Forensic Methodology & Detection Mechanics
CabalLens inspects real Solana Mainnet transactions using graph algorithms to detect sybil cabal networks and deceptive copy-trading metrics before an autonomous agent or human trader commits capital.
01. Multi-Hop Genesis SOL Ancestry Analysis
Standard token contract scanners only inspect static metadata (mint authority, freeze authority) and displayed holder percentages. Modern cabals deploy tokens with revoked authorities but distribute 40%–80% of the circulating supply across dozens of disposable wallets created moments before pool initialization.
How the Graph Traversal Works:
- Top Holder Extraction: We query the largest non-liquidity-pool token holders via batched RPC calls.
- 2-Hop Funding Tracing: For each top holder, we traverse the signature history backwards to identify the initial SOL funding transaction that seeded the account with lamports for gas and rent.
- Ancestry Collapse: If wallet A and wallet B were funded by wallet C (Hop 1), or their funders were funded by common wallet D (Hop 2), they belong to the same cluster.
- Disjoint-Set Union-Find: Holder wallets sharing common funding roots are collapsed into linked clusters. The true insider control percentage is calculated as the sum of all tokens held across all wallets in the dominant cluster.
02. Copy-Trading Wallet & Fake-PnL Forensics
Public leaderboards and tracking bots frequently display wallets with 90%+ win rates and millions in paper PnL. Our engine evaluates whether historical performance is organic or engineered:
Zero-Cost Inbound Seeding
Tokens transferred into the target wallet from deployers without an on-chain DEX trade. When sold, standard trackers register 100% profit from zero cost-basis, masking artificial win rates.
A↔B Wash-Trade Loops
Circular transfers and self-trading between affiliated addresses designed to manufacture artificial volume and trigger algorithmic discovery bots.
Uncopyable Sniper Latency
Wallets with median buy execution within 1–2 slots of pool creation. Copy-trading bots following these transactions inevitably suffer high slippage, sandwich attacks, or failed transactions.
Follower-Dump Bait Patterns
Clusters where the primary tracked wallet buys publicly, attracting copy bots, followed immediately (3–15 slots later) by heavy sells from connected sibling wallets.
03. Known Limitations & False Positives
Graph analysis on public distributed ledgers is probabilistic. Users and agents must consider the following known boundaries:
- Centralized Exchange (CEX) Hot Wallets: Major exchanges fund thousands of independent user wallets from common withdrawal hot addresses. While CabalLens maintains a known CEX address exclusion list, newly deployed exchange operational addresses may temporarily cause independent traders to appear clustered.
- Ecosystem Grants & Airdrops: Legitimate treasury dispersals seed thousands of recipients from one funding origin. We inspect dispersion timing, holder distribution, and contract flags to differentiate these from sybil cabals.
- Historical Signature Depth: Standard Solana Mainnet RPC nodes may prune deep historical transaction signatures on high-throughput or aged accounts. When funding history is partially truncated, the audit returns
confidence: "LOW"with an explicit disclosure code.
04. Disclaimers & Dispute Resolution
Heuristic analysis, not financial advice; may produce false positives.
CabalLens reports are automated algorithmic interpretations of raw Solana Mainnet state. They do not constitute an endorsement, financial guidance, or formal legal accusation of fraudulent intent.
If your protocol or treasury wallet has been erroneously flagged due to an unlisted CEX hot wallet or distribution mechanism, please submit verifiable on-chain proof to our security and disputes contact: