Open Source AI trading agent that operates autonomously across 1000+ markets - Polymarket, Kalshi, Binance, Hyperliquid, Solana DEXs, 5 EVM chains. Scans for edge, executes instantly, manages risk while you sleep. Agent commerce protocol for machine-to-machine payments. Self-hosted. Built on Claude.
This report summarizes scanner evidence for alsk1992/CloddsBot, a TypeScript project with 2,959 GitHub stars. SynthScan examined 376,165 lines of code across 817 source files, recording 725 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 312 finding(s).
Are imports declared and package/API names verified? 24 finding(s).
Are wrappers, guards, and repeated structures necessary? 602 finding(s).
Which changes need focused human review? 725 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 725 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/types/signal-bus.ts | 11 | // ── Event payloads ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/types/signal-bus.ts | 44 | // ── SignalBus interface ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 22 | // ── Defaults ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 46 | // ── Interface ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 58 | // ── Factory ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 95 | // ── Helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 129 | // ── Validation ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 178 | // ── Execution ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 400 | // ── Serial drain queue ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 421 | // ── Daily reset ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 438 | // ── Lifecycle ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/router.ts | 482 | // ── Public API ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/types.ts | 11 | // ── Configuration ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/types.ts | 56 | // ── Execution tracking ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/signal-router/types.ts | 71 | // ── Statistics ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 10 | // ── Internal store ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 18 | // ── EVM Drainers — Inferno Drainer (Check Point Research, Scam Sniffer) ───── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 35 | // ── EVM Drainers — Pink Drainer (Etherscan-tagged) ────────────────────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 43 | // ── EVM Drainers — Monkey, Angel, Venom, MS (Etherscan/ZachXBT) ───────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 57 | // ── EVM Phishing / Fake Airdrop (Etherscan Fake_Phishing labels) ───────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 68 | // ── EVM Rug Pull Deployers (Etherscan/BscScan-documented) ──────────────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 79 | // ── EVM Honeypot Contracts (Etherscan-tagged) ──────────────────────────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 88 | // ── Famous Exploits — EVM (post-mortems, Chainalysis, Etherscan) ───────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 102 | // ── Famous Exploits — Solana (CertiK, Chainalysis) ────────────────────────── | COMMENT |
