# Live mc5 rugs: forensics 12 Oct (exec)
Script: rugforensics.py (rpcpool free RPC, mirror mc5.db). Raw: rugforensics.json. Pool list: fw/rugs.json (9 pools; its `t` is the BUY time, not the pull time).

| # | pool | pool-create tx sender | token deployer (first token tx.from) | pull (Burn) tx sender |
|---|---|---|---|---|
| 3 | 0xc5f873f6 | 0x311dd831fc | 0x20a0d61d2b | 0x20a0d61d2b (via position mgr 0x73991a25) |
| 4 | 0x0f592dcb | 0x311dd831fc | 0x20a0d61d2b | not in +-300 blk of buy |
| 5 | 0x1996432a | 0x311dd831fc | 0x20a0d61d2b | idem |
| 6 | 0xf0d59bfd | 0x311dd831fc | 0x20a0d61d2b | idem |
| 1 | 0x6d6ea481 | 0x9f1a93f4c3 | 0xfae3956763 | not found |
| 2 | 0x2c254c0c | 0x77847838ef | 0xf7067c1447 | not found |
| 7 | 0xae0e93c0 | 0xf8e70b4e03 | 0xf7d3c7ce47 | not found |
| 8 | 0xa20e64ec | 0x1323f74047 | 0xf266214f4a | not found |
| 9 | 0x2912e652 | 0xddb8243bdb | 0xbdd97d28dc | not found |

Findings
1. The 4-in-25-min burst (pools 3-6, buys 11 Oct 23:55-00:19 BKK, all open_unsold = never sold, stuck) is ONE operator: same pool-create sender 0x311dd831fc4ecd3430a54afcc6394a40b5691404 and same token deployer 0x20a0d61d2baee1624aabfebc74acc4770f0df71e in all four. The deployer itself sent the LP burn/decrease tx on pool 3 (block 85988786, ~18 blocks after our buy). So LP NFT owner = deployer, unlocked, deployer pulled.
2. The other 5 rugs (pools 1,2,7,8,9) are 5 different wallets: no cluster. Their pull is not a Burn within +-300 blocks of our buy (they stopped at 0.5x, so likely dump-by-selling, as in the 8 Oct TM report), not a LP pull.
3. Position NFT owner could not be read from the create tx (NFT mint is not in the token's first tx); not resolved.

Dry gate (proposal, NOT in live code): wallet blacklist of pool-create sender + token deployer, plus "creator already had a rug within 24 h". Would have blocked pools 4,5,6 (3 of the 4 burst buys, ~0.012 ETH) once pool 3 had rugged; pool 3 itself and the 5 singletons are not catchable by wallet history. A "LP owner = deployer, unlocked" check needs an ownerOf call per candidate (+1 RPC at the entry decision); I have not built it into fm_mc5.py.
Next: need the rest of the #2130 title (cut off at "if dep...") to finish item 2.