moof: the whitepaper

on-chain forensics for every Solana token. see who's really holding the bag before you ape.

version 1.0 · contract address: coming soon

abstract

Solana is the busiest chain in crypto and the home of the memecoin market. Anyone can launch a token in seconds, and most launches are stacked against the buyer before the first candle prints. Developers split supply across dozens of "independent" wallets, buy the launch block through bundles, let snipers front-run the public, and pay influencers to buy early and post late.

Every one of those moves leaves a trail on-chain. The trail is just too long and too noisy for a person to follow by hand in the minutes before they buy.

moof is an automated on-chain detective. It takes one Solana token address and, in a single pass, traces where every top holder's money came from, groups wallets controlled by the same person, pulls the deployer's full launch history, lines up influencer buys against their posts on X, and compresses all of it into one 0–100 number: the moof score.

This paper explains the problem, the method, the scoring model, the X agent, the role of the $moof token, and the limits of what automated forensics can tell you.

1. the problem: the game is rigged and you can't see the dealer

Every degen knows the pattern. A chart is ripping, the holder count looks healthy, the top 10 looks spread out, and you buy. Twenty minutes later it's down 90% and the dev wallet is "coincidentally" empty.

Here's what was hiding in plain sight.

1.1 fake decentralization

Forty holders at 1.5% each looks organic. Forty holders all funded by the same wallet ten minutes before launch is one person holding 60% of supply. Holder lists show balances. They don't show relationships.

1.2 bundled launches

The deployer buys a large slice of supply across many wallets in the same block as the first trade. On the chart it looks like a fair launch with strong early demand. In reality the dev bought from themselves.

1.3 snipers

Bots and insiders buy within seconds of liquidity going live, before any human could have seen the token. They sit on cheap supply and sell into the first wave of real buyers.

1.4 serial ruggers

The same people launch, pump and dump over and over, usually from a fresh wallet funded by the last one. Every new ticker looks like a clean slate. It isn't.

1.5 paid shills

Influencers (KOLs) buy quietly at a low market cap, then post "just aped" to their followers at a much higher one. Their audience becomes the exit liquidity.

1.6 why existing tools miss it

Most scanners stop at "here are the top holders" or check the token contract for mint and freeze authority. Those checks matter, but they can't see who controls the wallets, and on Solana memecoins who is the whole game. The data that answers it is public. It's just buried under millions of transactions.

moof does the tracing for you.

2. the solution: one address in, the whole truth out

moof takes one input, a Solana token address, and runs a full forensic investigation:

1. Token profile: name, ticker, supply, price, market cap and the top 100 holders.
2. Funding trace: for every top holder, moof walks back through incoming SOL transfers to find who funded the wallet.
3. Funding graph: an interactive map of wallets and money flows that shows clusters, dev links and exchange-funded wallets at a glance.
4. Ring sorting: every holder is placed in one of seven rings: dev, hidden insiders, bundlers, snipers, fresh wallets, KOLs or organic holders.
5. Rap sheet: every other token the deployer and its wallet family have launched, and how each one ended.
6. Receipts: tracked KOL wallets are matched against the token's trades and their posts on X.
7. Score and verdict: everything rolls up into one 0–100 score with a verdict you can read in half a second.

Every scan gets its own link and share card, so your group chat sees the same receipts you do.

3. methodology

This section describes what moof actually does under the hood, including the exact thresholds it uses.

3.1 data sources

• Helius: Solana RPC, enhanced transaction history, wallet funding lookups and token creation history.
• Birdeye: token metadata, price, market cap and the top holder list.
• A curated list of known exchange hot wallets, so money coming straight from a centralized exchange is labeled as such.
• A curated list of tracked KOL wallets and X handles, used for receipts.

moof only reads public data. It never asks for a wallet connection, a signature or a private key.

3.2 funding trace

For each of the top 100 holders, moof follows the SOL that funded the wallet, hop by hop, up to 5 hops back. A trail stops when it:

• reaches the deployer or a wallet that funded the deployer, which marks the holder as a hidden insider;
• reaches a known exchange wallet, which usually means a separate, real person; or
• runs out of funding history or hits the hop limit.

3.3 clusters

Separately from the dev link, moof groups holders by shared funders. Two or more holders funded by the same wallet form a cluster. Clusters count toward the hidden insiders ring, because one funder bankrolling several "independent" holders is the most common way to fake decentralization.

