Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

Gradient Boosting models can flag a TON token as a likely rug pull within its first five minutes of trading, reaching an AUC of 0.891 with a TVL-based label and recalls above 0.96 with an idle-based label.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

T0 review · deepseek-v4-flash

2026-08-05 12:50 UTC pith:PRXJWE5L

load-bearing objection A useful TON rug-pull dataset and a fair comparison of two label definitions, but the central 'early detection within five minutes' claim is undercut by temporal overlap between feature and label windows. the 4 major comments →

arxiv 2509.01168 v1 pith:PRXJWE5L submitted 2025-09-01 cs.DC cs.LG

Detecting Rug Pulls in Decentralized Exchanges: Machine Learning Evidence from the TON Blockchain

classification cs.DC cs.LG
keywords rug pulldecentralized exchangeTON blockchaingradient boostingTVLdata fusionearly warningDeFi security
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that rug pulls on TON decentralized exchanges can be detected almost immediately after a token starts trading: from the first five minutes of minute-level data, a gradient boosting model can predict whether a rug pull will happen within the next hour. The authors build and compare two definitions of 'rug pull' — a catastrophic TVL drop (more than 99% from its first-hour peak) and a complete stoppage of trading for an hour — and test both on the two largest TON DEXs, Ston.Fi and DeDust. They report that the TVL-based definition yields the stronger discriminator (AUC up to 0.891), while the idle-based definition catches nearly all scams (recall up to 0.97) but with more false alarms. They also find that a common feature set transfers across the two exchanges, but the underlying distributions differ, so combining data or transferring weights must be done deliberately. If right, the result gives TON investors a five-minute early-warning signal for an imminent liquidity collapse or trading halt.

Core claim

The paper claims that rug pulls on TON DEXs are predictable in the first five minutes of trading, before the outcome is fully known. The TVL-based label defines a rug pull as a Maximum Drop in total value locked of more than 99% from its peak within the first hour; the idle-based label defines it as zero trades within that hour. On Ston.Fi and DeDust data, gradient boosting and XGBoost models using first-five-minute features achieve AUC values around 0.82–0.89 for TVL and 0.82–0.84 for idle, with the idle models reaching recall of 0.96–0.97 on both exchanges. The paper presents this as a practical, deployable early-warning mechanism and recommends the TVL approach as the primary monitor whil

What carries the argument

The central objects are two label definitions built on a one-hour window. The TVL label uses MD, the Maximum Drop in TVL: MD = |TVL(t0)-TVL(τ)|/TVL(t0), where t0 is the first-hour peak and τ the subsequent minimum. The idle label is simply 'no buys or sells for one hour after trading starts.' Features are computed over the first five minutes of the same hour — buy/sell counts and volumes, unique buyers/sellers, TVL bounds, price range and standard deviation, fees, and time deltas from token and pool creation. Gradient boosting models (GradientBoosting and Extreme Gradient Boosting) are the classifiers that map those five-minute features to each label; the paper also compares Random Forest an

Load-bearing premise

The paper's feature window (minutes 0–5) is a subset of the label window (minutes 0–60), so for tokens that are already idle or already collapsed within five minutes, the model is reading current state rather than forecasting; if that overlap is removed, the reported recall and AUC may drop sharply.

