# a1-2084: four rugs 11-12 Oct night = one serial operator; rule "known dumper in pool" (analyst1, 12 Oct)

## Finding
The four mc5 buys of 16:55-17:19 UTC (0xc5f873, 0x0f592d, 0x199643, 0xf0d59b) are one operator, not bad luck:
- One wallet (0x311dd8...) bought 8-10 ETH in the first 22-61 s of each pool and dumped it later. It did this in 10 consecutive pools in 50 min (17 Oct 11 UTC 1791735903 to 1791738890). mc5 bought the last 4; the first 6 were never bought.
- The same 174 wash wallets (0.1 ETH buy/sell round trips) sit in all four pools. Outside the cluster they are ~1% of any pool's signers (normal range 0.4-5%).
- Static features do NOT separate them. Dev-buy size, top-buyer share, volume per pool WETH, unique signers, pool_weth: all identical to the normal mc5 population (n=60, 32 pulled, no bucket stands out). Do not build a static filter on these.

## Rule that works: dynamic dumper blacklist
Blacklist = for every pool with a PULL event, the wallet with the largest sell ETH (>=0.5) in that pool. Skip an entry if any wallet that bought in the pool before the entry is on the blacklist from a pull in the last 6 h (other pool).
Replay on all 60 mc5 buys with a closed or open_unsold outcome (mirror mc5.db + /opt/sw/v3live.db, no look-ahead: blacklist uses only pulls before t_buy): flagged 4 (mean 0.00x), unflagged 56 (mean 1.71x vs 1.62 overall). 0 false positives, 0 winners removed (the 4 big winners 29x/19x/13x/13x are untouched). Blacklist has 231 wallets from 1330 pulled pools in the file.
Money: avoided 4 buys at 0x = about 4 x size per cluster night; at the 8 Oct-12 Oct tape that is one such cluster in 5 days, so ~ +0.8 size/day. Cluster-limited: evidence is ONE operator. A rule that would not have helped the first rug, only the 2nd to 10th.

## Caveats
- n=1 operator; cannot say how often serial operators come. Cheap and low-risk, so worth shadow-logging first.
- Needs a live signer feed per pool before entry (swaps buyer list by t_buy). v3live has it; whether exec's mc5 sees it at decision time is exec's call.
- Script: /tmp copies at /opt/crew/work/analyst1/r1/dumper_bl.py (see below).

## Ask (exec)
Add to mc5 as a shadow flag first (log `bl_hit` in c.note, no skip) for 48 h, then enforce if no winner is flagged. Only Ben switches live.
Also: tm-sweep says 229 skips have no reason in c.note: exec to check.