Robinhood Honeypot Analyzer

The Tech Quant Honeypot Analyzer reverse engineers deployed EVM contracts on Robinhood Chain. It fetches the current runtime bytecode, decompiles it with Heimdall and Lutetia, and gives both outputs to Codex through oh-my-pi for the final analysis. The verdict focuses on durable sell restrictions and privileged transfer controls.

The sample endpoint points to FinanceAI at 0x59D2B3f39a0608500D94938Ccec133e99D77d3ef. Its report demonstrates a caller-specific transferFrom allowance bypass without describing a direct transfer block that the evidence does not show. The main page starts with an empty address search.

Local

nstack setup
pnpm dev
# or
nstack dev
pnpm worktree
nstack devexec 'return await apiJson("/analysis/sample")'
pnpm check
# or
nstack check

Heimdall and Lutetia 0.2.2 are included in the production backend image. For local development, install each executable or set HEIMDALL_BIN and LUTETIA_BIN to their paths. The deterministic opcode checks still run when a decompiler is unavailable. Lutetia receives runtime bytecode already fetched by the backend and does not need an RPC URL.

The browser receives a short Lutetia preview, while Codex reads the complete unsliced output from a private workspace file and continues with offsets until EOF. The related-contract decompile tool writes the same complete file before returning. Partial output is never treated as a successful decompilation.

Analysis only requires deployed runtime bytecode, so a newly created contract can be inspected before holders, transfers, source code, or explorer metadata exist. The analyzer does not replay transactions or impersonate holders. Codex can make bounded eth_call simulations against one current-state snapshot. These calls cannot persist state, override storage, sign, or send transactions.

Token supply concentration, whale balances, and wallet distribution are excluded from the verdict. Temporary launch buy restrictions, finite buy-side anti-bot windows, launch max-wallet limits, and buy cooldowns contribute zero points to the score. Launch sell restrictions, sell-only reverts, and controls that prevent disposal are scored normally. Token-level buy and sell taxes are measured separately. Rates from 20% to under 50% are high, 50% to under 90% are extreme, and 90% or more are confiscatory. Active sell-tax bands contribute 35, 70, or 90 points; active buy-tax bands contribute 15, 30, or 50 points. Callable admin sell setters contribute 25, 50, or 65 points; admin buy setters contribute 10, 20, or 35 points. Finite launch-only sell taxes contribute 20, 45, or 60 points, while finite launch-only buy taxes remain neutral. Only the strongest tax rule per direction counts. DEX fees, price impact, slippage, gas, and rounding are excluded. LP custody is reported separately and never changes the honeypot score.

Codex does not choose a free-form number. It returns evidence for a closed set of honeypot mechanisms, and the backend assigns each accepted rule a fixed point value. Overlapping rules in the same family are deduplicated and the total is capped at 100. Unverified source, tx.origin by itself, external dependencies by themselves, decompiler ambiguity, proxy presence, and missing simulations can lower confidence or appear as limitations, but cannot add points. An empty evidence ledger produces a valid score of zero.

LP analysis resolves fungible V2 balances plus V3 and V4 position ownership. V2 holders and position history are reconstructed from bounded read-only RPC logs. The backend does not query Blockscout; the site keeps an optional explorer link for users who want to inspect an address manually. Burn addresses count as permanent. When a contract owns the LP or position NFT, its exact runtime is checked for current approvals, principal withdrawal, position transfer, generic execution, and delegated execution. Heimdall and Lutetia output for each custodian is cached permanently by runtime source hash. Fee collection alone does not establish that position principal can be removed.

EIP-1167 minimal clones and EIP-1967 proxies are resolved before decompilation. Codex, Lutetia, Heimdall, and the opcode scanner receive the current implementation code while the report keeps the original token address and proxy metadata visible.

Decompiler output and completed Codex synthesis are stored permanently in Postgres. source_decompiler_analyses keeps versioned Heimdall and Lutetia artifacts, while source_codex_analyses keeps the source-level model report. Decompiler rows use the exact SHA-256 runtime hash. Codex rows use a structural source-family hash that normalizes repeated small Solidity immutables only when they are proven to participate in block-number or timestamp comparisons. This lets deployments of the same source share one model review while preserving exact decompiler output for each runtime. The Codex key also includes the model and analyzer version. Neither table has an expiry or deletion path. New analyzer versions retain previous reports for auditability. Snapshot RPC reads can validate source semantics, but volatile state and first-seen addresses are excluded from the permanent source verdict.

Frontend requests use durable Postgres analysis jobs. active_analysis_jobs leases one worker per contract address, so concurrent requests receive the same job ID. analysis_jobs stores progress and completed reports, and recent_contract_analyses supplies the recently analyzed token list. A worker heartbeat allows interrupted jobs to be replaced without running a duplicate while the original worker is healthy.

The official Robinhood Chain public RPC is the fallback and is rate-limited. Set ALCHEMY_API_KEY with nstack env set ALCHEMY_API_KEY for repeated or production analysis, matching the provider route used by CashCatMaps.

