How the canary listens.

What the canary listens for

Proxima is a tool for launching memecoins. One person launches a token and, in the same block, buys a big share of its supply from dozens of wallets, so it looks like many buyers. A block is a batch of transactions the network writes together, about every 0.4 seconds on Solana; buys packed into the token’s first block are called a bundle. Those wallets sell later, often to people who just bought in.

Everything Canary reads is on-chain: written on the public blockchain, where anyone can check it. On Solana, it reads a token’s creation, its first and latest transactions, its first buyers and, when there are hints, those buyers’ wallets around the launch. It listens for three kinds of fingerprints, each linked to its transactions. Robinhood Chain has its own signals, in Beta: see below.

1 · Proxima’s own programs

A program is code that lives on the blockchain and does things when a transaction calls it, through named actions called instructions. Proxima runs its own Solana programs. When a token’s transactions — or its first wallets’ — call one of them, or carry its instructions (SellAndDispersePump and its siblings, the Buyback family, RecordMevBuy), that is direct proof.

The programs are not a hard-coded list. They are rediscovered from their upgrade authority, the key that deploys and updates them (GVt5…7C3h), with a read-only query, so a quiet redeploy under the same authority is picked up on the next pass.

2 · The fee trail

After a user’s sale, or after a creator claims their launchpad fees, Proxima charges its own fee: 5% of the proceeds, 2% or 3% on some referral deals. It lands in a fee wallet, a brand-new address used once, in a separate transaction right after. About a day later (median 25 hours) a collector, a wallet that gathers Proxima’s fees, empties several fee wallets in the same second: a sweep. It splits the sweep in two: 15 to 50% to the user’s referrer (whoever invited them), the rest to a Proxima treasury, Proxima’s own wallet, which changes about once a day. Following this money is what we call the fee trail.

Canary’s indexer, a process on our server that keeps reading the chain, finds those treasury wallets from the sweeps themselves, reads every sweep they receive, and walks each one back to the users. Every wallet it meets goes into the fee tree: the map of wallets linked to Proxima by its fees. A creator or a wallet from the launch bundle already in the tree is direct proof. So is a seller paying the fee into an address that reaches the tree within three hops, that is, three transfers.

During a scan, Canary also traces sellers live: it follows the fees of the token’s first four sellers, newest knowledge included, to see whether any reached the tree. Four is a cap that keeps a scan to a few seconds; it is not the token’s number of sales. Every other sale is covered by the index, the fees the indexer has already seen for that token. A result that says “The first 4 sellers were traced live” means those four paid nothing that reached Proxima yet, and nothing in the index says otherwise.

3 · Fingerprints

Proxima’s users leave habits. Jito and Astralane are services that put a transaction first in a block in exchange for a tip. Early wallets are funded through a Stake Withdraw, taking SOL out of staking (where it was locked to help run the network), with two tiny tips (about 0.0002 SOL), one to Jito and one to Astralane. Pairs of tip-only transactions of about 0.003 SOL go to Jito and Astralane in the same second, around the launch. A known Proxima wallet shows up among the later buyers. And since late October, the wallets at the launch are often funded in a fan: a minute or two before the launch, each one receives the same amount from about ten different wallets at once.

These are patterns, not proof. One of them alone doesn’t change the answer: it stays No Proxima evidence, with a “Proxima-like patterns” label. Two of them make a launch Likely Proxima: it looks like a Proxima launch, but there’s no proof.

Two more things are reported as information only: several buys in the same slot as the creation (a slot is Solana’s 0.4-second step; the site says “the first second” and tags it “bundled at creation”) and Jito plus Astralane tips in the launch block. Lots of launches do both, Proxima or not. On its own, bundled at creation gets only its own label; launch-block tips get the “Proxima-like patterns” label at most. There are three exceptions. Stake Withdraw funding together with Jito plus Astralane tips in the launch block makes a launch Likely. So does a fresh Proxima fee — a seller paying 2, 3 or 5% of the sale, in a separate transaction within two seconds, into a brand-new wallet — together with a bundle at creation or the launch-block tips. Other tools charge similar fees, but not in that shape: on 1,323 random launches the fresh fee never pointed anywhere but Proxima. On 54 Proxima tokens whose fee trail we could not follow yet, that pair raised Confirmed or Likely from 9 to 42. The third is the fan: a wallet at the launch funded by five or more wallets sending the same amount just before the launch, together with tips to Jito and Astralane, at the launch or in the ten minutes after it. On 1,453 random launches it showed up 14 times: 13 were Proxima launches we could check, and the last had every Proxima habit but no fee we could follow. On 40 Proxima tokens never used to build it, it raised Confirmed or Likely 30 seconds after launch from 27 to 38. The Stake Withdraw usually comes 5 to 25 minutes after the launch, so it helps in the first hour, not in the first seconds.