What would settle it

Re-run the experiment keeping features on minutes 0–5 but computing both labels only over minutes 5–60 (exclude the first five minutes from the TVL drop and from the idle window). If the idle model's recall falls from ~0.97 toward chance and the TVL AUC drops well below 0.89, the published numbers are artifacts of definitional overlap.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • A monitor on TON could raise a rug-pull alert five minutes after a token's first trade, before the one-hour outcome has played out.
  • The TVL-based model is the recommended primary signal because it best separates scams from normal tokens; the idle-based model is a high-recall complement that rarely misses a scam but alarms more often.
  • Cross-exchange data fusion does not automatically improve results; models that train on the combined dataset or transfer weights between Ston.Fi and DeDust behave differently per exchange, so platform-aware training matters.
  • The most informative early features are transaction volume, the number of buys, and liquidity values (max TVL in five minutes), pointing to where a monitoring system should focus its data pipeline.
  • The same pipeline generalizes to other DEXs only after re-validation, since feature distributions differ substantially across platforms.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The five-minute feature window overlaps the one-hour label window, so the reported scores mix genuine forecasting with reading the present; redefining labels over minutes 5–60 only would give a cleaner estimate of predictive power.
  • A practical deployment would need to set a warning threshold by the cost of false alarms; even the best idle-based transfer setting flags 10% of normal tokens as scams.
  • A one-hour 'no trades' label can conflate a deliberate rug pull with a token that simply dies naturally; multi-horizon labels could separate the two phenomena.
  • Features outside trading data — creator history, code-level backdoors, or social signals — would likely extend detection to rug pulls that begin after the five-minute window.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a machine-learning framework for early rug-pull detection on the TON blockchain, using data from the two largest TON DEXs (Ston.Fi and DeDust). It compares two rug-pull definitions—an idle-based definition (no trades within one hour) and a TVL-based definition (drop of more than 99% from the peak TVL within the first hour)—and reports that Gradient Boosting/XGBoost models achieve AUC up to 0.891 for TVL and recall up to 0.96–0.99 for idle, based on features collected in the first five minutes of trading. The paper also studies data fusion and transfer learning between the two exchanges. The central claim is that these models provide an early-warning mechanism within five minutes of token launch.

Significance. If the results were valid, the study would be a useful empirical contribution: it assembles a TON-specific dataset, jointly implements two rug-pull definitions, and compares cross-exchange transfer. However, the headline quantitative claims are undermined by a temporal leakage between feature construction and label construction: the idle and TVL labels are defined over the first hour from the same start time as the five-minute features, so the model is partly reading the current token state rather than forecasting a future event. The reported AUC and recall figures therefore do not support the abstract's early-warning claim. With corrected label windows and appropriate baselines, the underlying dataset and comparison framework could still be valuable, but the evidence presented in the current manuscript is not reliable.

major comments (4)
  1. [§3.1.1, §3.1.2, §5.1, Table 1, Tables 2–5] The label windows and the feature window share the same start time, making the 'prediction' partly a contemporaneous classification. The idle label is defined as 'no trades within one hour of starting trading' (§3.1.1), while the features include 'buys', 'sells', and 'total usd volume' over the first 5 minutes (§5.1, Table 1). Any token with zero trades in [0,5] is positive by definition, so a model can trivially achieve high idle recall by detecting zero activity. The TVL label is MD computed over [0,60] via Eqs. (1)–(3), while features include max/min TVL and price extremes in [0,5]; for tokens whose peak-to-trough occurs entirely within the first five minutes, the label is a deterministic function of the feature window. The reported idle recall 0.96–0.97 and TVL AUC 0.885–0.891 are therefore partly artifacts of definitional overlap, not measures of forecasting skill. The fix is to def
  2. [§5.1, Table 1] Several features are not explicitly restricted to the first five minutes, which is a second, independent temporal leak. 'first buy time ts' and 'first sell time ts' are timestamps; if a token's first trade occurs after minute 5, these features encode post-launch information that would not be available at prediction time. The same concern applies to 'time deltas' mentioned in §5.1. The paper must state that every feature is computed strictly from data in [0,5], or truncate/censor such features to that window; otherwise the reported performance is inflated by lookahead.
  3. [§6.1, Tables 2–5] No baselines are reported. The claim that Gradient Boosting models 'effectively identify rug pulls' requires comparison with trivial baselines, especially given class imbalance and the leakage described above. For the idle approach, the relevant baseline is 'flag any token with zero trades in the first 5 minutes'; for TVL, 'flag any token whose max/min TVL ratio already exceeds the threshold in [0,5]'. Until such baselines are included and the models are shown to outperform them after fixing the label window, the effectiveness claim is unsupported. Reporting confidence intervals or significance tests for the AUC differences would also help, since several cross-experiment gaps are small (e.g., 0.820 vs 0.820 in Table 2).
  4. [§7, Limitations] The Limitations paragraph acknowledges that using only the first 5 minutes limits prediction capability for tokens with non-standard dynamics, but it does not acknowledge the more serious issue that the labels are defined over the same first hour that contains the feature window. This omitted limitation should be stated explicitly, and the corrected experimental protocol should be used to determine whether any early-warning signal remains.
minor comments (5)
  1. [§3.2] The metrics list defines 'Accuracy' twice; the first definition ('proportion of correctly predicted rug pulls among all positive predictions') is precision, not accuracy. Later in §6.1.2, 'Class 0 accuracy' is actually Precision(0). Please use consistent terminology.
  2. [§4.4 and Figure 9] The text says 'a time of 60 minutes was chosen' for the prediction horizon, but does not explain the decision based on the class-ratio analysis in Figure 9. Please provide the actual trade-off or state the criterion explicitly.
  3. [§6.1.1, §5.2.1] Recursive Feature Elimination reportedly eliminated 'creation month cos', 'is pool creator', and 'std rsi', but Table 1 does not define 'creation month cos' or 'std rsi'. Either add these features to Table 1 or clarify their provenance.
  4. [§3.3, §5.2.2] Data-fusion methods 4 and 5 are described as 'saving model weights, then retraining'; it is unclear whether this is fine-tuning, continued training, or using weights for initialization. Please specify the exact procedure and hyperparameters for these transfer experiments.
  5. [Various] The text contains typos and inconsistent formatting (e.g., 'Ston.F i' and 'Ston.Fi'; 'Memcoins' vs 'memecoins'; 'ExtremeGradientBoosting' vs 'XGBoost'). A careful proofreading pass is needed.

