Security methodology

Confidence levels

• VERIFIED — read directly from on-chain accounts or transactions (e.g. an active mint authority, a SOL transfer between two wallets, a Jito bundle id).
• LIKELY — two or more independent indicators point the same way.
• POSSIBLE — a single heuristic indicator.
• UNKNOWN — not enough data. Unknown is never treated as a passed check.

Severity (how bad it would be) is kept separate from confidence (how strong the evidence is).

Token scanner

• Mint account (SPL Token or Token-2022) parsed via RPC: supply, decimals, mint and freeze authority, every Token-2022 extension with its configuration (transfer fee, transfer hook, permanent delegate, default frozen state, pausable, confidential transfers…).
• Metadata: Metaplex metadata account (decoded on-chain: update authority, mutability) or Token-2022 embedded metadata. Off-chain JSON only supplies the image, description and links, which are shown as unverified.
• Holders: every token account via Helius DAS (or getProgramAccounts), aggregated by owner. Owners are classified: wallet, exchange (public labels), the token's Pump.fun bonding curve, AMM pools (account owned by a known AMM program or listed as a pool), burn address, lockers and other program-derived addresses. Concentration figures exclude pools, burn and program accounts, which are shown separately.
• Liquidity: pools from DexScreener; the Pump.fun curve state is read on-chain. LP ownership is decoded on-chain for PumpSwap pools (LP mint supply and largest LP holders). Liquidity is never described as locked unless the lock is verified.

Bundle detector

• The launch venue is the token's Pump.fun bonding curve, or for other tokens the oldest indexed pool. Its full signature history is walked back to the first transaction; if the history is longer than the scan limit, launch analysis is reported as unavailable rather than guessed.
• Purchases are decoded from Pump.fun TradeEvents, or from owner-level token balance changes for other venues. Windows: launch slot, first 3 slots, 10 s, 30 s, 1 min, 5 min.
• Same slot ≠ bundle. Groups of wallets buying in the same slot are reported as same-slot groups. A group is a confirmed bundle only when the Jito explorer API returns the same bundle id for two or more of its transactions. A transfer to a Jito tip account only shows the transaction was routed through Jito.
• Funding: for each of the top 30 early buyers SAFU reads the first funding transfer (for new wallets) and the last SOL received within 72 h before launch, plus one more hop for funders that matter. Exchange hot wallets and very busy service wallets (1000+ transactions per day) never link wallets.
• Clusters: wallets are joined by shared funder, shared 2-hop funder, creator funding, confirmed bundle, same-slot + similar size + Jito-tipped pattern, or co-creation within one hour. Two or more independent indicator types → LIKELY, one → POSSIBLE.
• Supply metrics are reported separately: launch-window acquired, same-slot acquired, confirmed-bundle acquired, suspected-cluster acquired, and what those clusters hold now. Each wallet is counted once.

Insider tracker

• Creator attribution in order of strength: the creator field stored in the Pump.fun bonding curve (VERIFIED), the signer of the token's first transaction (VERIFIED as deployer), the current mint authority (LIKELY), the metadata update authority (POSSIBLE).
• Creator activity comes from the history of the creator's token account: buys and sells (decoded from Pump.fun events or inferred from balance changes — labelled as such), and transfers out with their recipients.
• A wallet that received SOL or tokens directly from the creator has a VERIFIED link; that still does not prove the same person controls it. SAFU never labels a wallet “developer-owned”.

Risk score

score = 100 − Σ(severity weight × confidence multiplier) − 6 × each core category without data

Weights: INFO 0, LOW 4, MEDIUM 10, HIGH 22, CRITICAL 35. Multipliers: VERIFIED 1, LIKELY 0.8, POSSIBLE 0.45, UNKNOWN 0. Labels: ≥ 75 lower observed risk, 45–74 elevated, < 45 high; data coverage below 50 % → insufficient data. Scores are recalculated on every scan. 100/100 is not a safety guarantee and a low score is not proof of wrongdoing.

Known limitations

• Complete historical Jito bundle data is not available from ordinary RPC; when the Jito explorer does not answer, bundles are “unverified”.
• Wallets funded through exchanges, mixers or bridges cannot be linked.
• Very old or very active tokens may exceed the history scan limit; their launch analysis is skipped and counted as missing data.
• Market data (price, volume, pools) comes from indexers and can lag the chain by seconds to minutes.
• Alerts are observed after transactions execute; nothing on Solana can be seen before it lands.