, info) {
+  const keys = [];
+  [info.mintAuth, info.freezeAuth].forEach(function (a) { if (a && keys.indexOf(a) < 0) keys.push(a); });
+  if (!keys.length) return {};
+  return accountKinds(client, keys, true);   // no account but on the curve: an empty wallet
+}
+
+// Concentration of the supply. Each large account is traced to its owner: a pool or a program
+// holding tokens is not a whale, so w1/w10 count only people's wallets.
+export async function getConc(client, mint, supply) {
+  const r = await client.rpc("getTokenLargestAccounts", [mint]);
+  const v = (r && r.value) || [];
+  if (!v.length || supply <= 0) throw new Error("no holder data");
+  const amts = v.map(function (x) { return Number(x.amount); });
+  const out = {
+    ok: false,
+    top1: amts[0] / supply * 100,
+    top10: amts.slice(0, 10).reduce(function (s, x) { return s + x; }, 0) / supply * 100
+  };
+  const addrs = v.map(function (x) { return x.address; });
+  if (addrs.some(function (x) { return !x; })) return out;
+  try {
+    const ta = await client.rpc("getMultipleAccounts", [addrs, { encoding: "jsonParsed" }]);
+    const owners = ta.value.map(function (x) {
+      return x && x.data && x.data.parsed && x.data.parsed.info && x.data.parsed.info.owner || null;
+    });
+    if (owners.some(function (o) { return !o; })) return out;
+    const kind = await accountKinds(client, uniq(owners), false);
+    const agg = {};
+    owners.forEach(function (o, i) { agg[o] = (agg[o] || 0) + amts[i]; });
+    const ws = [];
+    let prog = 0;
+    Object.keys(agg).forEach(function (o) { if (kind[o] === "wallet") ws.push(agg[o]); else prog += agg[o]; });
+    ws.sort(function (x, y) { return y - x; });
+    out.ok = true; out.nW = ws.length;
+    out.w1 = ws.length ? ws[0] / supply * 100 : 0;
+    out.w10 = ws.slice(0, 10).reduce(function (s, x) { return s + x; }, 0) / supply * 100;
+    out.prog = prog / supply * 100;
+  } catch (e) { if (isCancel(e)) throw e; }
+  return out;
+}

package/src/wallet.js

@@ -1,94 +1,94 @@
-import { ADDRESS_RE, KNOWN, LEVELS, PUMP_CURVE_DEXES } from "./constants.js";
-import { ScanError } from "./errors.js";
-import { pool, progress } from "./util.js";
-import { getTokens, isMint } from "./tokens.js";
-import { getMarkets, geckoLiquidity, geckoPair } from "./markets.js";
-import { assess } from "./risk.js";
-
-function checkAddress(addr) {
-  if (!ADDRESS_RE.test(addr || "")) throw new ScanError("INVALID_ADDRESS", "not a Solana address");
-}
-
-export function sortResults(list) {
-  return list.sort(function (a, b) {
-    return LEVELS.indexOf(a.lvl) - LEVELS.indexOf(b.lvl) || (b.sev || 0) - (a.sev || 0) || b.pts - a.pts || b.value - a.value;
-  });
-}
-
-/**
- * Risk of a single token. Throws IS_NFT for NFTs.
- * @param [opts.noGecko]  do not fill DexScreener's Pump.fun gaps from GeckoTerminal (also for analyzeWallet)
- */
-export async function analyzeToken(client, mint, opts) {
-  opts = opts || {};
-  checkAddress(mint);
-  progress(opts.onProgress, "markets", 0.15);
-  const mkr = await getMarkets(client, [mint]);
-  // Pump.fun gaps in DexScreener: not listed yet (seconds old) or $0 liquidity on the bonding curve
-  if (!opts.noGecko) {
-    if (!mkr.data[mint] && !mkr.failed.length) { const gp = await geckoPair(client, mint); if (gp) mkr.data[mint] = gp; }
-    await geckoLiquidity(client, mkr.data[mint]);
-  }
-  progress(opts.onProgress, "token", 0.45);
-  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator, copies: opts.copies !== false });
-  if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
-  progress(opts.onProgress, "done", 1);
-  return r;
-}
-
-/**
- * Risk of every token a wallet holds.
