Skip to main content

​
What a flag is

A tier tells you the overall read. A flag tells you why, in plain language and as a stable code. Flags are the human-readable layer on top of the score, the specific patterns worth knowing about on a given wallet or token. A flag is directional, not a conviction. Some are a hard warning. Others are just context you should weigh. A flag can show up even on an otherwise reasonable tier, and that combination is often the most useful thing on the read, because it tells you exactly where to look before you commit to anything. Unknown codes are possible. Renderers should show the raw code rather than crash.

​
Token and discovery flags

These are the codes the batch endpoint and discovery widget know by name.
Behavior consistent with a token you can buy but cannot sell. Sell volume near zero relative to buy volume after the distribution period is the typical shape.This is one of the more serious flags. Treat the token as a trap until you have proven otherwise yourself. Discovery labels it “Honeypot”.
A wave of wallets buying inside the same window in a way that looks organized rather than organic. It is how fake demand gets manufactured. It does not always mean a scam, but it means the interest you are looking at may not be real.Discovery labels it “Coordinated buy”.
Multiple holders, often ones that look credible, selling the majority of their position inside the same rolling window. The sync of the sell is the signal.A warning that the people closest to the token may be heading for the door. Discovery labels it “Exit sync”. Participating wallets can pick up a follow-on mark.
The holders are mostly fresh, low-trust, or farm-style wallets rather than addresses with real histories. A crowd that looks bigger than it is.Discovery labels it “Low holders”. You may also see HOLDER_CONCENTRATION on some contract reads when a tiny set of wallets owns almost everything.

​
Additional codes you may see

These fire on Token Shield, NFT, wallet, and staking paths. They are first-class on those responses even if the compact discovery widget does not yet have a pretty label for them.
Bidirectional pairs trading the same asset back and forth, or NFT transfer patterns that look recycled rather than collected. One-way flow through a router is not treated as wash.
This wallet has participated in coordinated exits across more than one token. It is a wallet-side mark, not a token-side one, and it follows the address into later reads.
The wallet that launched the token has little or no track record of its own. Not damning on its own, but there is no history standing behind the launch yet.
On a wallet, activity whose rhythm reads as scripted rather than human. This is context, not a verdict. Plenty of legitimate automation exists.
Trading volume that looks padded, recycled, or too thin to support the impression the token is trying to give.
A tiny set of wallets owns almost everything. Concentration is the token-side read. Dominance is the contract-side read.
The contract has been upgraded often enough that the code you see today may not be the code you get tomorrow.
On NFT collections, the creator is selling into their own market rather than holding.
Wallet-side. Burst transaction rate that does not look like ordinary use.
Wallet-side. Metronomic gaps between txs, the way a script keeps time.
Wallet-side. The address is sending to itself enough to pad a history.
Wallet-side. High volume, zero failures, and a young wallet. Too tidy.
Wallet-side. Committed means real aged stakes lifted the read. Gaming covers same-day churn (SAME_DAY_STAKE_CHURN), self-staking (SELF_STAKING), and circular rings (CIRCULAR_STAKE_RING).
Wallet-side. This address has a history of showing up in synchronized token exits, not just one incident.

​
Sui TokenShield flags

The Sui coin widget uses a different code list. Do not expect Arc temporal codes on a Sui coin response.
Flags point you at behavior worth checking. They do not make the decision for you, and the presence or absence of a flag is never a guarantee on its own. Read them together with the tier, the confidence, and your own judgment.

​
How they appear on the wire

Discovery batch:
Oracle (hardened):
Attestations hash flags instead of publishing the raw list on-chain: flagsHash is keccak256 of the sorted, uppercased codes joined by |. The HTTP attestation still includes the flags array so you can display them.

​
That is the conceptual core

You now have the whole picture of how a read is built: the overview, the tiers, the signals, and the flags here.

Confidence and states

How sure a read is, and how brand-new tokens are handled.

The products

Where the score turns into something you can use.