Token Risk Flags: How RetinaOS Detects On-Chain Red Flags

The five risk signals RetinaOS monitors for each token — wash trading, sybil clusters, liquidity pulls, concentrated ownership, and smart money exits.

RetinaOS automatically monitors every indexed token for patterns that indicate elevated risk. Risk flags appear on token pages and in API responses, and you can filter the discovery feed to exclude tokens carrying specific flags.

Risk Flag Types

Wash Trading

Detected when a significant portion of trading volume appears to flow between a small set of wallets in circular patterns. Wash trading artificially inflates volume metrics, making a token appear more actively traded than it is.

RetinaOS applies a heuristic filter: if more than 40% of volume in a given window traces back to the same cluster of wallets, a wash-trading flag is raised.

Sybil Clusters

Groups of wallets that appear to be controlled by the same entity — identified through similar funding sources, near-simultaneous actions, and coordinated token accumulation. Sybil clusters can artificially inflate holder counts and create false signals of organic distribution.

Concentrated Ownership

When the top 10 holders control an unusually high percentage of supply (typically above 60–70%), small sell decisions by a handful of wallets can cause outsized price impact. This flag is informational, not an automatic disqualification.

Liquidity Pulled

When a significant portion of a liquidity pool is removed in a short window, often correlated with a rug-pull pattern. RetinaOS tracks liquidity add and remove events and raises this flag when a removal crosses a defined threshold.

Smart Money Exiting

When wallets classified as Early Mover or rated as high-reputation by Cortex are net selling while retail activity continues. This flag is contextual — it surfaces on token pages and in AI summaries but does not automatically indicate a rug.

Risk Score vs. Risk Flags

A risk score (0–100) is a composite number that aggregates multiple signals into a single value. Risk flags are discrete binary signals — each one either applies to a token or it doesn’t. Both appear on token pages and in API responses.

A token can carry a moderate risk score (40–60) and still have one or more specific flags active. Always read the flags alongside the score rather than relying on the score alone.

Filtering by Risk Flags

In the discovery feed, open the Filters panel and deselect any risk flags you want to exclude. In the API, pass exclude_flags as a query parameter with a comma-separated list of flag names:

curl -X GET "https://api.retinaos.xyz/v1/tokens?exclude_flags=wash_trading,liquidity_pulled" \
  -H "Authorization: Bearer YOUR_API_KEY"