---
name: screen-log-6
description: Continuation of [[screen-log-5]] from 13 Sep 2026, after that file hit the 48KB cap. Same rules and columns as [[screen-log]] - one row per screen, written BEFORE the verdict, screen-time facts only, outcomes scored in the screen-log-outcomes files. Read and append on every screen.
sources: [cowork]
aliases: [screen-ledger-6]
---

# Screen log, part 6 (from 13 Sep 2026)

Rules and columns are in [[screen-log]]. Rows under 2KB where possible. Prior rows: [[screen-log-5]].

## Log

### 2026-09-13 ~14:45 UTC. NOTEFI / $NOTE, Robinhood Chain. Token `0xd22efb8cb47b45485d8dfaae036214e2c22e35aa`, pool `0xd4c88fe5358ca0848896ef53652da2d481e513f2` (WETH, Pons V2 curve, NOT yet graduated). LENS: TECH. DD-process four-pass format (Ben's "Run DD" command, first live use of the ten-question dd-process skill). Screened ~57 min after launch. Thread named "DD".

**VERDICT: avoid.** Single flip: the swap starts quoting AND the dev posts the fix within hours.

**SCREEN-TIME NUMBERS.** Pool created 13:57:56 UTC. Mcap $24.5K -> $28.5K during the screen, reserve $17.7K, 24h vol $20.1K, price +552% since launch, **curve 59% to graduation**. Holders 45, top10 65%. 1h 171 buys / 76 sells (132 buyers / 61 sellers); last 5m 29 buys / 22 sells (sellers catching up). **Tape genuinely clean: 138 unique wallets across the last 234 trades, largest single trade $497, no bundle, no uniform slices.** Dev holds 1.7%. Net buy for 10x ~ $19.4K.

**⚠ TICKER SQUAT, and it is the headline. NEW SUB-PATTERN FOR THE IMPOSTOR CHECK.** The ticker **$NOTE on the same chain already belongs to "Note Systems" `0xc4f730335Fb9e439ca5552f7b52B8E638c4245B0`** (@notesystems, $2.09M FDV, $273K liq, $331K 24h vol, launched ~9 Sep, autocallable barrier notes on tokenized stocks). Pushed by SneakyGems (111,492), CryptoFellaTx (51,129), digitaldynastyz (24,195), AltcoinSensei (15,327). **NoteFi is NOT a cloned contract — different product, own site, own X — but every $NOTE search returns Note Systems, so it can never own its own name.** **A ticker squat is not an impostor contract and the standard "self-minted copy / same metadata, different creator" test does NOT catch it. The test that does: search the ticker and ask whose PROJECT the results are about, not which contract they carry.**

**THREE CONTRADICTORY DESCRIPTIONS OF THE SAME PRODUCT, all live at once.** X bio @useNoteFi: "Tokenized stock **baskets** on Robinhood Chain." Launchpad/GeckoTerminal blurb: "swaps, liquidity, and **capital management**". Site `<title>`: "NoteFi — **DeFi Liquidity** on Robinhood Chain". Shipped code: a plain swap box. **The word "basket" appears twice in an 841KB bundle and nowhere on the site.**

**THE PRODUCT LOOKS REAL AND THE CORE FEATURE IS BROKEN. This is the reusable finding.** Clicked through via the Chrome bridge: `/app` Market Discovery lists **194 tokenized stocks with live reference prices** (CRM $247.99, AVGO $356.82, SPCX $150.28), ALL/VERIFIED/COMMUNITY tabs, per-asset TRADE buttons; `/app/swap` and `/app/portfolio` exist. Copy claims "Live executable quotes come directly from onchain Uniswap V3/V4 quoters". **Typed 1 ETH -> USDG: returned 0. Reloaded, typed 0.1 ETH -> USDG: returned 0.** A quoter is a read call and needs no wallet, so this is not a connect-wallet gate. **The USDG/WETH 0.01% pool holds $27,618,482 with $316,528,147 of 24h volume, the deepest pool on the chain. If the quoter cannot price that, it prices nothing.** The "24H VOL / LIQ" column on Markets is also all em-dashes. **STANDING METHOD RULE: a beautiful multi-page app is not a working product. On any swap/trade/quote UI, type an amount into the one box that matters and read the number back before grading Q4 as live.**

**HOSTING TELL: it is a Replit build.** `https://i.replit.com/script.js` sits in the page head, and the bundle still carries **`rpc.testnet.chain.robinhood.com` and `explorer.testnet.chain.robinhood.com`** alongside mainnet. Real wagmi/viem wiring though: Uniswap v4 PoolManager `0x8366a39cc670b4001a1121b8f6a443a643e40951`, Permit2 `0x000000000022D473030F116dDEE9F6B43aC78BA3`, WETH `0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73`, Global Dollar/USDG `0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168`, NVIDIA RH token `0xd0601ce157db5bdc3162bbac2a2c8af5320d9eec`, Apple RH token `0xaf3d76f1834a1d425780943c99ea8a608f8a93f9`. **Probing the site's JS bundle for `0x[a-f0-9]{40}` and then `eth_getCode` + `name()` on each hit is the fastest way to learn what an app actually touches; it named the whole stack here in one call.**

