GL1TCH Token Safety

GL1TCH — scan before you buy

A free, open-source token safety scanner for Solana (plus 15 EVM chains). Paste any token and get a 0–100 risk score with a plain-language reason for every check, in seconds. Read-only: it never asks for a signature, never touches a wallet, and costs nothing to use.

• Scanner: https://gl1tchbased.xyz/scan
• Safe Swap (Solana & 7 EVM chains): https://gl1tchbased.xyz/safe-swap · Solana Actions & Blinks (Spec v2.4)
• Paid Agent API (x402 v2 · 10 endpoints · 6 chains): https://gl1tchbased.xyz/agents/docs (USDC on Solana, Base, Arbitrum, Polygon, Avalanche, Sei)
• MCP Server & Agent Toolkit: https://gl1tchbased.xyz/api/mcp · gl1tch-agent-toolkit
• Live On-Chain Treasury & Revenue: https://gl1tchbased.xyz/revenue (reads Solana, Base, Arbitrum, Polygon, Avalanche directly on-chain)
• Mobile Prototype (Solana Mobile Wallet Adapter · Android): 52s YouTube Demo · mobile/
• Yield X-Ray (multi-chain APY & risk analysis across 7 chains): https://gl1tchbased.xyz/yield
• Rug Radar (risky new launches, swept every 10 minutes): https://gl1tchbased.xyz/radar
• Verdict Anchoring (sealed on Solana via SPL Memo): https://gl1tchbased.xyz/verify-scan
• Proof page (we run the scanner on our own token): https://gl1tchbased.xyz/proof
• Telegram bot: scan from chat, plus Watchtower alerts — https://t.me/gl1tch_infected
• License: MIT

Why it exists

Most tokens launched on Pump.fun collapse shortly after launch (Solidus Labs counted 98.6% of 7M+ tokens from Jan 2024 to Mar 2025 as pump-and-dumps). The warning signs sit in on-chain state that buyers can't read: a live mint authority, a freeze authority, a hidden Token-2022 transfer fee, unlocked liquidity, bundled sniper wallets, a deployer with a history of rugs. GL1TCH reads that state, explains it in plain words, and gives it away for free.

What every Solana scan checks

A token whose volume is botted, or whose holders are mostly one linked network, can't read better than CAUTION, whatever its contract looks like. The scan also flags a token that has fallen 85% or more from its peak, and paid DexScreener promotion. EVM chains use GoPlus for honeypot, sell tax, mintable, ownership, pausable and blacklist checks, plus the same trading-activity check. Every scan also feeds the Signal Graph, a cross-scan memory of deployers, so a serial rugger's next token is flagged. Scoring changes are logged in docs/scoring-changelog.md.

Use it from your own app (free, no key)

// Full safety report for one token

const r = await fetch("https://gl1tchbased.xyz/api/scan?mint= &chain=solana"); const report = await r.json(); // { verdict, score, confidence, checks[], meta, bottomLine, ... }

// Search by name or symbol across chains const s = await fetch("https://gl1tchbased.xyz/api/scan?q=bonk").then((x) => x.json()); // { candidates }

Verdicts: CLEAN, LOW RISK, CAUTION, HIGH RISK, RUG-SHAPED, UNKNOWN. The API is rate limited per IP (40 requests/min), the same for every caller. If you are building an integration that needs more, ask at founder@gl1tchbased.xyz; it stays free.

Embed a live badge that links to the full report:

<a href="https://gl1tchbased.xyz/scan/solana-<address>">

" alt="Scanned by GL1TCH" />

Machine-readable docs for agents: https://gl1tchbased.xyz/llms.txt.

How it's built

flowchart LR

U[Browser · Telegram · API caller] --> S["/api/scan (Next.js on Vercel)"] S --> RPC[Solana RPC: mint, authorities, holders, deployer balance] S --> RC[RugCheck: LP lock, insiders, deployer] S --> MK[DexScreener / GeckoTerminal: market] S --> GP[GoPlus: EVM checks] S --> BOT[(Bot on an Oracle Cloud VM: Signal Graph, counters, Watchtower)] BOT --> TG[Telegram alerts]

Mobile Experience & Solana Seeker (Android Prototype)

A working mobile-first Android prototype (mobile/, MIT) built for Solana Seeker and Android devices:

• Share to Scan: Share a token link from Telegram, X, or Pump.fun straight to GL1TCH for an instant verdict before buying.
• Mobile Wallet Adapter (MWA): Connect read-only (Phantom, Solflare, Seed Vault) to inspect all tokens you hold in one tap with zero transaction signatures.
• Sign in with Solana (SIWS): Proof of wallet ownership via message signature (never a transaction).
• 📹 Demo Video (52s, real device): Watch on YouTube
• 📦 Source & Build Steps: See mobile/README.md.

Run it locally

Requires Node.js 22.

npm install

cp .env.example .env.local # optional: a private Solana RPC in SCAN_RPC; public RPCs work for light use npm run dev # http://localhost:3000/scan npm test # unit tests (vitest)

cd bot && npm install && npm test # the Telegram bot has its own package and tests

CI type-checks and tests the site and the bot on every push, and a security workflow runs a secret scan, a dependency audit and a check that no code ever requests a fund-moving or approval signature.

Security and honesty

• Read-only by design. The scanner and bot never request a transaction signature. See SECURITY.md to report a vulnerability, and docs/threat-model.md.
• A verdict is a risk signal, not a guarantee, and never financial advice.
• Verdict anchoring (live on mainnet since 25 Oct 2026): each Rug Radar sweep's verdicts are sealed on Solana as a Merkle root in one SPL Memo, so anyone can prove a verdict existed at that time, unedited. The memos are signed by a dedicated fee-only attester wallet, never a user's. Check one in your browser at https://gl1tchbased.xyz/verify-scan; the spec is docs/verdict-anchoring.md.
• Public numbers come with their caveats: the scan counter's all-time total includes automated Rug Radar sweeps; since 20 Oct 2026 people's scans and automated ones are counted separately (/api/stats returns user, auto and splitSince, or a 503 while the counter is unreachable, never a made-up 0). Automated means Rug Radar, Watchtower, link previews, badge renders and our own pages' self-checks of $GL1TCH. Those self-checks were at first miscounted as people's scans, so the split restarted once that was fixed (splitSince is the restart).

The $GL1TCH token (disclosure)

The project also has a community token, $GL1TCH (3HQJwwHvzy8pGkPqGQcb4thZCH88MUCHVVSNtHn6pump), launched on Pump.fun on 29 May 2026: Token-2022, mint and freeze authority revoked, 0% tax, fixed 1B supply, liquidity in the Pump.fun bonding curve.

• Safety is never token-gated. The scanner, its API, the badge, Rug Radar and Watchtower are free for everyone. Holding the token only unlocks community ranks and the verifiable-randomness API.
• Deployer wallet: sold its full position on 2026-08-20, then bought back about 3.1% of supply on 17–19 Oct 2026. The live balance and both receipts are on the Proof page.
• The market is very thin. Grant funding is never used for the token, buybacks or liquidity.

More: whitepaper · token page · Quantum Core and verifiable randomness.

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md.