Codex synthesis

The model stage is disabled until OMP_ENABLED=1 is present. The product labels the configured production model as GPT 5.6.

nstack env set OMP_ENABLED

Set OMP_MODEL to override that route.

Production OAuth is supplied as OMP_AGENT_DB_B64, containing a gzip-compressed OMP credential database encoded with base64. The backend image restores that private database with mode 0600 before starting the service. Keep this value in nstack runtime secrets.

The generated analysis context already contains the Lutetia and Heimdall outputs. Codex reads and compares those outputs against the opcode scan. Its OMP session exposes five read-only tools:

• read, restricted to the generated analysis context
• fetch_contractsource_and_decompile, which fetches and decompiles one exact address without resolving or following proxies
• read_account_state, for snapshot balance, nonce, and runtime bytecode
• read_contract_storage, for one explicit storage slot
• simulate_contract_call, for disposable eth_call and gas estimation

RPC tools use the server-configured Robinhood endpoint and one fixed block for the review. They verify chain ID 4663, cap the session at 12 RPC tool calls, limit calldata and output size, and expose no arbitrary RPC method. The extension rejects shell, write, edit, browser, search, send, signing, state override, and subagent operations even if external configuration enables them.

nstack init installs dependencies and approves pnpm build scripts before the initial git commit. If this app was copied manually or cloned fresh, run nstack setup to install dependencies, bootstrap pnpm through Corepack when needed, install the Encore CLI when it is missing, and check Docker only when declared Encore resources need it.

The Nuxt frontend calls Encore through apiClient() in frontend/app/utils/api.ts, backed by the generated client in frontend/app/generated/encore-client.ts. The root page renders the address form, a short explanation, and recent analyses before a token is selected. The interface follows CashCatMaps, including its Robinhood wordmark, Tech Quant logo, Onest and JetBrains Mono typography, left-aligned search, job progress, and creator credit. pnpm dev runs the Encore backend, generated client watcher, and Nuxt frontend. pnpm check, pnpm build, and nstack deploy keep the generated client current.

backend/encore.app intentionally leaves the Encore app id empty. That keeps local encore run and encore check in Encore's local-only mode so they do not fetch Encore Cloud secrets. Use nstack.config.mjs app.slug for app identity in nstack and Dokploy; only fill the Encore id when intentionally linking this repo to Encore Cloud.

When nstack dev detects an AI coding harness such as Codex, Claude Code, or a custom NSTACK_AGENT_HARNESS=<name> value, it refuses to start a long-running dev server by default. Agents should use nstack devexec '<js>' for one-shot checks against a temporary dev stack. Set AI_ALLOW_DEVSERVER=1 only when an agent truly needs an interactive dev server.

Frontend

Nuxt pages live in frontend/app/pages; their file paths define their URLs. The default layout in frontend/app/layouts/default.vue provides the shared page shell. Use NuxtLink for internal links and apiClient() inside useAsyncData() for SSR calls to Encore. Nuxt Icon, Nuxt Fonts, and VueUse are available throughout the app. pnpm check also type-checks Vue templates and route components.

Deploy

The production target is https://sec.techquant.club.

Point the domain at your Dokploy server. If this app was not linked during nstack init, run:

nstack configure --domain <domain> --dokploy-url https://dokploy.example.com --dokploy-api-key <key> --repository https://github.com/acme/techquant-secanalyzer.git
nstack deploy

After that, the usual loop is small:

pnpm check
# or
nstack check
nstack deploy
nstack status

If this app has multiple local deploy targets, interactive nstack deploy asks which environment to deploy. Automation should pass --env <name>.

Deploy settings live in .nstack/local.env. App runtime secrets live in .nstack/secrets.env. nstack writes these files with private local permissions.

This app can live in a monorepo without a nested Git repository. Run commands from the app directory or pass --cwd <app-dir>; nstack scopes generated deploy artifacts, client sync, local .nstack state, and source-backed Git dirty checks to this app. For subdirectory source-backed deploys, nstack defaults Dokploy composePath and watchPaths to the app path unless you override them.

For deploy-on-push, connect the matching Git provider in Dokploy first. nstack can configure provider-backed Compose sources for GitHub, GitLab, Bitbucket, and Gitea/Forgejo. Use deploy.source in nstack.config.mjs for advanced provider fields such as explicit provider ids, GitLab path namespace, Bitbucket slug, or custom plain-Git SSH key id.

Secrets

nstack env set API_SECRET
nstack env push

Use nstack env pull --all when remote env changed and you want to refresh local secrets.

Recovery

nstack doctor
nstack logs --follow
nstack pull
nstack rollback

nstack provisions declared Encore resources automatically. Dokploy Domains/Traefik handle ingress; there is no proxy container in this template. By default Dokploy builds the production Nuxt server and Encore backend from source through Compose, so no external image registry is required.

Encore cron jobs are registered as Dokploy schedules. Keep cron endpoints private with api({ expose: false }, ...); Dokploy executes them through the bundled backend cron runner instead of calling a public HTTP route.