**DEPLOYER `0xc174c3cb7487e5313f7d0ba455abd018d8ab957e`. Brand-new wallet: `eth_getTransactionCount` = 2.** Two transactions in its entire life. No prior launches, so no rug history and no track record either. Balance 0.01905 ETH (~$47). Holds 1.7% of supply. **REUSABLE SHORTCUT: when Blockscout is Cloudflare-walled and Dune is unavailable, a single `eth_getTransactionCount` on the deployer settles "has this wallet launched before" in one call — nonce 2 cannot hide a launch history.**

**CONTRACT CLEAN, read from runtime bytecode (3,249 bytes) because GoPlus returned `{"result":{}}`.** NO mint(address,uint256), NO pause, NO owner, NO transferOwnership, NO renounceOwnership, NO blacklist, NO setFee, NO setMaxWallet. Third-party scanner confirms 0% buy / 0% sell tax, not a honeypot, source closed.

**OPERATOR: @useNoteFi, GRADE D-minus, largely ungradeable by newness.** Account **created 2026-09-12T07:06:26Z** (one day before launch), 406 followers, 8 posts, following 4, favouritesCount 0, blue-verified. Site notefi.ink deployed alongside. **twitterapi.io `user/last_tweets` returns 0 tweets against statusesCount 8 — the known new-account index gap — so his timeline was NOT retrievable and Q7a could not be graded.** No GitHub anywhere (site, X, launchpad). Nothing shipped since launch (57 min old). **Q8 pump economics: $0. No buybacks, no burns, no fee share, never engaged the topic.**

**COVERAGE: three real posts, ever, and they look bought.** Tier-one all zero (blknoiz06, theunipcs, CrashiusClay69, pingucharts, metaversejoji checked by name with correct `from:` parenthesisation). What exists: @BOSSBABYRAIDER (1,199 followers, whose last three posts are "Aped some $ZKISHU / $BOB / $BabySue" for three different coins), @RobinhoodAlphas (56,759) "$NoteFi could be next 100x !", @Visucalls (8 followers). Replies to the project account are all partnership spam from marketing accounts (@142C_ 142,568 "Feel free to DM", @CryptoRise_0 50,591 "let's talk", @HoodGUY_1 49,844 "can I get a follow back"), every one at 0 likes. **`notefi.ink` has ZERO mentions on X.**

**PMF: DEMAND EXISTS, ALREADY CAPTURED.** The job is done on this chain by ROUTE (route.fun, real aggregator, $3.88M), Pons itself ($379M) and Uniswap's own interface. Zero builder signal, zero technical questions, nobody complains by name if it vanishes tonight.

**MOAT: zero both ways. Rebuild 1-2 days** (Replit-grade React over public Uniswap contracts). Token moat zero: the token does nothing in the app — no fee, no gate, no share.

**LORE: none, and worse than none.** "NoteFi" = note + fi. A *structured note* is a bank product, which is exactly what the real $NOTE (Note Systems) does, so the name reads as a deliberate ride on a live $2M narrative. Nothing to look up, no joke, no chain fit, no landlord.

**SOURCE FAILURES, named rather than dropped:** DexScreener has still not indexed this pair (`/tokens/{ca}`, `/pairs/robinhood/{pool}` and `/search` all return null/empty roughly an hour after launch) — **GeckoTerminal was the only price source, and its `/tokens/{ca}/info` route is what carried holders, developer_address and developer_holding_percentage.** Robinhood Blockscout Cloudflare-walled on both v1 and v2 all session again. **⚠ Dune now returns "This api request would exceed your configured datapoint limit per billing cycle" — the monthly billing limit is spent, so Dune is unavailable until Ben raises it on dune.com. Check this before planning any multi-token or funder-graph query this month.**

- OUTCOME: pending, score in [[screen-log-outcomes-5]]

### 2026-09-13 ~16:25 UTC. DUO / Duo (duo.rich), Robinhood Chain. Token `0x601C29752e68Bfff7113751c7d6b6655494D07ae`, main pool `0xe7ad493981eb5a93bfbfe6e8e1acaddcb47f652c12d2d9083419a83404bc2833` (Uniswap **v4**, DUO/ETH). LENS: TECH. dd-process four-pass format, second live use of the Run DD command. Screened **45 minutes after launch**.

**VERDICT: buy (small).** Flips to avoid if the even 1.2-2.5% wallet band unloads together, or 24h passes with still zero third-party launches on the pad.

