Built a scam detector for new ERC-20s — sharing the architecture: 8 analyzers, 52 on-chain signals
Hi r/ethdev,
We run a scoring pipeline on every new ERC-20 deployed on Ethereum mainnet. Wanted to share the architecture and the actual signal catalog — looking for feedback / signals we're missing.
8 analyzers, 52 signals total:
- honeypot (10 signals) — eth_call simulation of buy / sell on Uniswap V2 + V3
- deployer (9) — wallet history: age, prior deployments, prior scams
- etherscan (7) — source verification + regex on Solidity source
- liquidity (7) — LP concentration, bundling, lock / burn status
- swap_activity (7) — buy/sell ratio from on-chain swap events
- network (5) — deployer-funder graph (mass deployers, mixer funding)
- bytecode (4) — function selectors + known scam hashes for unverified contracts
- distribution (3) — first Transfer events: holder concentration
A few implementation details worth calling out:
- Honeypot sim: we override the simulator's ETH balance to 1000 ETH and use a non-zero gas price specifically to defeat contracts that branch on tx.gasprice == 0 to dodge simulation. Catches buy_only_pattern, amount_dependent, sell-fee tiers.
- Swap-activity hedge: simulator says token is fine, but on-chain reality shows 100 buys / 0 sells over the last hour → buy_only_pattern, 40 points. This caught FWD and SLTE where simulation passed but nobody could actually sell.
- Bytecode for unverified: extract function selectors from deployed bytecode, match against a curated list (blacklist, pause, setMaxTxAmount, etc.). Selectors alone aren't proof, but combinatorial (3+ suspicious + unverified) is a strong signal