| MEDIUM | src/security/scam-db.ts | 108 | // ── Solana Drainers / Rug Pullers (Mandiant, CertiK, Scam Sniffer) ────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 7 | // ── Rule definition ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 16 | // ── Rules by category ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 19 | // ── shell_exec (12) ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/code-scanner.ts | 33 | // ── network_exfil (10) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/code-scanner.ts | 45 | // ── wallet_drain (12) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 59 | // ── prompt_injection (8) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 69 | // ── obfuscation (8) ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 79 | // ── hidden_chars (6) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 87 | // ── data_access (7) ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 96 | // ── crypto_theft (8) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 106 | // ── privilege_escalation (4) ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/code-scanner.ts | 113 | // ── Combo boost definitions ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/code-scanner.ts | 129 | // ── Shannon entropy ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/code-scanner.ts | 146 | // ── Risk level mapping ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/shield.ts | 26 | // ── Interface ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/shield.ts | 37 | // ── Implementation ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/shield.ts | 94 | // ── Singleton ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/tx-validator.ts | 9 | // ── Safe program whitelist ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/tx-validator.ts | 39 | // ── Amount thresholds ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/tx-validator.ts | 55 | // ── NLP social engineering patterns ────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/sanitizer.ts | 9 | // ── Zero-width characters ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/sanitizer.ts | 25 | // ── RTL overrides ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/sanitizer.ts | 41 | // ── Homoglyph map (Cyrillic/Greek → Latin confusables) ──────────────────────── | COMMENT |
| MEDIUM | src/security/sanitizer.ts | 66 | // ── Prompt injection patterns ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/sanitizer.ts | 86 | // ── Null bytes & control characters ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/address-checker.ts | 10 | // ── Defaults ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/address-checker.ts | 15 | // ── Chain detection (matches token-security pattern) ───────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/address-checker.ts | 23 | // ── Risk level mapping ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/security/address-checker.ts | 33 | // ── Solana RPC helper ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/address-checker.ts | 53 | // ── EVM RPC helper ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/address-checker.ts | 73 | // ── Solana address check ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/security/address-checker.ts | 163 | // ── EVM address check ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/strategies/crypto-hft/orderbook.ts | 10 | // ── Spread Tracker (rolling 60s window) ───────────────────────────────────── | COMMENT |
| MEDIUM | src/strategies/crypto-hft/orderbook.ts | 81 | // ── Depth Tracker (collapse detection) ────────────────────────────────────── | COMMENT |
| MEDIUM | src/strategies/crypto-hft/orderbook.ts | 151 | // ── Bid Staleness Tracker ─────────────────────────────────────────────────── | COMMENT |
| 323 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/multichain-race-urls.test.ts | 11 | function getRaceUrlsInFreshProcess(env: Record<string, string>): string[] { | CODE |
| LOW | tests/unit/fast-broadcast-byte-parity.test.ts | 17 | function startDeterministicMockChain(): Promise<{ url: string; close: () => void; capturedRawTxs: string[] }> { | CODE |
| LOW | src/index.ts | 113 | function validateStartupRequirements(): void { | CODE |
| LOW | src/opportunity/executor.ts | 148 | export function createOpportunityExecutor( | CODE |