Circularity Check

2 steps flagged

The 'first-five-minutes' prediction leaks the label window: TVL and idle labels are defined over the same first hour from which the five-minute features are drawn, so early-collapse/early-idle tokens are classified by reading current state rather than forecasting.

specific steps
  1. fitted input called prediction [Section 3.1.2 (Eqs. 1-3), Table 1, Section 5.1]
    "A rug pull is defined as a drop in TVL of more than p% from its peak value within the first hour of trading. ... t0 = arg max_{t∈[0,60]} TVL(t) (1), τ = arg min_{t∈[t0,60]} TVL(t) (2), MD = |TVL(t0) − TVL(τ)| / TVL(t0) (3). ... max tvl: Maximum TVL in 5 minutes; min tvl: Minimum TVL in 5 minutes."

    The TVL label is the maximum drop MD over [0,60], while the features 'max tvl' and 'min tvl' are computed over [0,5], a subset of the same interval. For any token whose peak (Eq. 1) and trough (Eq. 2) both fall inside the first five minutes, MD is exactly (max_tvl_5min − min_tvl_5min)/max_tvl_5min, a deterministic function of the features. The model is therefore not predicting a future rug pull for these tokens; it is classifying an event that has already completed inside the feature window. Since the paper never excludes [0,5] from the label window, the reported TVL AUC (up to 0.891) is partially inflated by label information embedded in the features.

  2. self definitional [Section 3.1.1, Table 1, Section 3 (Research Workflow)]
    "Rug pull is defined as a token that has no trades (buys/sells) within one hour of starting the trading. ... buys: Number of purchases in 5 minutes; sells: Number of sales in 5 minutes; total usd volume: Total transaction volume in dollars. ... it is necessary to predict whether a rug pull (fraudulent liquidity loss or cessation of activity) will occur within the next hour after the start of trading, based on data collected within 5 minutes of the start of DEX token trading."

    The idle label is defined over the full first hour, while the features are trade counts and volume over the first five minutes of that same hour. A token with zero buys, zero sells, and zero USD volume in [0,5] has already satisfied the necessary condition for the positive label; for tokens that never trade again, the label's defining 'no trades' condition is partly read directly from the feature window. The reported idle recall of 0.96–0.97 is thus substantially a contemporaneous classification of already-inactive tokens, not a forecast of future inactivity, contrary to the paper's 'predict ... within the next hour' framing.