3.4 launch analysis

moof pulls the token's earliest successful transactions and reconstructs the launch:

• Bundlers: any block where 4 or more buys land together. Every wallet in that block, other than the deployer, is flagged.
• Snipers: wallets that bought within 4 seconds of the first swap.

3.5 fresh wallets

A holder is fresh if the wallet was first funded within the last 7 days and holds only this token. Fresh, single-purpose wallets are cheap to create and a common way to spread out supply.

3.6 performance

Holder traces run in parallel with bounded concurrency. Concurrent requests for the same token share one in-flight scan, and finished scans are cached for 10 minutes, so a token that's trending in a group chat loads instantly for everyone after the first person scans it.

4. the rings: who actually owns this token

Each ring shows the share of supply it holds and lights up green, yellow or red depending on how dangerous that share is.

The organic ring works the other way around from the rest: more is better. It's green at 50% of supply or more, yellow from 25%, and red below 25%.

If organic holders own most of the supply, the token is real. If they don't, you just found the exit liquidity, and it's you.

5. the funding graph: follow the money, find the ring

The graph turns the trace into something you can see. Node types:

• dev: the deployer, the center of gravity.
• dev funder: wallets that sent the deployer its SOL.
• insider: holders whose path leads back to the dev, even through several hops.
• cluster: holders sharing a funder. One person, many wallets.
• cex: a known exchange wallet at the end of a trail.
• holder / funder: everything else on the path.

Click any wallet and moof highlights its full path back to the dev. The fake decentralization falls apart in front of you.

6. the rap sheet: every dev has a history

Rugs aren't random. The same people do it over and over.

6.1 the wallet family tree

moof starts at the deployer and walks its funding relationships up to 3 hops, building a family of related wallets. Then it pulls every token any wallet in that family created, keeping the 20 most recent launches.

6.2 what counts as a rug

For each past launch, moof finds its peak market cap within the first 24 hours. If the price later fell to 10% of that peak or lower, the launch counts as rugged. moof also measures how many minutes passed before the dev's first sell.

6.3 the grade

The rap sheet shows launches, rugs, peak versus current market cap, and the average minutes until the dev's first sell. An A is a builder with a clean history. An F means you've met this rug before, wearing a different ticker.

7. the receipts: catch the shill in 4k

Influencer marketing on Solana runs on one move: buy early, post late, sell into the followers.

moof matches tracked KOL wallets against the token's trade history and their posts on X. When a KOL bought before posting about the token, moof shows the receipt:

• the handle and the post
• the wallet that bought
• how many minutes before the post they bought
• market cap at entry versus market cap when they posted
• whether they sold within 60 minutes of buying

No more guessing who's actually early and who's being paid to be early.

8. the moof score

Everything feeds into one 0–100 score. Higher is safer.

score = 0.40 × I  +  0.30 × D  +  0.15 × K  +  0.15 × B

The result is rounded to a whole number and given a verdict:

• 80–100: clean. Green light. The holders look real.
• 50–79: sus. Yellow flag. Something's off, so size accordingly.
• 0–49: stay away. Red alert. You're looking at a trap.

8.1 why these weights

Hidden insiders carry the most weight on purpose. A token secretly held by its own dev is the biggest threat to your bag, because that supply can hit the market at any moment. Under this model, 40% of supply held by hidden insiders zeroes out the largest component by itself.

The dev's history is next, because past behavior is the best predictor of future behavior. KOL receipts and launch fairness each carry less weight: they're strong warning signs, but on their own they're less likely to mean a total loss.

8.2 a worked example

A token with 12% hidden insiders, a grade C deployer, one KOL receipt and 8% held by bundlers and snipers:

I = 100 − 2.5 × 12 = 70
D = 60
K = 60
B = 100 − 3 × 8   = 76

score = 0.40×70 + 0.30×60 + 0.15×60 + 0.15×76
      = 28 + 18 + 9 + 11.4
      = 66.4 → 66 (sus)

9. the moof agent on X

You don't need the website to use moof. Tag @moofagent on X with a Solana contract address and the agent replies in the thread with the scan:

• the moof score and verdict
• hidden insider share
• the dev's launch count, rug count and grade
• KOL receipts, if any
• a link to the full scan

How it runs:

• The agent checks for new mentions every minute.
• It replies to up to 5 mentions per run, and each mention is answered once.
• Each account can get up to 10 replies per day, which keeps the agent fast for everyone and resistant to spam.