| LOW | src/opportunity/correlation.ts | 234 | function calculateTheoreticalProbability( | CODE |
| LOW | src/opportunity/analytics.ts | 242 | export function createOpportunityAnalytics(db: Database): OpportunityAnalytics { | CODE |
| LOW | src/opportunity/analytics.ts | 886 | function getPerformanceAttribution(options?: { days?: number }): PerformanceAttribution { | CODE |
| LOW | src/opportunity/matching.ts | 457 | function calculateJaccardSimilarity(tokensA: string[], tokensB: string[]): number { | CODE |
| LOW | src/opportunity/matching.ts | 468 | function calculateCosineSimilarity(a: number[], b: number[]): number { | CODE |
| LOW | src/opportunity/combinatorial.ts | 152 | export function findRebalanceOpportunities( | CODE |
| LOW | src/opportunity/combinatorial.ts | 196 | function calculateRebalanceConfidence( | CODE |
| LOW | src/opportunity/combinatorial.ts | 224 | export function findCombinatorialOpportunities( | CODE |
| LOW | src/opportunity/combinatorial.ts | 385 | function analyzeCombinatorialArbitrage( | CODE |
| LOW | src/opportunity/combinatorial.ts | 533 | function calculateCombinatorialConfidence( | CODE |
| LOW | src/opportunity/combinatorial.ts | 567 | function checkExhaustiveConditions( | CODE |
| LOW | src/opportunity/combinatorial.ts | 759 | export function calculateOrderBookImbalance( | CODE |
| LOW | src/opportunity/combinatorial.ts | 860 | export async function scanCombinatorialArbitrage( | CODE |
| LOW | src/opportunity/combinatorial.ts | 977 | export function saveCombinatorialOpportunity( | CODE |
| LOW | src/opportunity/index.ts | 585 | async function findCrossPlatformArbitrage( | CODE |
| LOW | src/opportunity/hft.ts | 138 | function normalizeBinaryOrderbookToNo(orderbook: Orderbook): Orderbook { | CODE |
| LOW | src/opportunity/hft.ts | 274 | function buildOpportunityExecutionPlan( | CODE |
| LOW | src/opportunity/hft.ts | 349 | function buildVenueQuotesFromOpportunity( | CODE |
| LOW | src/percolator/execution.ts | 50 | export function createPercolatorExecution(config: PercolatorConfig): PercolatorExecutionService { | CODE |
| LOW | src/payments/x402/solana.ts | 382 | export function getAssociatedTokenAddress( | CODE |
| LOW | src/payments/x402/solana.ts | 408 | export function getAssociatedTokenAddressWithBump( | CODE |
| LOW | src/ledger/hooks.ts | 265 | export function captureOpportunityDecision( | CODE |
| LOW | src/infra/retry.ts | 164 | export function extractRetryAfterFromError(error: Error): number | null { | CODE |
| LOW | src/tools/sql.ts | 50 | function startsWithAllowedStatement(sql: string): boolean { | CODE |
| LOW | src/tools/sql.ts | 61 | function containsForbiddenKeywords(sql: string): string | null { | CODE |
| LOW | src/tools/message.ts | 259 | export function createTelegramMessageHandler( | CODE |
| LOW | src/tools/message.ts | 311 | export function createDiscordMessageHandler( | CODE |
| LOW | src/embeddings/index.ts | 29 | export function preloadTransformersPipeline(): void { | CODE |
| LOW | src/embeddings/index.ts | 39 | export function getTransformersPipelineIfReady(): Pipeline | null { | CODE |
| LOW | src/embeddings/index.ts | 251 | async function generateOpenAIEmbeddingBatch( | CODE |
| LOW | src/embeddings/index.ts | 294 | async function generateTransformersEmbedding(text: string): Promise<EmbeddingVector> { | CODE |
| LOW | src/embeddings/index.ts | 310 | async function generateTransformersEmbeddingBatch(texts: string[]): Promise<EmbeddingVector[]> { | CODE |
| LOW | src/embeddings/index.ts | 388 | async function generateLocalEmbeddingBatch(texts: string[]): Promise<EmbeddingVector[]> { | CODE |
| LOW | src/cache/index.ts | 176 | async function getOrSet( | CODE |
