Files

RogueWave 18ecbe471b feat(token-2022): extension-aware scanning + classification (security-gated)

Implements the §7.1 policy in code so Token-2022 (pump.fun) tokens are cleanable
when safe:
- @pyre/core: extensions.ts (BLOCKING/FLAGGED/SAFE sets + evaluateTokenExtensions);
  classify.ts gates Token-2022 on account+mint extensions; unknown extension or
  confidential-transfer/withheld-fee -> UNSUPPORTED; transfer-hook/permanent-
  delegate/pausable -> cleanable+flagged. Added malformed-u64-balance guard.
- @pyre/solana: parseTokenAccounts reads account extensions + withheld fee, and
  batch-fetches MINT extensions (getMultipleParsedAccounts, chunked).

SECURITY (from audit): mint-fetch failure no longer silently downgrades to
account-level-only (which could hide a mint-level blocking extension). Token-2022
accounts with unverified mints are marked extensionsVerified=false and classified
UNSUPPORTED ("unknown means skip"). Two audit agents: integration SHIP; security
found this CRITICAL -> fixed + tested.

Tests: core 85, solana 8. Live verified: the two pump.fun Token-2022 tokens now
classify INCINERATE_ONLY (were UNSUPPORTED). classic-SPL behavior unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 04:16:33 +00:00

src

feat(token-2022): extension-aware scanning + classification (security-gated)

2026-05-31 04:16:33 +00:00

package.json

feat(phase1): wallet scanner — scan API, classifier, token fetch, web UI

2026-05-31 03:10:52 +00:00

README.md

chore: scaffold PYRE MVP monorepo (structure + docs)

2026-05-31 02:20:55 +00:00

tsconfig.json

chore: scaffold PYRE MVP monorepo (structure + docs)

2026-05-31 02:20:55 +00:00

README.md

@pyre/solana

Solana transaction helpers for PYRE.

Purpose

Token-account reading and unsigned transaction construction for the burner flow. Per §13 its responsibilities are:

Token-account parsing.
Close-account transaction builder.
Burn transaction builder.
Simulation helpers.
Transaction decoder (for preview matching).

Trust rules (load-bearing)

PYRE never holds private keys — this package builds unsigned transactions; signing happens client-side in the user's wallet.
Recovered ATA rent defaults to the user's own wallet.
Always simulate, then decode and match against the user-facing preview before requesting a signature.
Classic SPL only in the MVP. Skip Token-2022, NFTs, and unsupported layouts.

Status

Stubs only. Every exported function throws Error("not implemented").

TODO

Implement parseTokenAccounts, buildCloseEmptyAccountsTx, buildBurnTx, simulateTransaction, and decodeTransaction.
Wire classification through @pyre/core.