on record

Program Stats

mainnet·last 48h·423 programs·186 new · 237 upgrades

Deploys over timei

05010011/12 12:0011/12 22:0011/13 08:0011/13 18:0011/14 04:00

Frameworksi

anchor9350% → 37%▼ -13pppinocchio7123% → 37%▲ +15ppnative5826% → 26%→ 0pp
unknown11% → 0%→ -1pp
anchor v200% → 0%→ +0ppquasar00% → 0%→ +0pp

IDL, security.txt, verifiedi

IDL
8.5%
security.txt
7.8%
verified build
1.4%
all three
0.7%

Categoriesi

DEX
11STAKING
13LAUNCHPAD
2LENDING
3PERPS
1BRIDGE
7ORACLE
2NFT
0GOV
1AIRDROP
0TOKEN
1INFRA
4DEFI
5
UNKNOWN
173

Integrationsi

SPL Token
100
Token-2022
72
Pump.fun
35
Associated Token
28
Meteora DLMM
20
Raydium CLMM
15
Orca Whirlpool
15
Raydium AMM
13
Jupiter
8
Metaplex Metadata
6

Identityi

namedA project name was recovered from the binary.
82
has repoA source-code repo was found in the binary or a verified build.
2
opaqueNo name, repo, or security.txt — anonymous bytecode.
141

Lineagei

novelNo known code relative on record — genuinely new code.
0variantLoosely similar to a known program, but not a direct copy.
191fork≥60% code match to a known program — a fork or close derivative.
32

Controli

mutableHas an upgrade authority — the deployer can still replace the code (including to rug).
201
frozenUpgrade authority is null — the code can never be changed by anyone.
22verified buildThe on-chain bytecode reproduces from public source code.
2

Build machinei

MacBuilt with the macOS platform-tools download, or on a Mac home folder.
28
LinuxBuilt with the Linux download. Includes Docker builds.
80
no clueNo machine paths left in the binary: stripped or remapped at build time.
115

Fundingi

known entityDeployer was funded from a labeled exchange or bridge.
0
traced funderFunded from a specific wallet we could trace, but not a labeled entity.
0
untracedCouldn't reach the funding origin.
223

sBPF versioni

v312131% → 27%▼ -5pp
v2134% → 2%▼ -2pp
v120% → 1%→ +1pp
v028764% → 71%▲ +7pp

Recycled — byte-clone redeploysi

16.1%of today's 186 new deploys are byte-clone redeploys, not new code
redeploysNew deploys that are byte-clones of known code — same program, fresh id. A fact, not a judgment.
30
Pump.fun snipersThe confident bot subset: redeploys wired to Pump.fun — the launch-sniper signature.
15
already closedDeploys whose ProgramData is already gone — rent reclaimed, likely a throwaway bot that moved on.
102
What's a throwaway bot?

A disposable on-chain program a trader deploys to run one strategy — almost always sniping new Pump.fun token launches — then closes minutes later to reclaim its rent, redeploying under a fresh id for the next run.

Why a program at all?

Sniping means "buy the instant the pool exists, atomically, or abort" — you can't do that reliably from a wallet. A tiny custom program bundles the whole attempt (and often multi-venue routing) into a single instruction that either lands complete or reverts.

Why thousands of failed transactions?

That's the race. The bot fires on every launch; most attempts lose the block or the token rugs, so they revert. The failures are the strategy — spray for the few that land.

Why redeploy and close?

The ~0.2 SOL of rent is refundable on close, and a fresh program id sidesteps any blocklist or reputation built against a known address. Cheaper and stealthier to burn identities than to keep one — so one operator can wear dozens of "new program" identities in a day.

How On Record catches it

Exact-bytecode dedup (same sha256 = same bot) collapses the redeploys into one cluster; lifecycle tracking sees the deploy → close; the failed-tx count confirms the intent. No explorer distinguishes "new protocol" from "same bot, 30th identity today" — that's a novelty-definition problem, which is exactly what this radar solves.

last 48h · updated 2026-11-13 16:23 UTC