solana-risk-engine 0.4.6 → 0.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solana-risk-engine",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Explainable risk analysis for Solana tokens and wallets: creator control, real holder concentration, inflated liquidity, impostor tokens, funder clusters and PnL. Zero dependencies, runs in Node and the browser.",
   "type": "module",
   "main": "./src/index.js",

package/src/holders.js

@@ -31,15 +31,23 @@ export async function holderBase(client, mint, onProgress) {
 // People's wallets rarely move hundreds of transactions in a couple of days; exchanges, bots and
 // market makers do. Checked with the last 200 signatures. Marks them kind[o] = "active" (mutates kind)
 // and returns {address: hours it took to do those 200}.
+// Signatures also list what a wallet only RECEIVES (fee shares, airdrops, dust), so before calling it busy
+// a few of those transactions are read: if it signed none, it is a quiet wallet that gets paid, not a bot
+// (31/10: the 60% holder of a pump.fun quote token got ~1,500 fee shares an hour and signed nothing).
+// Those stay "wallet" and are listed in busy.passive (not enumerable) as {address: true}.
 export async function markBusy(client, kind, wallets, onStep) {
-  const busy = {};
+  const busy = {}, passive = {};
+  Object.defineProperty(busy, "passive", { value: passive });
   let chk = 0;
   await pool(wallets, 3, async function (o) {
     try {
       const sg = await client.rpc("getSignaturesForAddress", [o, { limit: 200 }]);
       if (sg && sg.length >= 200) {
         const t1 = sg[0].blockTime, t0 = sg[sg.length - 1].blockTime;
-        if (t1 && t0 && (t1 - t0) < 2 * 86400) { kind[o] = "active"; busy[o] = Math.max(1, Math.round((t1 - t0) / 3600)); }
+        if (t1 && t0 && (t1 - t0) < 2 * 86400) {
+          if (await onlyReceives(client, o, sg)) passive[o] = true;
+          else { kind[o] = "active"; busy[o] = Math.max(1, Math.round((t1 - t0) / 3600)); }
+        }
       }
     } catch (e) { if (isCancel(e)) throw e; }
     chk++; if (onStep) onStep(chk, wallets.length);
@@ -47,6 +55,33 @@ export async function markBusy(client, kind, wallets, onStep) {
   return busy;
 }
 
+// How many of the busy list's transactions are read to tell a wallet that acts from one that only receives
+export const PASSIVE_SAMPLE = 4;
+
+function signers(tx) {
+  const m = tx && tx.transaction && tx.transaction.message;
+  const keys = (m && m.accountKeys) || [];
+  if (keys.length && typeof keys[0] === "object") return keys.filter(function (k) { return k.signer; }).map(function (k) { return k.pubkey; });
+  const n = (m && m.header && m.header.numRequiredSignatures) || 1;   // raw format: signers come first
+  return keys.slice(0, n);
+}
+
+// true only when at least 2 of the sampled transactions could be read and the wallet signed none of them
+export async function onlyReceives(client, o, sg) {
+  const idx = [];
+  for (let i = 0; i < PASSIVE_SAMPLE; i++) idx.push(Math.round(i * (sg.length - 1) / Math.max(1, PASSIVE_SAMPLE - 1)));
+  let read = 0;
+  for (const i of uniq(idx)) {
+    let tx = null;
+    try { tx = await client.rpc("getTransaction", [sg[i].signature, { maxSupportedTransactionVersion: 1, encoding: "jsonParsed" }]); }
+    catch (e) { if (isCancel(e)) throw e; }
+    if (!tx) continue;
+    read++;
+    if (signers(tx).indexOf(o) >= 0) return false;
+  }
+  return read >= 2;
+}
+
 /* ---------- wallets funded from the same source (maybe one owner split into several accounts) ---------- */
 // By Solana protocol, account 0 of any transaction is always the fee payer. Looking at who paid the
 // very first transaction of each wallet shows who "created" it with the first SOL transfer. If several
@@ -156,6 +191,7 @@ export function holderRows(b, busy) {
   b.largest.forEach(function (a, i) {
     const o = b.owners[i] || a.address;
     if (!agg[o]) agg[o] = { owner: o, kind: b.kind[o] || "program", raw: 0, busy: busy[o] || 0 };
+    if (busy.passive && busy.passive[o]) agg[o].passive = true;   // very busy, but only receiving
     agg[o].raw += Number(a.amount);
   });
   const price = Number((b.pair && b.pair.priceUsd) || 0);

package/src/i18n/en.js

@@ -43,7 +43,7 @@ export default {
     COPYCAT: (d) => "There " + (d.n === 1 ? "is another token" : "are " + d.n + " more tokens") + " with the same name and ticker; the oldest one with a real market (" + short(d.original) + ", " + d.days + (d.days === 1 ? " day" : " days") + " old) is not this one: check you have the right address",
     HOLD_GROUP: (d) => d.n + " holders got their first SOL from the same wallet and together hold " + pct(d.pct) + " of the supply: most likely one person or team",
     CTL_CREATOR_HISTORY: (d) => "Of the " + d.old + " tokens the creator launched before (over 24 h ago), " + d.dead + " stayed under $10,000 market cap (per RugCheck): their launches rarely take off",
-    IMPOSTOR: (d) => "Impersonates " + d.symbol + ": the real " + d.symbol + " has another address (" + short(d.real) + "). It is a copy, almost certainly a scam",
+    IMPOSTOR: (d) => "Not the original " + d.symbol + ". Make sure it is the token you want",
 
     CON_SKIPPED: () => "Holder concentration not checked",
     CON_UNAVAILABLE: () => "Could not check holder concentration (the service did not answer; try again in a while)",

package/src/i18n/es.js

@@ -46,7 +46,7 @@ export default {
     COPYCAT: (d) => "Hay " + (d.n === 1 ? "otro token" : d.n + " tokens más") + " con el mismo nombre y ticker; el más antiguo con mercado real (" + short(d.original) + ", de hace " + d.days + (d.days === 1 ? " día" : " días") + ") no es este: comprueba que tienes la dirección correcta",
     HOLD_GROUP: (d) => d.n + " holders recibieron su primer SOL de la misma wallet y juntos tienen el " + pct(d.pct) + " del suministro: probablemente son la misma persona o equipo",
     CTL_CREATOR_HISTORY: (d) => "De los " + d.old + " tokens que el creador lanzó antes (hace más de 24 h), " + d.dead + " se quedaron por debajo de 10.000 $ de capitalización (según RugCheck): sus lanzamientos no suelen despegar",
-    IMPOSTOR: (d) => "Se hace pasar por " + d.symbol + ": el " + d.symbol + " de verdad tiene otra dirección (" + short(d.real) + "). Es una copia, casi seguro una estafa",
+    IMPOSTOR: (d) => "No es el " + d.symbol + " original. Comprueba que es el token que buscas",
 
     CON_SKIPPED: () => "Sin comprobar la concentración de holders",
     CON_UNAVAILABLE: () => "No se pudo comprobar la concentración de holders (el servicio no respondió; prueba otra vez en un rato)",

package/src/index.js

@@ -51,7 +51,7 @@ export { rugcheckSummary, rugcheckReport, rugcheckGraph, netBalances, creatorLau
 export { score, issuerOf, tokenType, buildLights, levelFrom, dataOnly, reasonsFrom, assess, SERIAL_WARN, SERIAL_BAD, HISTORY_MIN, HISTORY_WARN, HISTORY_BAD_MIN, HISTORY_BAD } from "./risk.js";
 export { recentLaunches } from "./launch.js";
 export { analyzeToken, analyzeWallet, analyzeAddress, sortResults } from "./wallet.js";
-export { holderBase, markBusy, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders,
+export { holderBase, markBusy, onlyReceives, PASSIVE_SAMPLE, findFunder, findFunders, clusterByFunder, holderRows, creatorInfo, analyzeHolders,
   perHour, sourceRates, groupList, EXCHANGE_PER_HOUR, YOUNG_DAYS, HOLD_GROUP_YOUNG, HOLD_GROUP_MATURE } from "./holders.js";
 export { fetchSwaps, solHistory, priceSeries, parseTrades, pnlFromTrades, pnlStatus, estimatePnl } from "./pnl.js";
 export { capSnap, chgDiff, chgAgg, takeSnapshots, diffSnapshots } from "./changes.js";