full rationale

The paper's ML pipeline and data-fusion analysis are self-contained and do not rest on a load-bearing self-citation chain: prior work [18,29] supplies the rug-pull definitions, but the experiments on TON data are new. The main circularity is temporal label leakage. Both target definitions (Sections 3.1.1 and 3.1.2) are computed over the first hour [0,60], while all features in Table 1 are computed over the first five minutes [0,5] of that same interval. For the TVL approach, if the peak and trough in Eqs. 1–2 occur by minute 5, the label MD is exactly a ratio of the features 'max tvl' and 'min tvl'; no future information is needed. For the idle approach, zero trade features in [0,5] are a necessary condition for the positive label and make the model's 'rug pull in next hour' prediction partly a statement about current inactivity. The limitation section acknowledges that five minutes is a short window but never states that the label window overlaps it, so the early-warning claim is not insulated from this leakage. This is not full circularity—later rug pulls are genuinely forecast from early features, and the cross-DEX fusion results have independent content—but the headline AUC/recall numbers are partially forced by construction, warranting a score of 6.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

The central claim rests on two hand-set label parameters (p = 99% TVL drop and the 60-minute horizon), a hand-set 5-minute feature window, a data-quality assumption about Dune.com indexing, and the assumption that the two operational definitions capture what a rug pull is. The idle definition additionally assumes that a one-hour trading stoppage indicates fraud rather than honest failure. No code, data, or exact hyperparameters are provided, so several fitted choices are unverifiable.

free parameters (6)
  • TVL drop threshold p = 99%
    Labels for the TVL approach depend on p: a token is a rug pull if MD <= p (Section 3.1.2). p is set to 99% following Mazorra [29]; Figures 7-8 show sensitivity to p but no principled selection, and every reported TVL result inherits this choice.
  • Prediction horizon (label window) = 60 minutes
    Section 4.4: 'For this work, a time of 60 minutes was chosen' after inspecting the class balance dependence in Figure 9 (following [18]). Both labels and therefore the reported AUC depend on this choice.
  • Feature observation window = 5 minutes
    The 'first five minutes of trading' is the central early-warning window (Abstract, Section 3). Its length is chosen by hand and never varied.
  • Missing value imputation = median
    Section 4.5: NULLs filled with median values for numeric features; zero filling vs row removal is decided per feature without a stated rule.
  • Model hyperparameters = not reported
    GridSearchCV over listed ranges (Section 5.2.2) selects learning rate, depth, n estimators, etc., but the final chosen values are never reported, and scaler on/off choices are per-fold.
  • RFE retained features = not reported
    Recursive Feature Elimination (Section 6.1.1) removes three named features, but the retained subset and the cross-validated stopping rule are unspecified; the reported accuracy of 87.89% is attached to an unidentified configuration.
axioms (5)
  • domain assumption Dune.com indexed TON data is complete and correct for the study window
    Section 4.1 collects all token, pool, and trade data through dune.com; the whole dataset rests on this index being complete and accurate for Ston.Fi and DeDust.
  • domain assumption The two operational definitions fully capture rug pull ground truth
    Section 3.1 labels tokens as rug pulls only if they show a >99% TVL drop or a one-hour trade stop. Tokens whose fraud takes other shapes (slow liquidity drain, honeypots retaining some liquidity) are labeled non-rug and the model is trained to treat them as normal.
  • domain assumption A one-hour trade stoppage indicates fraud rather than honest failure
    Section 3.1.1 treats full inactivity as a rug pull; a legitimate token that simply fails to attract trading is labeled identically to a deliberate scam. The paper provides no validation that idle tokens are actually fraudulent.
  • domain assumption Tokens are independent and identically distributed across time
    Section 5.2.3 uses a random 8:2 split with stratification by class and data source, not a temporal split. Market regime shifts between Jan 2024 and Apr 2025 could make the test set optimistic relative to forward deployment.
  • standard math Gradient boosting, cross-validation, and AUC are valid tools for this task
    Standard supervised learning machinery invoked throughout Sections 5-6; no novel math is claimed.

pith-pipeline@v1.4.0-alltime-deepseek-medium · 12281 in / 25563 out tokens · 258139 ms · 2026-08-05T12:50:40.962316+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Detecting Rug Pulls in Decentralized Exchanges: Machine Learning Evidence from the TON Blockchain." pith.science (2026). https://pith.science/paper/PRXJWE5L