- *
- * @param [opts.minUsd=1]      hide priced tokens worth less than this (dust)
- * @param [opts.concurrency=3]
- * @returns {wallet, sol, balances, total, hidden, results}
- */
-export async function analyzeWallet(client, wallet, opts) {
-  opts = opts || {};
-  checkAddress(wallet);
-  const minUsd = opts.minUsd === undefined ? 1 : opts.minUsd;
-  const onProgress = opts.onProgress;
-  progress(onProgress, "wallet", 0.02);
-  const w = await getTokens(client, wallet);
-  const mints = Object.keys(w.tokens);
-  const res = { wallet: wallet, sol: w.sol, balances: w.tokens, total: mints.length, hidden: 0, results: [] };
-  if (!mints.length) return res;
-  progress(onProgress, "markets", 0.08);
-  const mkr = await getMarkets(client, mints, function (d, n) { progress(onProgress, "markets", 0.08 + 0.12 * d / n, { done: d, total: n }); });
-  const mk = mkr.data, failedMk = {};
-  mkr.failed.forEach(function (m) { failedMk[m] = 1; });
-  // Bonding-curve tokens show $0 liquidity on DexScreener; ask GeckoTerminal for a few (its free API
-  // allows ~30 requests a minute, and wallets full of airdropped spam would use them up)
-  if (!opts.noGecko) {
-    const curve = mints.filter(function (m) { const p = mk[m]; return p && PUMP_CURVE_DEXES.indexOf(p.dexId) >= 0 && !(p.liquidity && p.liquidity.usd); }).slice(0, 10);
-    await pool(curve, 2, async function (m) { await geckoLiquidity(client, mk[m]); });
-  }
-
-  const out = [], todo = [];
-  mints.forEach(function (m) {
-    const pair = mk[m], price = Number((pair && pair.priceUsd) || 0);
-    let value = w.tokens[m] * price;
-    if (pair && pair.liqRaw) value = Math.min(value, pair.liquidity.usd);   // with inflated liquidity the price is fake too
-    if (KNOWN[m]) { out.push({ mint: m, sym: KNOWN[m], name: "", pts: 0, sev: 0, lvl: "LOW", known: true, type: null, lights: null, reasons: [{ code: "KNOWN_TOKEN", s: "ok" }], value: value, pair: pair, img: null }); return; }
-    if (price > 0 && value < minUsd) { res.hidden++; return; }
-    todo.push({ mint: m, pair: pair, value: value, unknown: !!failedMk[m] });
-  });
-
-  let done = 0;
-  await pool(todo, opts.concurrency || 3, async function (t) {
-    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
-    if (r) out.push(r);
-    done++;
-    progress(onProgress, "tokens", 0.2 + 0.8 * done / Math.max(1, todo.length), { done: done, total: todo.length });
-  });
-  res.results = sortResults(out);
-  return res;
-}
-
-/** Detects whether the address is a token mint or a wallet and analyses it accordingly. */
-export async function analyzeAddress(client, addr, opts) {
-  checkAddress(addr);
-  progress(opts && opts.onProgress, "address", 0.01);
-  if (await isMint(client, addr)) return { kind: "token", token: await analyzeToken(client, addr, opts) };
-  return { kind: "wallet", wallet: await analyzeWallet(client, addr, opts) };
-}
+import { ADDRESS_RE, KNOWN, LEVELS, PUMP_CURVE_DEXES } from "./constants.js";
+import { ScanError } from "./errors.js";
+import { pool, progress } from "./util.js";
+import { getTokens, isMint } from "./tokens.js";
+import { getMarkets, geckoLiquidity, geckoPair } from "./markets.js";
+import { assess } from "./risk.js";
+
+function checkAddress(addr) {
+  if (!ADDRESS_RE.test(addr || "")) throw new ScanError("INVALID_ADDRESS", "not a Solana address");
+}
+
+export function sortResults(list) {
+  return list.sort(function (a, b) {
+    return LEVELS.indexOf(a.lvl) - LEVELS.indexOf(b.lvl) || (b.sev || 0) - (a.sev || 0) || b.pts - a.pts || b.value - a.value;
+  });
+}
+
+/**
+ * Risk of a single token. Throws IS_NFT for NFTs.
