This documentation provides a detailed explanation of how our system distinguishes between various types of transactions – such as Bundles, Sniper trades, Developer Buys/Sells, Sniper Clusters, and Sniper Bot activities – based solely on transaction characteristics and filtering logic.
A Bundle is defined as a group of trades that occur in rapid succession and share the same slot (a blockchain-specific grouping). The filtering process follows these steps:
get_all_trades(mint) function) for a given token (mint address).
filter_small_transactions(trades, threshold=Decimal("0.05")) function retains only those trades with a converted amount of at least 0.05 SOL, filtering out smaller, less significant trades.
slot value using the group_by_slot(trades) function. Only groups containing at least two transactions are considered valid bundles.
net_result = total_sell - total_buy
// Pseudocode Example for Bundle Detection:
filteredTrades = filter_small_transactions(allTrades, threshold=0.05);
bundles = group_by_slot(filteredTrades);
for each bundle in bundles {
totalBuy = sum(buy trades);
totalSell = sum(sell trades);
netResult = totalSell - totalBuy;
tag bundle as profit/loss/break-even based on netResult;
}
Developer transactions are identified by comparing the transaction’s traderPublicKey with the creator’s key stored in the tokens table. There are two primary types:
traderPublicKey in the transaction matches the creator’s key from the tokens record, it is flagged as a Developer Buy.
traderPublicKey, it is recognized as a Developer Sell.
The functions process_dev_bought and process_dev_sold are responsible for scanning new updates (from the tokens_update table) and verifying whether the trader’s public key matches the token creator’s key.
// Pseudocode Example for Developer Transaction Detection:
if (update.txType == 'buy') {
if (token.traderPublicKey == update.traderPublicKey) {
// Mark as Developer Buy
}
} else if (update.txType == 'sell') {
if (token.traderPublicKey == update.traderPublicKey) {
// Mark as Developer Sell
}
}
Sniper transactions are characterized by their extremely short time window, typically occurring immediately after a token is created. The filtering logic includes:
tokens table for tokens created within the last 10 minutes.
created_at timestamp.
tokens_update table.
sniper table for further analysis.
// Pseudocode Example for Sniper Detection:
for each token created in last 10 minutes {
windowStart = token.created_at;
windowEnd = windowStart + 1 seconds;
sniperTrades = get trades from tokens_update between windowStart and windowEnd;
if (sniperTrades exist) {
insert sniperTrades into sniper table;
}
}
Sniper Clusters are groups of similar sniper transactions that indicate coordinated trading behavior. The process involves:
sniper table are grouped by their slot and the processed_at time, which is rounded to the nearest minute.
traderPublicKey values.
sniper_cluster table.
// Pseudocode Example for Sniper Cluster Detection:
groups = group sniper trades by (slot, round(processed_at to minute));
for each group with >= 2 trades {
signature = sorted unique traderPublicKeys (joined by commas);
if (signature occurs in multiple groups) {
insert cluster (signature, token, group time) into sniper_cluster;
}
}
The Sniper Bot module is designed to detect automated or repetitive sniping behavior. It operates by:
sniper_wallets table are collected. These entries originate from sniper transactions already flagged as potentially suspicious.
traderPublicKey and the trade amount (solAmount). This grouping is based on the assumption that a genuine trader would not repeatedly execute transactions with the same amount in rapid succession.
tokens table. The enriched data is then stored in the sniper_bot table.
// Pseudocode Example for Sniper Bot Filtering:
groupedWallets = group new sniper_wallets entries by (traderPublicKey, solAmount);
for each group {
if (group count >= threshold) {
tokenDetails = fetch token info by mint;
insert record into sniper_bot with wallet, solAmount, tokenDetails, and transaction type;
}
}
The filtering logic of our system is based on a combination of transaction characteristics such as timing, value, and participant identity. By applying these specific criteria:
This multi-layered approach enables real‑time monitoring and differentiation of complex trading patterns, which is essential for market analysis and risk management.