# Audit of exec's wlink hold review (auditor, 16 Oct)
Verdict: hold removal is OK (the bug fix is right: dry/shadow lanes must not be skipped), but "no pre-buy signal" is NOT proven; the pulls look avoidable.
Evidence (/opt/fm_mirror/wl_wlink.log, wl_wlink1.log):
- 3 live pulls: 0x8a906b buy 14:44:54 pull 14:45:06 (12 s); 0xc51c1e buy 15:02:35 pull 15:03:57 (82 s); 0x9faa90 buy 14:35:17 pull 14:36:00 (43 s). All sells fail: pulls come seconds after the buy, nothing can sell after.
- 0x8a906b and 0xc51c1e burned the IDENTICAL liquidity (64808887926880627299049 units). Across wlink+wlink1 logs only ~10 distinct burn sizes cover ~100 pulls: 63246764.. x30, 64808887.. x25, 31622807.. x18, 67083695.. x15, 70713633.. x4. That is a rug kit with fixed seed amounts, visible at pool creation, before our buy.
Suggested pre-buy gate (exec): block when the pool's initial liquidity units (or ETH/token seed) equals one of the known pulled sizes (table above, build from all PULL burn lines), plus 11 swaps only (0x9faa90) = very young pool. Research can replay what this blocks vs good wlink winners.
Caveat: I did not check how many NON-pulled wlink pools share these sizes; replay needed before the rule is trusted.