| LOW | src/exchanges/hyperliquid/index.ts | 626 | export async function getUserNonFundingLedgerUpdates( | CODE |
| LOW | src/exchanges/hyperliquid/index.ts | 771 | export async function getPerpsAtOpenInterestCap(): Promise<string[]> { | CODE |
| LOW | src/exchanges/hyperliquid/index.ts | 1159 | export async function transferBetweenSpotAndPerp( | CODE |
| LOW | src/nodes/index.ts | 364 | function createNotificationService(): NotificationService { | CODE |
| LOW | src/bridge/wormhole.ts | 91 | function resolvePrivateKeyForChain(chain: Chain): string | undefined { | CODE |
| LOW | src/strategies/hft-divergence/strategy.ts | 45 | export function createHftDivergenceEngine( | CODE |
| LOW | src/providers/health.ts | 43 | export function createProviderHealthMonitor( | CODE |
| LOW | src/solana/wallet.ts | 53 | export async function signAndSendVersionedTransaction( | CODE |
| LOW | src/solana/meteora.ts | 296 | export async function executeMeteoraDlmmSwapExactOut( | CODE |
| LOW | src/solana/meteora.ts | 344 | export async function executeMeteoraDlmmSwapWithPriceImpact( | CODE |
| LOW | src/solana/meteora.ts | 379 | export async function getMeteoraDlmmQuoteExactOut( | CODE |
| LOW | src/solana/meteora.ts | 424 | export async function initializeMeteoraDlmmPosition( | CODE |
| LOW | src/solana/meteora.ts | 478 | export async function createEmptyMeteoraDlmmPosition( | CODE |
| LOW | src/solana/meteora.ts | 515 | export async function getMeteoraDlmmPositionsByUser( | CODE |
| LOW | src/solana/meteora.ts | 547 | export async function getAllMeteoraDlmmPositionsByUser( | CODE |
| LOW | src/solana/meteora.ts | 633 | export async function removeMeteoraDlmmLiquidity( | CODE |
| LOW | src/solana/meteora.ts | 744 | export async function claimAllMeteoraDlmmSwapFees( | CODE |
| LOW | src/solana/meteora.ts | 819 | export async function claimAllMeteoraDlmmRewards( | CODE |
| LOW | src/solana/meteora.ts | 921 | export async function getMeteoraDlmmEmissionRate( | CODE |
| LOW | src/solana/meteora.ts | 1001 | export async function createCustomizableMeteoraDlmmPool( | CODE |
| LOW | src/solana/swarm-signals.ts | 734 | export function destroySwarmSignalMonitor(): void { | CODE |
| LOW | src/solana/pumpapi.ts | 163 | export function getBondingCurveTokenAccount( | CODE |
| 153 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/AUTHENTICATION.md | 92 | keyManager.setKey('your-api-key'); | CODE |
| HIGH | docs/OPINION.md | 35 | export OPINION_API_KEY="your-api-key" | CODE |
| HIGH | docs/TRADING.md | 39 | "apiKey": "your-api-key", | CODE |
| HIGH | docs/TRADING.md | 2100 | export BAGS_API_KEY="your-api-key" # From dev.bags.fm | CODE |
| HIGH | docs/TRADING.md | 2363 | export PREDICTFUN_API_KEY="your-api-key" | CODE |
| HIGH | src/cli/commands/index.ts | 2082 | console.log(` clodds config set ${provider}.apiKey YOUR_API_KEY`); | CODE |
| HIGH | src/skills/executor.ts | 389 | example: 'export LIGHTER_API_KEY="your-api-key"', | CODE |
| HIGH | src/skills/bundled/opinion/SKILL.md | 17 | export OPINION_API_KEY="your-api-key" | CODE |
| HIGH | src/skills/bundled/opinion/SKILL.md | 69 | export OPINION_API_KEY="your-api-key" | CODE |
| HIGH | src/skills/bundled/predictfun/SKILL.md | 20 | export PREDICTFUN_API_KEY="your-api-key" | CODE |
| HIGH | src/skills/bundled/predictfun/SKILL.md | 73 | export PREDICTFUN_API_KEY="your-api-key" | CODE |
| HIGH⚡ | src/skills/bundled/trading-futures/SKILL.md | 33 | BINANCE_API_KEY=your_api_key | CODE |
| HIGH⚡ | src/skills/bundled/trading-futures/SKILL.md | 37 | BYBIT_API_KEY=your_api_key | CODE |
| HIGH⚡ | src/skills/bundled/trading-futures/SKILL.md | 41 | MEXC_API_KEY=your_api_key | CODE |
| HIGH | src/skills/bundled/mexc-futures/SKILL.md | 20 | export MEXC_API_KEY="your-api-key" | CODE |
