Token risk check

[alrimarleskovar]

token-risk-check (Track D) — T0

A Solana token-risk-check tool plugin: given a mint, returns a fail-closed red/amber/green verdict over on-chain facts.

What it checks

• Mint & freeze authority (active → red)
• Dangerous Token-2022 extensions: permanentDelegate, transferHook, defaultAccountState=frozen (red); transferFeeConfig >10% (red, theft-grade) or ≤10% (amber); nonTransferable (amber)
• Holder concentration via getTokenLargestAccounts (amber, best-effort)

Safety design (the point of the plugin)

• Verdict is a pure function of on-chain facts. classify() never receives token metadata — so attacker-controlled name/symbol/uri cannot influence it. Injection fails closed by construction, not by defense. Self-declared metadata is returned quarantined in untrusted_metadata with a warning.
• Fail-closed throughout: any RPC failure, missing account, unreadable field, or unknown extension resolves to error or a stricter verdict — never green by default.
• Honest checks_performed / not_checked in every result (LP status and metadata mutability are declared unchecked).

Custody: T0 — read-only. Never builds, signs, or submits a transaction; never holds a key; never touches funds. Only possible secret is an RPC key via config_read.

Status: core complete, 56 host tests passing (mocked RPC, no network), builds clean for wasm32-wasip2. Opening as draft while I wire up a live host demo — feedback welcome, especially on the WIT usage and anything blocking merge-readiness.

Pure-core/thin-shim split, mirrors redact-text. Structured logging via log-record. MIT.