The verdict rule

Under “No Proxima evidence”, one pattern, launch-block tips or an unswept fee add an information label: “Proxima-like patterns”. It is not a verdict. It is there because silence would be wrong: in our October checks of Proxima launches traced back from their fees, every one that Canary couldn’t confirm or call Likely carried it. Plenty of launches that aren’t Proxima carry it too. Bundled at creation alone doesn’t.

“No Proxima evidence” is an honest statement about one platform. It never means a token is safe: a token can be rugged or dumped on in ways that have nothing to do with Proxima.

The October 2026 test

We scanned 1,153 random Solana launches — 1,000 from pump.fun and 153 from Bonk.fun — picked at uniform times over seven days, 13 to 20 October 2026. Nothing was excluded in advance. On 21 October we rescored them with today’s rules; 9 weren’t in our cache.

Then speed, on launches the rules had never seen. We took 60 Proxima launches that the indexer found through their fee payments, none of them used to build or tune any rule, and replayed each scan as the site would have run it seconds and minutes after creation, using only the transactions — and only the fee-tree knowledge — that existed at that moment.

The hard case is a Proxima user Canary has never seen. Until their first fee reaches Proxima’s treasury, about a day after their first sales, only Proxima’s programs and the patterns give them away — and Proxima says it rotates its program IDs. That is the one launch in eight Canary still misses in the first hour, and why “No Proxima evidence” is never a promise. It is also why a token under 36 hours old comes with “check again tomorrow”: once its first fee is collected, the same scan can come back Confirmed. About a day after a new user’s first sales, Proxima collects their fee: from then on Canary knows the user, most of their Likely answers turn Confirmed, and their next launches are Confirmed from the first block.

Robinhood Chain · Beta

On Robinhood Chain, the two Proxima launches we started from (zkThunder and Startup) use two contracts, programs on that chain, that almost no one else does. A bundler buys for 3–4 wallets in the block right after creation. An executor rotates the bundle into fresh wallets: it sells on the launchpad’s price curve and buys straight back for the signing wallet. Proxima’s public app code has a matching “Cleanup” feature. On the home and result pages these are “the contracts Proxima users buy and sell through”.

The link to Proxima rests on those two launches and the app code, not on a transaction Proxima signed itself. So on Robinhood Chain these signals give Likely at most. One transaction from a known Proxima launch (its bundle buy and one cleanup) would turn them into proof. The public Robinhood Chain RPC, the service that answers questions about the chain, keeps no traces of transfers made inside a contract, so fees paid that way aren’t checked.

What Canary can’t see

• New programs from a new authority. If Proxima redeploys under a different upgrade authority, its programs stop being direct proof until we find them. The canary check below watches for exactly this.
• Brand-new wallets, for about a day. The fee trail only reveals a user once their first fee is swept, about 25 hours later. Until then, only Proxima’s programs and the patterns give them away. A token under 36 hours old says so under its verdict.
• Activity far from the launch. Canary reads the first 100 buys and the first wallets within ±12 hours of the launch, plus the token’s latest 100 transactions.
• Other launchpads. pump.fun and Bonk.fun on Solana, and the Robinhood launchpad. Elsewhere, Canary says it can’t read the launch instead of guessing.
• Intent. Canary reports what happened on-chain. It can’t tell you what anyone will do next.

The canary check

A canary needs its own canary. A read-only check, meant to run every day, asks four questions. Are Proxima’s treasury wallets still receiving sweeps from all its referral branches? Are the latest launches that use Proxima’s programs still detected? Have new programs appeared? Do the sweeps still follow the same pattern, and is every new treasury wallet indexed? Any “no” raises an alarm, and the rules get reviewed before anyone trusts a verdict again.

What we store

Your wallet address and your daily scan count, so the holder limit works. Signing in is a plain-text message, never a transaction: Canary never sees a key or a seed phrase and never builds or sends a transaction. Every chain read goes through our server; your browser never talks to an RPC service with our key.