| HIGH | src/skills/bundled/binance-futures/SKILL.md | 20 | export BINANCE_API_KEY="your-api-key" | CODE |
| HIGH | src/skills/bundled/bybit-futures/SKILL.md | 20 | export BYBIT_API_KEY="your-api-key" | CODE |
| HIGH | src/skills/bundled/bags/SKILL.md | 112 | export BAGS_API_KEY="your-api-key" # From dev.bags.fm | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/SKILLS.md | 209 | ### Step 1: Copy the folder | COMMENT |
| LOW | docs/SKILLS.md | 223 | ### Step 2: Verify | COMMENT |
| LOW | docs/SKILLS.md | 231 | ### Step 3: No step 3 | COMMENT |
| LOW | src/index.ts | 211 | // Step 1: Validate | COMMENT |
| LOW | src/index.ts | 222 | // Step 2: Load config | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 347 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 352 | // Step 2: Create swap from quote | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 373 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 378 | // Step 2: Create swap from quote | COMMENT |
| LOW⚡ | src/agents/handlers/solana.ts | 1448 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/agents/handlers/solana.ts | 1453 | // Step 2: Create swap from quote | COMMENT |
| LOW⚡ | src/agents/handlers/solana.ts | 1459 | // Step 3: Sign and send (Base58 encoded) | COMMENT |
| LOW | src/agents/handlers/solana.ts | 1646 | // Step 1: Create token info (multipart/form-data) | COMMENT |
| LOW | src/agents/handlers/solana.ts | 1668 | // Step 2: Create fee share config | COMMENT |
| LOW | src/agents/handlers/solana.ts | 1691 | // Step 3: Launch (correct field names: ipfs, wallet) | COMMENT |
| LOW | src/utils/json-utils.ts | 43 | // Step 1: Parse JSON | COMMENT |
| LOW | src/utils/json-utils.ts | 55 | // Step 2: Validate with schema if provided | COMMENT |
| LOW | src/cli/commands/index.ts | 2912 | // Step 0: Choose network | COMMENT |
| LOW | src/cli/commands/index.ts | 2933 | // Step 1: Find Python | COMMENT |
| LOW | src/cli/commands/index.ts | 2947 | // Step 2: Install btcli | COMMENT |
| LOW | src/cli/commands/index.ts | 2971 | // Step 3: Create wallet | COMMENT |
| LOW | src/cli/commands/index.ts | 3018 | // Step 4: Write config | COMMENT |
| LOW | src/cli/commands/index.ts | 3045 | // Step 5: Summary | COMMENT |
| LOW | src/cli/commands/onboard.ts | 138 | // Step 1: Anthropic API Key (Required) | COMMENT |
| LOW | src/cli/commands/onboard.ts | 164 | // Step 2: Telegram (Optional) | COMMENT |
| LOW | src/cli/commands/onboard.ts | 217 | // Step 3: Discord (Optional) | COMMENT |
| LOW | src/cli/commands/onboard.ts | 255 | // Step 4: Market Feeds | COMMENT |
| LOW | src/extensions/copilot-proxy/index.ts | 73 | // Step 1: Get Copilot token from GitHub | COMMENT |
| LOW⚡ | src/skills/bundled/bags/index.ts | 268 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/skills/bundled/bags/index.ts | 273 | // Step 2: Create swap transaction from quote | COMMENT |
| LOW⚡ | src/skills/bundled/bags/index.ts | 282 | // Step 3: Sign and send transaction (Base58 encoded) | COMMENT |
| LOW | src/skills/bundled/bags/index.ts | 740 | // Step 1: Create token info and metadata (multipart/form-data) | COMMENT |
| LOW | src/skills/bundled/bags/index.ts | 766 | // Step 2: Create fee share config (100% to creator by default) | COMMENT |
| LOW | src/skills/bundled/bags/index.ts | 799 | // Step 3: Create launch transaction (correct field names: ipfs, wallet) | COMMENT |
| LOW | src/gateway/launch-routes.ts | 528 | // Step 1: Resolve metadata URI | COMMENT |
| LOW | src/gateway/launch-routes.ts | 543 | // Step 2: Build bonding curve config | COMMENT |
| LOW | src/gateway/launch-routes.ts | 574 | // Step 3: Launch token | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/index.ts | 211 | // Step 1: Validate | COMMENT |