This turns every timeline debate about "is this a rug?" into a public, timestamped answer anyone in the thread can check.

10. $moof

Contract address: coming soon. Until it's posted on this site and on @moofagent, any address claiming to be $moof is not.

10.1 utility

moof is free to use. Everyone gets 3 free scans per day, because everyone deserves to see the truth before they buy. Tokens that someone else has scanned recently load from cache and don't use up your allowance.

Real hunters don't scan three tokens a day. They scan everything. Holding $moof unlocks unlimited scans.

10.2 the flywheel

1. degens get rugged and look for answers
2. moof gives them receipts they can share
3. shared scans and agent replies pull in more users
4. power users hold $moof to scan without limits
5. more users means more scans, more data and sharper detection

The more the market gets rugged, the more moof is needed. It's the rare token that gets stronger when the market gets dirtier.

10.3 launch details

Supply, distribution and launch venue will be announced alongside the contract address. moof will hold itself to the same standard it holds everyone else to: you'll be able to scan $moof with moof.

11. roadmap

These are planned directions, not promises or dates.

• Phase 1: the scanner. Full forensic scans, funding graph, rap sheets, receipts, the moof score and shareable scan pages. Live.
• Phase 2: the agent. @moofagent answering scans directly on X. Live.
• Phase 3: the token. $moof launch and holder-gated unlimited scans.
• Phase 4: watchlists and alerts. Get pinged when a token you hold changes rings, when the dev moves supply, or when a tracked KOL buys.
• Phase 5: the public record. A searchable database of deployers, wallet families and KOL receipts that makes repeat rugging expensive.

12. limitations

Automated forensics is powerful, but it isn't magic. Here's what moof can get wrong:

• Hop limits. Funding is traced 5 hops back and family trees 3 hops out. A determined actor can route money through more hops, or through bridges and mixers, to break the trail.
• Exchange funding hides links. Wallets funded from an exchange are treated as likely independent. An insider who withdraws to many wallets from the same exchange account will look organic.
• Top 100 only. moof analyzes the top 100 holders. Supply spread thinly across many small wallets can slip under the radar.
• Curated lists. Exchange and KOL coverage depends on lists that need regular updates. A KOL moof doesn't track can't produce a receipt.
• Rug definition. A 90% drop from the 24-hour peak is a strong signal but not proof of intent. Some honest launches simply fail.
• A snapshot in time. A scan reflects the chain when it ran. Holders, prices and dev behavior can change minutes later.

13. security and privacy

• moof is read-only. It never asks you to connect a wallet, sign a transaction or share a private key. Anyone asking for that in moof's name is a scammer.
• Scans use public blockchain data only.
• The only thing moof stores about visitors is a short-lived daily scan counter used for the free allowance.

14. why now

Launchpads made deploying a token take seconds, and rugging one takes just as little effort. Retail has better charts than ever and almost no visibility into who's on the other side of the trade. The tools that exist are built for analysts, not for the person about to ape from their phone.

moof closes that gap: pro-level wallet forensics, delivered as one number, one link, or one reply on X.

15. the vision

moof starts as a scanner. It ends as the trust layer for Solana memecoins: the check people run before they buy, the link that settles arguments in group chats, and a public record that makes rugging expensive.

When every dev knows their wallets will be traced, every KOL knows their buys will be timestamped against their posts, and every bundler knows the block will be exposed, the game changes.

Our mascot is a little carrot that pops up out of the dirt, because digging up what's buried is literally the job.

moof doesn't make you lucky. It makes you informed. In a casino where the house hides its cards, being informed is the biggest edge you can get.

16. disclaimer

moof is an analysis tool, not financial advice. Scores, labels and receipts are generated automatically from public on-chain data and can be incomplete or wrong. A clean score is not a guarantee, and a bad score is not an accusation against any person. $moof is a utility token with no promise of profit or return. Always do your own research, check any contract address against official moof channels, and never risk more than you can afford to lose.

sniff out the insiders before you ape. follow @moofagent