Skip to content

v4.0.0 — Meme Coin Security Module

Choose a tag to compare

View all tags
@shuvonsec shuvonsec released this 13 Apr 17:12
· 206 commits to main since this release
v4.0.0
8938285

Meme Coin Security Module

New /token-scan command and full meme coin rug pull detection for EVM and Solana tokens.

New Files (8)

Component What It Does
skills/meme-coin-audit/SKILL.md New skill — rug pull detection, token authority checks, bonding curve exploits
tools/token_scanner.py Automated red flag scanner — hidden mint, honeypot, fee traps, LP drain, fake renounce
agents/token-auditor.md Fast token audit agent (8-class protocol)
commands/token-scan.md /token-scan <contract> — instant rug pull analysis
web3/10-meme-coin-bugs.md 8 meme coin bug classes with real exploit examples
web3/11-solana-token-audit.md Solana-specific: SPL authorities, Token-2022, pump.fun, Raydium, Jupiter, PDA patterns
web3/12-dex-lp-attacks.md DEX/LP attacks: sandwich, pool sniping, CL position manipulation
tests/test_token_scanner.py 39 tests for the token scanner

8 Bug Classes Covered

  1. Hidden Mint / Unlimited Supply — deployer mints post-launch, dumps on LP
  2. Honeypot / Transfer Restriction — buy works, sell blocked (blacklists, max tx, approve override)
  3. Fee Manipulation — sell fee set to 99% after initial buys
  4. Liquidity Pool Drain — LP removal, migration, sync manipulation
  5. Bonding Curve Manipulation — pump.fun graduation exploits, virtual reserve inflation
  6. Authority Retention (Solana) — retained mint/freeze/update authorities, Token-2022 extensions
  7. Fake Renounce / Hidden Ownership — ownership appears renounced but backdoor control retained
  8. Sandwich Amplification by Design — zero slippage auto-swaps, rebase on transfer

Solana Coverage

  • SPL Token authority checklist (mint, freeze, update, close)
  • Token-2022 extension risk matrix (transfer hooks, permanent delegate, transfer fees)
  • pump.fun bonding curve analysis (graduation sniping, bundled buys, fee extraction)
  • Raydium LP pool vulnerabilities (burn vs lock, skewed ratios)
  • Jupiter routing exploits (fake pool injection, price oracle manipulation)
  • PDA authority patterns (hidden control via upgradeable programs)
  • Anchor program vulnerabilities (missing signer/owner checks, unchecked arithmetic)

Grep Arsenal Expansion

3 new grep blocks added to web3/03-grep-arsenal.md:

  • Block 11 — Token Rug Pull Detection (EVM)
  • Block 12 — Solana Token Authorities
  • Block 13 — DEX / LP Manipulation

Quick Start

# Scan an EVM token contract
python3 tools/token_scanner.py contracts/Token.sol

# Scan a Solana program
python3 tools/token_scanner.py programs/token/ --chain solana --recursive

# Full directory scan with markdown report
python3 tools/token_scanner.py src/ --recursive --output findings/token-report.md

Stats

  • 3,832 lines added across 11 files
  • 39 new tests, 250 total passing
  • 9 skills, 14 commands, 8 agents

AwareXone
Powered by AwareXone.com — Your AI Agent Against Scams & Fraud

Assets 2
Loading