This documentation provides a detailed explanation of how our system distinguishes between various types of transactions – such as Bundles, Sniper trades, Developer Buys/Sells, Sniper Clusters, and Sniper Bot activities – based solely on transaction characteristics and filtering logic.
A Bundle is defined as a group of trades that occur in rapid succession and share the same slot (a blockchain-specific grouping). The filtering process follows these steps:
get_all_trades(mint)
function) for a given token (mint address).
filter_small_transactions(trades, threshold=Decimal("0.05"))
function retains only those trades with a converted amount of at least 0.05 SOL, filtering out smaller, less significant trades.
slot
value using the group_by_slot(trades)
function. Only groups containing at least two transactions are considered valid bundles.
net_result = total_sell - total_buy
// Pseudocode Example for Bundle Detection: filteredTrades = filter_small_transactions(allTrades, threshold=0.05); bundles = group_by_slot(filteredTrades); for each bundle in bundles { totalBuy = sum(buy trades); totalSell = sum(sell trades); netResult = totalSell - totalBuy; tag bundle as profit/loss/break-even based on netResult; }
Developer transactions are identified by comparing the transaction’s traderPublicKey
with the creator’s key stored in the tokens table. There are two primary types:
traderPublicKey
in the transaction matches the creator’s key from the tokens record, it is flagged as a Developer Buy.
traderPublicKey
, it is recognized as a Developer Sell.
The functions process_dev_bought
and process_dev_sold
are responsible for scanning new updates (from the tokens_update
table) and verifying whether the trader’s public key matches the token creator’s key.
// Pseudocode Example for Developer Transaction Detection: if (update.txType == 'buy') { if (token.traderPublicKey == update.traderPublicKey) { // Mark as Developer Buy } } else if (update.txType == 'sell') { if (token.traderPublicKey == update.traderPublicKey) { // Mark as Developer Sell } }
Sniper transactions are characterized by their extremely short time window, typically occurring immediately after a token is created. The filtering logic includes:
tokens
table for tokens created within the last 10 minutes.
created_at
timestamp.
tokens_update
table.
sniper
table for further analysis.
// Pseudocode Example for Sniper Detection: for each token created in last 10 minutes { windowStart = token.created_at; windowEnd = windowStart + 1 seconds; sniperTrades = get trades from tokens_update between windowStart and windowEnd; if (sniperTrades exist) { insert sniperTrades into sniper table; } }
Sniper Clusters are groups of similar sniper transactions that indicate coordinated trading behavior. The process involves:
sniper
table are grouped by their slot
and the processed_at
time, which is rounded to the nearest minute.
traderPublicKey
values.
sniper_cluster
table.
// Pseudocode Example for Sniper Cluster Detection: groups = group sniper trades by (slot, round(processed_at to minute)); for each group with >= 2 trades { signature = sorted unique traderPublicKeys (joined by commas); if (signature occurs in multiple groups) { insert cluster (signature, token, group time) into sniper_cluster; } }
The Sniper Bot module is designed to detect automated or repetitive sniping behavior. It operates by:
sniper_wallets
table are collected. These entries originate from sniper transactions already flagged as potentially suspicious.
traderPublicKey
and the trade amount (solAmount
). This grouping is based on the assumption that a genuine trader would not repeatedly execute transactions with the same amount in rapid succession.
tokens
table. The enriched data is then stored in the sniper_bot
table.
// Pseudocode Example for Sniper Bot Filtering: groupedWallets = group new sniper_wallets entries by (traderPublicKey, solAmount); for each group { if (group count >= threshold) { tokenDetails = fetch token info by mint; insert record into sniper_bot with wallet, solAmount, tokenDetails, and transaction type; } }
The filtering logic of our system is based on a combination of transaction characteristics such as timing, value, and participant identity. By applying these specific criteria:
This multi-layered approach enables real‑time monitoring and differentiation of complex trading patterns, which is essential for market analysis and risk management.