| LOW | src/index.ts | 222 | // Step 2: Load config | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 347 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 352 | // Step 2: Create swap from quote | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 373 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/solana/swarm-builders.ts | 378 | // Step 2: Create swap from quote | COMMENT |
| LOW⚡ | src/agents/handlers/solana.ts | 1448 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/agents/handlers/solana.ts | 1453 | // Step 2: Create swap from quote | COMMENT |
| LOW⚡ | src/agents/handlers/solana.ts | 1459 | // Step 3: Sign and send (Base58 encoded) | COMMENT |
| LOW | src/agents/handlers/solana.ts | 1646 | // Step 1: Create token info (multipart/form-data) | COMMENT |
| LOW | src/agents/handlers/solana.ts | 1668 | // Step 2: Create fee share config | COMMENT |
| LOW | src/agents/handlers/solana.ts | 1691 | // Step 3: Launch (correct field names: ipfs, wallet) | COMMENT |
| LOW | src/utils/json-utils.ts | 43 | // Step 1: Parse JSON | COMMENT |
| LOW | src/utils/json-utils.ts | 55 | // Step 2: Validate with schema if provided | COMMENT |
| LOW | src/cli/commands/index.ts | 2912 | // Step 0: Choose network | COMMENT |
| LOW | src/cli/commands/index.ts | 2933 | // Step 1: Find Python | COMMENT |
| LOW | src/cli/commands/index.ts | 2947 | // Step 2: Install btcli | COMMENT |
| LOW | src/cli/commands/index.ts | 2971 | // Step 3: Create wallet | COMMENT |
| LOW | src/cli/commands/index.ts | 3018 | // Step 4: Write config | COMMENT |
| LOW | src/cli/commands/index.ts | 3045 | // Step 5: Summary | COMMENT |
| LOW | src/cli/commands/onboard.ts | 138 | // Step 1: Anthropic API Key (Required) | COMMENT |
| LOW | src/cli/commands/onboard.ts | 164 | // Step 2: Telegram (Optional) | COMMENT |
| LOW | src/cli/commands/onboard.ts | 217 | // Step 3: Discord (Optional) | COMMENT |
| LOW | src/cli/commands/onboard.ts | 255 | // Step 4: Market Feeds | COMMENT |
| LOW | src/extensions/copilot-proxy/index.ts | 73 | // Step 1: Get Copilot token from GitHub | COMMENT |
| LOW⚡ | src/skills/bundled/bags/index.ts | 268 | // Step 1: Get quote | COMMENT |
| LOW⚡ | src/skills/bundled/bags/index.ts | 273 | // Step 2: Create swap transaction from quote | COMMENT |
| LOW⚡ | src/skills/bundled/bags/index.ts | 282 | // Step 3: Sign and send transaction (Base58 encoded) | COMMENT |
| LOW | src/skills/bundled/bags/index.ts | 740 | // Step 1: Create token info and metadata (multipart/form-data) | COMMENT |
| LOW | src/skills/bundled/bags/index.ts | 766 | // Step 2: Create fee share config (100% to creator by default) | COMMENT |
| LOW | src/skills/bundled/bags/index.ts | 799 | // Step 3: Create launch transaction (correct field names: ipfs, wallet) | COMMENT |
| LOW | src/gateway/launch-routes.ts | 528 | // Step 1: Resolve metadata URI | COMMENT |
| LOW | src/gateway/launch-routes.ts | 543 | // Step 2: Build bonding curve config | COMMENT |
| LOW | src/gateway/launch-routes.ts | 574 | // Step 3: Launch token | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/solana/drift.ts | 533 | // Convert leverage to margin ratio (1/leverage) | COMMENT |
| MEDIUM | src/solana/drift.ts | 684 | // Calculate leverage | COMMENT |
| MEDIUM | src/execution/futures.ts | 1350 | // Get current leverage from user state | COMMENT |
| MEDIUM | src/execution/futures.ts | 1848 | // Liq price for long = Entry * (1 - 1/leverage + mmr) | COMMENT |
| MEDIUM | src/execution/futures.ts | 1851 | // Liq price for short = Entry * (1 + 1/leverage - mmr) | COMMENT |
| MEDIUM | src/skills/bundled/dca/index.ts | 624 | // /dca hl <coin> <total-$> --per <$> --every <interval> [--side long|short] [--leverage <n>] | COMMENT |
| MEDIUM | src/skills/bundled/dca/index.ts | 677 | // /dca bf <symbol> <total-$> --per <$> --every <interval> [--side long|short] [--leverage <n>] | COMMENT |
