Solana Token Safety

{
  "cached": false,
  "chain": "solana",
  "commitment": "confirmed",
  "decimals": 5,
  "extensions": {
    "all": [],
    "default_account_state": null,
    "permanent_delegate": null,
    "transfer_fee_bps": null,
    "transfer_hook_program": null
  },
  "freeze_authority": null,
  "freeze_authority_present": false,
  "holders": {
    "holders": [
      {
        "label": "Raydium AMM pool authority",
        "owner": "5Q544fKrFoe6tsEbD7S8EmxGTJYAKtTVhAW5Q5pge4j1",
        "share_pct": 9.24,
        "token_account": "4k3Dyjzvzp8eMZWUXbBCjEvwSkkSn9xcFqNkNEq7Fo8M"
      },
      {
        "label": "incinerator (burn address)",
        "owner": "1nc1nerator11111111111111111111111111111111",
        "share_pct": 2,
        "token_account": "8ZmHdKyHGnDYbe4mCwGnGBwhnLxjA2PPDE8fPBHJ4oEq"
      },
      {
        "label": null,
        "owner": null,
        "share_pct": 6.31,
        "token_account": "2aYq7Wd8VJt5pXy1Q6Ni5KrUQ7Hs4fZkM1b3C9DxLrTn"
      }
    ],
    "labelled_in_top20": 4,
    "largest_unlabelled_pct": 6.31,
    "top10_pct": 31.42,
    "top10_unlabelled_pct": 22.18
  },
  "label": null,
  "limits": "A snapshot of now. Mint and freeze authorities and Token-2022 settings can be changed by their holder later. A sell quote is not a fill: a program can still block a sell in ways a quote does not show, and a new token can be rebalanced between the quote and a trade. Holders behind many wallets look small, and exchange wallets or market makers cannot be told from other holders unless they are a pool, a program-owned account or a burn address. Heuristic, not an audit: a low risk level is not proof the token is safe.",
  "mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
  "mint_authority": null,
  "mint_authority_present": false,
  "pools": [
    {
      "dex": "orca",
      "liquidity_usd": 374692.11,
      "pool": "5zpyutJu9ee6jFymDGoK7F6S5Kczqtc9FomP3ueKuyA9",
      "price_usd": 0.000003471,
      "quote": "SOL"
    }
  ],
  "program": "token",
  "reasons": [],
  "risk_level": "low",
  "sell_route": {
    "amount_capped": false,
    "amount_usd": 100,
    "hops": 1,
    "price_impact_pct": 0,
    "reference_price_usd": 0.000003471,
    "sell_loss_pct": 0,
    "slippage_bps": 50,
    "source": "Jupiter quote API (api.jup.ag/swap/v1/quote)",
    "status": "checked",
    "usdc_out": 100.1487,
    "venues": [
      "TesseraV"
    ]
  },
  "slot": 455838786,
  "supply": "8799436232277477953",
  "ui_supply": "87994362322774.77953",
  "untrusted_content": true,
  "warnings": []
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://tanod.dev/v1/chain/solana/token-safety' \
  -H 'content-type: application/json' \
  --data-raw '{"mint":"DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://tanod.dev/v1/chain/solana/token-safety' \
  -H 'content-type: application/json' \
  --data-raw '{"mint":"DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.005 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.005" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.005 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ftanod.dev%2Fv1%2Fchain%2Fsolana%2Ftoken-safety&method=POST
const res = await pay("https://tanod.dev/v1/chain/solana/token-safety", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"
  }),
});
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.005 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.005"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://tanod.dev/v1/chain/solana/token-safety",
        json={
            "mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
        },
    )
    print(res.status_code, res.text)