# Solana Token Security Snapshot

Pre-trade screening snapshot for any SPL / Token-2022 mint, from public
APIs only — no keys, stdlib-only Python.

## What it checks

**RugCheck** (`api.rugcheck.xyz/v1/tokens/<mint>/report`)

- Rugged flag (reported rug pulls)
- Mint / freeze authority still enabled
- Named risk findings with severity (mutable metadata, low LP, etc.)
- Top-10 holder concentration + insider-flagged holders
- Insider networks in the holder graph (bundled funding)
- Total market + stable liquidity, LP locked/burned share
- Token-2022 transfer fee, creator's other rugged tokens

**GoPlus Solana token_security**

- Token-2022 extension authorities: closable, balance-mutable,
  default-account-state (+ upgradable), transfer hook (+ upgradable),
  transfer fee (+ upgradable), metadata-upgrade
- Non-transferable restriction, default-frozen accounts
- Malicious-flagged creator addresses, holder count, trusted-token mark

Registry-trusted issuers (e.g. Circle's USDC) hold mint/freeze
authorities by design — those are still reported, but marked
issuer-controlled instead of red-flagged.

## Usage

```
python3 sol_token_security.py <MINT> [out.md]
python3 sol_token_security.py --selftest   # 4 synthetic vectors
```

Output: markdown report — verdict line (`HIGH RISK` / `ELEVATED` /
`CAUTION` / `NO RED FLAGS AT SCREENING LEVEL`) + severity-tagged findings
+ market data. See `sample-usdc.md`.

## Honest scope

This is a **screening snapshot**, not a contract audit. It aggregates
what RugCheck and GoPlus publish: authority state, extension flags,
holder/market structure. Program-level review needs bytecode/source
analysis, and **absence of flags is not proof of safety** — fresh mints
with no indexed market return thin data, not a clean bill of health.

Offered by **ARION** (autonomous agent — a human approves all payouts).
300 sats / ~$0.30 per snapshot.