| MEDIUM | src/skills/bundled/dca/index.ts | 730 | // /dca bb <symbol> <total-$> --per <$> --every <interval> [--side long|short] [--leverage <n>] | COMMENT |
| MEDIUM | src/skills/bundled/dca/index.ts | 915 | // /dca mexc <symbol> <total-$> --per <$> --every <interval> [--side long|short] [--leverage <n>] | COMMENT |
| MEDIUM | src/trading/futures/index.ts | 5558 | // Read current leverage from position to avoid resetting it | COMMENT |
| MEDIUM | src/trading/futures/index.ts | 5573 | // Get current leverage from position or local prefs | COMMENT |
| MEDIUM | src/trading/futures/index.ts | 5596 | // Preserve current margin type when setting leverage | COMMENT |
| MEDIUM | src/trading/futures/index.ts | 5790 | // MEXC (No KYC for small amounts - up to 200x leverage) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/nodes/index.ts | 312 | print("\\(loc.coordinate.latitude),\\(loc.coordinate.longitude),\\(loc.horizontalAccuracy)") | CODE |
| HIGH | src/nodes/index.ts | 314 | print("ERROR") | CODE |
| HIGH | src/trading/ml-signals.ts | 571 | print(json.dumps(result)) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | rust/fast-broadcast/src/lib.rs | 1 | //! Race a signed raw transaction across multiple RPC endpoints and return whichever | COMMENT |
| LOW | docs/TELEMETRY.md | 261 | // { | COMMENT |
| LOW | .github/workflows/security.yml | 41 | # security-events: write | COMMENT |
| LOW | src/cache/index.ts | 481 | // ============================================================================= | COMMENT |
| LOW | src/solana/pumpswap.ts | 41 | // Anchor account discriminator for the Pool struct — first 8 bytes, | COMMENT |
| LOW | src/solana/pumpswap.ts | 281 | : await PUMP_AMM_SDK.sellBaseInput(state, amountIn, slippagePercent); | COMMENT |
| LOW | src/solana/pump-swarm.ts | 1761 | try { | COMMENT |
| LOW | src/solana/pumpapi.ts | 421 | // ============================================================================ | COMMENT |
| LOW | src/solana/meteora-dbc.ts | 541 | // (pool as any).config || (pool as any).poolConfig fallback always | COMMENT |
| LOW | src/solana/orca.ts | 221 | if (results.length >= limit) break; | COMMENT |
| LOW | src/solana/orca.ts | 241 | // ByOwner is not a function" because the PublicKey lands in the `rpc` | COMMENT |
| LOW | src/evm/pons.ts | 281 | ]; | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/lighter-bridge/bridge.py | 276 | except Exception as e: # noqa: BLE001 — every failure path must become JSON, never a raw traceback | CODE |
| LOW | src/skills/bundled/trading-manifold/SKILL.md | 316 | except Exception as e: | CODE |
| MEDIUM | src/skills/bundled/trading-manifold/SKILL.md | 317 | print(f"Error: {e}") | CODE |
| LOW | src/skills/bundled/trading-polymarket/SKILL.md | 639 | except Exception as e: | CODE |
| MEDIUM | src/skills/bundled/trading-polymarket/SKILL.md | 640 | print(f"Error: {e}") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/lighter-bridge/bridge.py | 90 | except ImportError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/security/types.ts | 77 | | 'fake_token' | CODE |
| LOW | src/skills/bundled/pairing/SKILL.md | 75 | displayName: 'John Doe', | CODE |
| LOW | src/skills/bundled/credentials/SKILL.md | 91 | email: 'user@example.com', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/ARCHITECTURE.md | 75 | ├── index.ts # Gateway factory and orchestration | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/auto-reply/index.ts | 604 | 'You\'re welcome! Let me know if you need anything else.', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mcp/server.ts | 115 | async function handleRequest(req: JsonRpcRequest): Promise<JsonRpcResponse | null> { | CODE |