+ * @param [opts.noGecko]  do not fill DexScreener's Pump.fun gaps from GeckoTerminal (also for analyzeWallet)
+ */
+export async function analyzeToken(client, mint, opts) {
+  opts = opts || {};
+  checkAddress(mint);
+  progress(opts.onProgress, "markets", 0.15);
+  const mkr = await getMarkets(client, [mint]);
+  // Pump.fun gaps in DexScreener: not listed yet (seconds old) or $0 liquidity on the bonding curve
+  if (!opts.noGecko) {
+    if (!mkr.data[mint] && !mkr.failed.length) { const gp = await geckoPair(client, mint); if (gp) mkr.data[mint] = gp; }
+    await geckoLiquidity(client, mkr.data[mint]);
+  }
+  progress(opts.onProgress, "token", 0.45);
+  const r = await assess(client, mint, mkr.data[mint] || null, { marketUnknown: mkr.failed.length > 0, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator, copies: opts.copies !== false });
+  if (!r) throw new ScanError("IS_NFT", "that address is an NFT, not a token");
+  progress(opts.onProgress, "done", 1);
+  return r;
+}
+
+/**
+ * Risk of every token a wallet holds.
+ *
+ * @param [opts.minUsd=1]      hide priced tokens worth less than this (dust)
+ * @param [opts.concurrency=3]
+ * @returns {wallet, sol, balances, total, hidden, results}
+ */
+export async function analyzeWallet(client, wallet, opts) {
+  opts = opts || {};
+  checkAddress(wallet);
+  const minUsd = opts.minUsd === undefined ? 1 : opts.minUsd;
+  const onProgress = opts.onProgress;
+  progress(onProgress, "wallet", 0.02);
+  const w = await getTokens(client, wallet);
+  const mints = Object.keys(w.tokens);
+  const res = { wallet: wallet, sol: w.sol, balances: w.tokens, total: mints.length, hidden: 0, results: [] };
+  if (!mints.length) return res;
+  progress(onProgress, "markets", 0.08);
+  const mkr = await getMarkets(client, mints, function (d, n) { progress(onProgress, "markets", 0.08 + 0.12 * d / n, { done: d, total: n }); });
+  const mk = mkr.data, failedMk = {};
+  mkr.failed.forEach(function (m) { failedMk[m] = 1; });
+  // Bonding-curve tokens show $0 liquidity on DexScreener; ask GeckoTerminal for a few (its free API
+  // allows ~30 requests a minute, and wallets full of airdropped spam would use them up)
+  if (!opts.noGecko) {
+    const curve = mints.filter(function (m) { const p = mk[m]; return p && PUMP_CURVE_DEXES.indexOf(p.dexId) >= 0 && !(p.liquidity && p.liquidity.usd); }).slice(0, 10);
+    await pool(curve, 2, async function (m) { await geckoLiquidity(client, mk[m]); });
+  }
+
+  const out = [], todo = [];
+  mints.forEach(function (m) {
+    const pair = mk[m], price = Number((pair && pair.priceUsd) || 0);
+    let value = w.tokens[m] * price;
+    if (pair && pair.liqRaw) value = Math.min(value, pair.liquidity.usd);   // with inflated liquidity the price is fake too
+    if (KNOWN[m]) { out.push({ mint: m, sym: KNOWN[m], name: "", pts: 0, sev: 0, lvl: "LOW", known: true, type: null, lights: null, reasons: [{ code: "KNOWN_TOKEN", s: "ok" }], value: value, pair: pair, img: null }); return; }
+    if (price > 0 && value < minUsd) { res.hidden++; return; }
+    todo.push({ mint: m, pair: pair, value: value, unknown: !!failedMk[m] });
+  });
+
+  let done = 0;
+  await pool(todo, opts.concurrency || 3, async function (t) {
+    const r = await assess(client, t.mint, t.pair, { value: t.value, marketUnknown: t.unknown, skipConcentration: opts.skipConcentration, skipCreator: opts.skipCreator });
+    if (r) out.push(r);
+    done++;
+    progress(onProgress, "tokens", 0.2 + 0.8 * done / Math.max(1, todo.length), { done: done, total: todo.length });
+  });
+  res.results = sortResults(out);
+  return res;
+}
+
+/** Detects whether the address is a token mint or a wallet and analyses it accordingly. */
+export async function analyzeAddress(client, addr, opts) {
+  checkAddress(addr);
+  progress(opts && opts.onProgress, "address", 0.01);
+  if (await isMint(client, addr)) return { kind: "token", token: await analyzeToken(client, addr, opts) };
+  return { kind: "wallet", wallet: await analyzeWallet(client, addr, opts) };
+}