> ## Documentation Index
> Fetch the complete documentation index at: https://retinaos.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Token Risk Flags: How RetinaOS Detects On-Chain Red Flags

> The five risk signals RetinaOS monitors for each token — wash trading, sybil clusters, liquidity pulls, concentrated ownership, and smart money exits.

RetinaOS automatically monitors every indexed token for patterns that indicate elevated risk. Risk flags appear on token pages and in API responses, and you can filter the discovery feed to exclude tokens carrying specific flags.

## Risk Flag Types

<AccordionGroup>
  <Accordion title="Wash Trading">
    Detected when a significant portion of trading volume appears to flow between a small set of wallets in circular patterns. Wash trading artificially inflates volume metrics, making a token appear more actively traded than it is.

    RetinaOS applies a heuristic filter: if more than 40% of volume in a given window traces back to the same cluster of wallets, a wash-trading flag is raised.
  </Accordion>

  <Accordion title="Sybil Clusters">
    Groups of wallets that appear to be controlled by the same entity — identified through similar funding sources, near-simultaneous actions, and coordinated token accumulation. Sybil clusters can artificially inflate holder counts and create false signals of organic distribution.
  </Accordion>

  <Accordion title="Concentrated Ownership">
    When the top 10 holders control an unusually high percentage of supply (typically above 60–70%), small sell decisions by a handful of wallets can cause outsized price impact. This flag is informational, not an automatic disqualification.
  </Accordion>

  <Accordion title="Liquidity Pulled">
    When a significant portion of a liquidity pool is removed in a short window, often correlated with a rug-pull pattern. RetinaOS tracks liquidity add and remove events and raises this flag when a removal crosses a defined threshold.
  </Accordion>

  <Accordion title="Smart Money Exiting">
    When wallets classified as Early Mover or rated as high-reputation by Cortex are net selling while retail activity continues. This flag is contextual — it surfaces on token pages and in AI summaries but does not automatically indicate a rug.
  </Accordion>
</AccordionGroup>

## Risk Score vs. Risk Flags

A risk score (0–100) is a composite number that aggregates multiple signals into a single value. Risk flags are discrete binary signals — each one either applies to a token or it doesn't. Both appear on token pages and in API responses.

A token can carry a moderate risk score (40–60) and still have one or more specific flags active. Always read the flags alongside the score rather than relying on the score alone.

## Filtering by Risk Flags

In the discovery feed, open the **Filters** panel and deselect any risk flags you want to exclude. In the API, pass `exclude_flags` as a query parameter with a comma-separated list of flag names:

```bash theme={null}
curl -X GET "https://api.retinaos.xyz/v1/tokens?exclude_flags=wash_trading,liquidity_pulled" \
  -H "Authorization: Bearer YOUR_API_KEY"
```