@misc{pith2026250901168,
  author       = {Pith},
  title        = {Pith review of: Detecting Rug Pulls in Decentralized Exchanges: Machine Learning Evidence from the TON Blockchain},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PRXJWE5L}},
  note         = {Machine review of arXiv:2509.01168}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

This paper presents a machine learning framework for the early detection of rug pull scams on decentralized exchanges (DEXs) within The Open Network (TON) blockchain. TON's unique architecture, characterized by asynchronous execution and a massive web2 user base from Telegram, presents a novel and critical environment for fraud analysis. We conduct a comprehensive study on the two largest TON DEXs, Ston.Fi and DeDust, fusing data from both platforms to train our models. A key contribution is the implementation and comparative analysis of two distinct rug pull definitions--TVL-based (a catastrophic liquidity withdrawal) and idle-based (a sudden cessation of all trading activity)--within a single, unified study. We demonstrate that Gradient Boosting models can effectively identify rug pulls within the first five minutes of trading, with the TVL-based method achieving superior AUC (up to 0.891) while the idle-based method excels at recall. Our analysis reveals that while feature sets are consistent across exchanges, their underlying distributions differ significantly, challenging straightforward data fusion and highlighting the need for robust, platform-aware models. This work provides a crucial early-warning mechanism for investors and enhances the security infrastructure of the rapidly growing TON DeFi ecosystem.

Figures

Figures reproduced from arXiv: 2509.01168 by Alisa Kalacheva, Dmitry Yaremus, Igor Vodolazov, Jianghai Li, Yury Yanovich.

Figure 1
Figure 1. Figure 1: Visualization of the general statement of the [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Example of Idle rug pull with $NOOB token its maximum value. TVL drops from $300k to $1 in a short period of time and activity ends. For￾mally, the method is defined by the “Maximum Drop in TVL”, the rug pull token ⇔ MD ≤ p. This approach mirrors the definition of a rug pull in that it relies directly on locked liquidity. t0 = arg max t∈[0,60] T V L(t) (1) τ = arg min t∈[t0,60] T V L(t) (2) MD = |T V L(t0)… view at source ↗
Figure 3
Figure 3. Figure 3: Example of TVL rug pull with $UKWNPTHS token (chart shows TVL in USD since start of trading) 3.2. Criteria for Model Evaluation The following metrics are used to objectively evaluate the quality of the model: • AUC (area under the ROC curve): This met￾ric mainly reflects the model’s ability to dis￾tinguish between rug pulls and normal to￾kens. • Accuracy: The proportion of correctly pre￾dicted rug pulls am… view at source ↗
Figure 4
Figure 4. Figure 4: The process of data fusion on ston.f i and DeDust data [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Trading volume of all DEX on TON for 2024- [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Per month number of new tokens created on [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 11
Figure 11. Figure 11: The analysis of the results shows that the TVL approach shows a higher average AUC value (0.860) compared to the Idle approach (0.829), with a difference of 0.031. Mixed learning on combined data (DeDust ∪ Ston.F i) does not improve the AUC metric for DeDust, but positively affects Ston.F i TVL ap￾proach (+0.007) Also, for the TVL approach, testing in Ston.F i data shows significantly better results with … view at source ↗
Figure 7
Figure 7. Figure 7: Rug percentage as a function of p for Ston.Fi [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 12
Figure 12. Figure 12: The accuracy of detecting non-rug pull tokens (class 0) is a critical metric, as false positives re￾duce user confidence in the warning system. The best Precision(0) is achieved using the Idle approach with transfer learning from DeDust to Ston.F i (0.90) With the idle approach, transferring weights from DeDust to Ston.F i improves precision (0) to 0.90, while transferring from Ston.F i to DeDust reduces … view at source ↗
Figure 9
Figure 9. Figure 9: Dependence of the ratio of 0 and 1 classes on the prediction horizon of rug pull [PITH_FULL_IMAGE:figures/full_fig_p011_9.png] view at source ↗
Figure 11
Figure 11. Figure 11: AUC results for different approaches and data [PITH_FULL_IMAGE:figures/full_fig_p013_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Class 0 accuracy results for different approaches [PITH_FULL_IMAGE:figures/full_fig_p013_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Feature importance for the Idle approach on [PITH_FULL_IMAGE:figures/full_fig_p013_13.png] view at source ↗
Figure 10
Figure 10. Figure 10: Comparative analysis of the distribution of Zero [PITH_FULL_IMAGE:figures/full_fig_p013_10.png] view at source ↗
Figure 15
Figure 15. Figure 15: Feature importance for Idle approach on Ston.F i data [PITH_FULL_IMAGE:figures/full_fig_p014_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Feature importance for TVL approach on Ston.F i data tested on another demonstrate comparable quality, which confirms the robustness of the approaches to differences in data distribu￾tions between exchanges. TVL approach (rug pull - TVL drop by more than 99% from the maximum in the first hour of trading): • In Ston.F i, the best model is GradientBoost￾ing: AUC = 0.8853, precision (1) = 0.76, re￾call (1) =… view at source ↗
Figure 17
Figure 17. Figure 17: Error matrix for TVL approach a bias in models towards the majority class. Noise and outliers in the data associated with zero val￾ues, gaps, and anomalies in transaction and price features also have a negative impact on the qual￾ity of the models, which require additional pre￾processing and data filtering. The specifics of determining rug pull depending on the chosen approach (Idle or TVL) lead to the fa… view at source ↗
Figure 18
Figure 18. Figure 18: Error matrix for Idle approach [4] A. Author, Blockchain-powered data science: En￾hancing security and transparency in decentralized finance, EasyChair Preprint (2024). URL https://easychair.org/publications/ preprint/6krD [5] V. Mohan, Automated market makers and decentral￾ized exchanges: a defi primer (2022). doi:10.1186/ s40854-021-00314-5. [6] Ston.fi, Ston.fi api documentation (2024). URL https://api… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. MELT: A Behavioral Trace Dataset for High-Risk Memecoin Launch Detection

