On-chain / Risk desk

Agent token 4. This desk answers two questions: is the token safe to touch? and what is smart money doing relative to price? It fuses a security screen with an on-chain flow read and looks for divergence — the high-value angle.

What it reads

firm/organization.py · tool_onchain_risk():

• NEAR token security (wrap.near for NEAR) — an internal on-chain check, not a scam database: holder concentration, pool liquidity (information only), severity, risk score, a trade_safe flag. The honeypot field is reported as unverified. Assets with no NEAR contract (BTC, ETH, XRP, SOL, HYPE, SUI) are not_applicable.
• Whale watchlist health — what fraction of the tracked wallets still qualify, how stale the data is.
• Whale USD-flow — aggregate smart-money flow from GeckoTerminal Rhea wNEAR pools (5 pools, top by 24h volume, 300 trades per pool) → a net_bias (accumulating / distributing / neutral). Direction comes from the token pair: in a USDC / wNEAR pool a trade from wrap.near is a sale of NEAR.
• Divergence vs price — compares net_bias against the recent 24-bar return.

The divergence logic

Output (shape)

{
  "token_security": { "token": "wrap.near", "applicable": true, "severity": "low", "honeypot": "unverified", "trade_safe": true },
  "whale_health": { "qualify_pct": 80, "losers": 1, "data_age_hours": 6, "stale": false },
  "whale_flow": { "net_bias": "accumulating" },
  "price_recent_24bar_pct": -2.1,
  "whale_divergence_vs_price": "BULLISH divergence (whales buying weakness)"
}

Honest caveats

The whale USD-flow aggregate is clean but lagged and unvalidated — it's forward-logged (via scripts/30) to test whether it predicts, but it has not earned an edge. On real data captured 2026-11-09 the cohort read neutral. So it's used as positioning / divergence context, not a timing trigger. The top 3 traders account for about half of the sampled volume. The security screen is a hard gate that fails closed: an unsafe token — or a screen that cannot run — turns an ENTER into an ABSTAIN regardless of flow.