    cs.CR 2026-02 unverdicted novelty 7.0

    MELT is the first behavioral trace dataset for high-risk memecoin launch detection on Solana, providing 122 features, risk annotations, and ML benchmarks that reduce investment loss when used for selection.

  2. From Viral to Void: Multi-Dimensional Behavioral and Contractual Analysis for Rug Pull Identification

    cs.CR 2026-08 reject novelty 4.0

    An MLP with SMOTE and Focal Loss is claimed to detect rug pull tokens with 0.927 accuracy, but the ground truth labels are partly randomly generated.

Reference graph

Works this paper leans on

34 extracted references · 28 canonical work pages · cited by 2 Pith papers · 3 internal anchors

  1. [1]

    URL https://relayto.com/relayto/telegram- open-network-ton-ico-whitepaper-6kf4rycn/ pdf

    Telegram, Telegram White Paper (2018). URL https://relayto.com/relayto/telegram- open-network-ton-ico-whitepaper-6kf4rycn/ pdf

  2. [2]

    Zheng, Z

    P. Zheng, Z. Jiang, J. Wu, Z. Zheng, Blockchain- based decentralized application: A survey, IEEE Open Journal of the Computer Society 4 (2023). doi:10.1109/OJCS.2023.3251854

  3. [3]

    Zheng, S

    Z. Zheng, S. Xie, H. N. Dai, W. Chen, X. Chen, J. Weng, M. Imran, An overview on smart contracts: Challenges, advances and platforms, Future Genera- tion Computer Systems 105 (2020). doi:10.1016/j. future.2019.12.019. 15 (a) Based onDeDust data (b) Based onSton.F idata Figure 18: Error matrix for Idle approach

  4. [4]

    Author, Blockchain-powered data science: En- hancing security and transparency in decentralized finance, EasyChair Preprint (2024)

    A. Author, Blockchain-powered data science: En- hancing security and transparency in decentralized finance, EasyChair Preprint (2024). URL https://easychair.org/publications/ preprint/6krD

  5. [5]

    Mohan, Automated market makers and decentral- ized exchanges: a defi primer (2022)

    V. Mohan, Automated market makers and decentral- ized exchanges: a defi primer (2022). doi:10.1186/ s40854-021-00314-5

  6. [6]

    URL https://api.ston.fi/v1/pools

    Ston.fi, Ston.fi api documentation (2024). URL https://api.ston.fi/v1/pools

  7. [7]

    URL https://dedust.io/ru

    Dedust, Dedust.io - amm dex on the open network (2025). URL https://dedust.io/ru

  8. [8]

    The Kosmosis Approach to Crypto Rug Pull Detection

    P. Stangl, C. P. Neumann, The kosmosis use-case of crypto rug pull detection and prevention, arXiv preprint (2024). arXiv:2405.19762. URL https://arxiv.org/abs/2405.19762

  9. [9]

    Sun, et al., Sok: Comprehensive analysis of rug pull causes, datasets, and detection tools in defi, arXiv preprint (2024)

    Y. Sun, et al., Sok: Comprehensive analysis of rug pull causes, datasets, and detection tools in defi, arXiv preprint (2024). arXiv:2403.16082. URL https://arxiv.org/abs/2403.16082

  10. [10]

    URL https://fc23.ifca.ai/preproceedings/76

    Anonymous, Uncovering the prevalence of rugpulls in cryptocurrency projects, Financial Cryptography and Data Security (2023). URL https://fc23.ifca.ai/preproceedings/76. pdf

  11. [11]

    Heights, Om - a rug pull in real-time on centralized exchanges (2025)

    T. Heights, Om - a rug pull in real-time on centralized exchanges (2025). URL https://www.binance.com/en/square/post/ 22965907943482

  12. [12]

    J. Jin, J. Zhou, C. Jin, S. Yu, Z. Zheng, Q. Xuan, Dual-channel early warning framework for ethereum ponzi schemes (2022). arXiv:2206.07895. URL https://arxiv.org/abs/2206.07895

  13. [13]

    Cheng, F

    L. Cheng, F. Zhu, Y. Wang, R. Liang, H. Liu, Evolve path tracer: Early detection of malicious ad- dresses in cryptocurrency, in: Proceedings of the ACM SIGKDD International Conference on Knowl- edge Discovery and Data Mining, 2023. doi:10. 1145/3580305.3599817

  14. [14]

    S. T. Howell, M. Niessner, D. Yermack, Initial Coin Offerings: Financing Growth with Cryptocurrency Token Sales, The Review of Financial Studies 33 (9) (2020) 3925–3974. doi:10.1093/rfs/hhz131. URL https://academic.oup.com/rfs/article/ 33/9/3925/5610546

  15. [15]

    Stencel, What is a meme coin? dogecoin to the moon! (12 2023)

    A. Stencel, What is a meme coin? dogecoin to the moon! (12 2023). URL https://hal.science/hal-04360574

  16. [16]

    Kalacheva, et al., Detecting rug pulls in decen- tralized exchanges: The rise of meme coins, SSRN (October 2024)

    A. Kalacheva, et al., Detecting rug pulls in decen- tralized exchanges: The rise of meme coins, SSRN (October 2024). URL https://papers.ssrn.com/sol3/papers. cfm?abstract_id=4981529

  17. [17]

    S. S. Taher, S. Y. Ameen, J. A. Ahmed, Advanced fraud detection in blockchain transactions: An ensemble learning and explainable ai approach, Engi- neering, Technology &amp; Applied Science Research 14 (2024) 12822–12830. doi:10.48084/etasr.6641. URL https://etasr.com/index.php/ETASR/ article/view/6641

  18. [18]

    Kalacheva, et al., Detecting rug pulls in decen- tralized exchanges: The rise of meme coins, SSRN18 pages, posted: 4 Dec 2024, date written: 9 Oct 2024 (October 2024)

    A. Kalacheva, et al., Detecting rug pulls in decen- tralized exchanges: The rise of meme coins, SSRN18 pages, posted: 4 Dec 2024, date written: 9 Oct 2024 (October 2024). URL https://papers.ssrn.com/sol3/papers. 16 cfm?abstract_id=4981529

  19. [19]

    M. V. Borate, D. A. Adsul, M. R. Dhakane, M. S. Gawade, M. S. Ghodake, M. P. Jadhav, A compre- hensive review of phishing attack detection using machine learning techniques, International Journal of Advanced Research in Science, Communication and Technology (2024). doi:10.48175/ijarsct-19963. URL http://dx.doi.org/10.48175/ijarsct- 19963

  20. [20]

    Caron, J

    S. Caron, J. E. Garc ´ ıa Navarro, M. Moreno Ll´ acer, P. Moskvitina, M. Rovers, A. Rubio J ´ ımenez, R. R. de Austri, Z. Zhang, Universal anomaly detec- tion at the LHC: transforming optimal classifiers and the DDD method, Eur. Phys. J. C 85 (4) (2025) 415. arXiv:2406.18469, doi:10.1140/epjc/ s10052-025-14087-z

  21. [21]

    Liebau, P

    D. Liebau, P. Schueffel, Crypto-currencies and icos: Are they scams? an empirical study, SSRN Electronic Journal (01 2019). doi:10.2139/ssrn.3320884

  22. [22]

    Tiwari, A

    M. Tiwari, A. Gepp, K. Kumar, The future of raising finance - a new opportunity to commit fraud: A re- view of initial coin offering (icos) scams, Crime, Law and Social Change: an interdisciplinary journal 73 (4) (2020) 417–441. doi:10.1007/s10611-019-09873- 2

  23. [23]

    T. Chiu, V. Chiu, T. Wang, Y. Wang, Using textual analysis to detect initial coin offering frauds, Journal of Forensic Accounting Research 7 (1) (2022) 165– 183

  24. [24]

    Hornuf, T

    L. Hornuf, T. K¨ uck, A. Schwienbacher, Initial coin offerings, information disclosure, and fraud, Small Business Economics 58 (4) (2022) 1741–1759

  25. [25]

    R. Ji, N. He, L. Wu, H. Wang, G. Bai, Y. Guo, Deposafe: Demystifying the fake deposit vulnerabil- ity in ethereum smart contracts, 2020, pp. 125–134. doi:10.1109/ICECCS51672.2020.00022

  26. [26]

    Durieux, J

    T. Durieux, J. F. Ferreira, R. Abreu, P. Cruz, Em- pirical review of automated analysis tools on 47,587 Ethereum smart contracts, in: Proceedings of the ACM/IEEE 42nd International Conference on Soft- ware Engineering, ACM, New York, NY, USA, 2020, pp. 530–541. doi:10.1145/3377811.3380364. URL https://dl.acm.org/doi/10.1145/3377811. 3380364

  27. [27]

    Twomey, M

    D. Twomey, M. Mann, Fraud and manipulation within cryptocurrency markets, in: Corruption and Fraud in Financial Markets: Malpractice, Misconduct and Manipulation, Wiley, 2020, pp. 205–250

  28. [28]

    P. Xia, H. wang, B. Gao, W. Su, Z. Yu, X. Luo, C. Zhang, X. Xiao, G. Xu, Trade or trick? detecting and characterizing scam tokens on uniswap decentral- ized exchange (2021). arXiv:2109.00229

  29. [29]

    Mazorra, V

    B. Mazorra, V. Adan, V. Daza, Do not rug on me: Leveraging machine learning techniques for au- tomated scam detection, Mathematics 10 (6) (2022)

  30. [30]

    C. Wu, J. Chen, Z. Zhao, K. He, G. Xu, Y. Wu, H. Wang, H. Li, Y. Liu, Y. Xiang, Tokenscout: Early detection of ethereum scam tokens via temporal graph learning, in: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communica- tions Security, 2024, pp. 956–970

  31. [31]

    Srifa, Y

    S. Srifa, Y. Yanovich, R. Vasilyev, T. Rupasinghe, V. Amelin, Rug pull detection on decentralized ex- change using transaction data, Blockchain: Research and Applications (2025) 100275

  32. [32]

    Cernera, M

    F. Cernera, M. La Morgia, A. Mei, F. Sassi, Token spammers, rug pulls, and sniper bots: An analysis of the ecosystem of tokens in ethereum and in the binance smart chain bnb, in: 32nd USENIX security symposium (USENIX security 23), 2023, pp. 3349– 3366

  33. [33]

    URL https://blog.ton.org/ton-dune- integration 17

    Ton blockchain data now accessible on dune (2024). URL https://blog.ton.org/ton-dune- integration 17

  34. [949]

    doi:10.3390/math10060949