**SCREEN-TIME NUMBERS.** Token deployed 15:42:30 UTC (first Transfer, block 62071531). Mcap **$178K** at screen (read $187.6K twelve minutes earlier). **ATH $227K mcap at 16:16 UTC, so -16% off ATH, ten minutes old.** Liquidity $39.5K (DexScreener, the v4 DUO/ETH pool). Volume since launch $172K. 1h **663 buys / 512 sells**; 5m 65/43. Holders with a balance **203**; unique addresses touched 477 and rising ~35 per 5-minute bucket (250 -> 282 -> 312 -> 335 -> 408 -> 437 -> 471 -> 477). Net buy for a 10x ~ **$43K** (L/2 x (sqrt10 - 1) on a $39.5K pool). ETH ~ $2,499 implied from the pool.

**WHAT IT IS.** A launchpad, not a meme. Every launch mints TOKEN plus a 1:1 redeemable wrapper wTOKEN, creates a TOKEN/wTOKEN pool (the "paired with itself" hook) and a TOKEN/WETH pool in one atomic tx. Duo's platform wallet pays the gas and seeds the initial ETH, funded from creator fees, so launching is free to the creator. Creator fees also buy back the DUO token. Wrapper contract `0x267444d099b10fb5ed7c3cc7b7c767adca574952` holds 81.6M DUO (8.16%).

**CONTRACT CLEAN, read from 3,248 bytes of runtime bytecode (GoPlus returns `{"code":2022,"message":"The main chain is not supported"}` for chain robinhood, so GoPlus is NOT a route on this chain).** totalSupply 1,000,000,000 fixed, 18 decimals. NO mint(address,uint256) 40c10f19, NO pause 8456cb59, NO owner() 8da5cb5b (reverts on call too), NO transferOwnership f2fde38b, NO blacklist f9f92be4, NO setFee 69fe0e2d, NO setMaxWallet 5d0044ca. PRESENT: burn, burnFrom, transfer, approve. Nothing can be switched on later.

**⚠ REAL BUYBACKS, CONFIRMED ON CHAIN, INSIDE THE FIRST HOUR. This is the strongest single finding and the method is reusable.** Deployer `0xbd98898ef101b7d4b7e248b4fe2a29420dad7dab` sent **1.1 ETH (~$2,750)** through the Universal Router `0x8876789976decbfcbbbe364623c63652db8c0904` (selector `0x3593564c` execute) in three market buys: 0.5 ETH at block 62085556 (`0xfb8285f77d0d2e31c866cc42ae43148dabfb81986604c16493da1385ebc32011`, 8,663,990 DUO out), 0.5 ETH at 62093401 (`0xad8fbffd1b5dfba642ff80dc07c3f0dba548aebb5aaac97f51f3ea6f21cf1f00`, 6,858,797 DUO), 0.1 ETH at 62094115 (`0xa99265dae1127fd6e3882cc5e7ad87f5079209c40ebccc861edb7050ec5d3168`, 1,285,692 DUO). **METHOD: a DUO inbound leg FROM the v4 PoolManager `0x8366a39cc670b4001a1121b8f6a443a643e40951` is ambiguous on its own (buy, LP pull or fee claim). Open the tx and read `value` plus the `to` address: non-zero ETH into the Universal Router settles it as a market buy in one call. Do this before ever crediting or dismissing a buyback.**

**BURNS PRICED AND SPLIT, per Ben's rule.** 25,000,000 tokens to `0x000000000000000000000000000000000000dead` = 2.50% of supply, two txs, both from the deployer: 15M at block 62079317 (`0xb3fac0c29d11108d40c8af237f8060a91b38a18f036d21f64fefe2941a1d6255`) and 10M at 62086727 (`0x43a5c4aa1c21bf0ddbd7126c454f8b4b2ba005d30246061547229afbcf488d00`). **Honest split: the first 15M burn came out of the free 30M launch allocation he received at block 62071531, so it is a SUPPLY CUT at $0 cost, not a buyback. Only the second burn is partly funded by the $2,750 of real buys.** Deployer still holds 21,808,479 = 2.18%.

**⚠ DISTRIBUTION IS THE UGLY BIT AND THE ONE REAL RISK.** Top 30 = 65.3%. After stripping the v4 PoolManager (108.4M, 10.84%), the wrapper (81.6M, 8.16%) and dead (25M, 2.5%), **roughly 25 EOAs hold 1.2-2.5% EACH in a suspiciously even band** (2.53, 2.39, 2.18, 2.02, 2.00, 1.93, 1.89, 1.79, 1.73, 1.70, 1.68, 1.54, 1.51, 1.49, 1.48, 1.45, 1.44, 1.39, 1.38, 1.37, 1.36 ...). That is Ben's uniform-slice farm pattern. One reply, @Bino87532647 (49 followers), shouted "40% bundles". **NOTE: the "82 recipients within 3s of deploy" read is NOT a bundle count here — the large entries (285M, 204M, 126M) are routing/pool contracts, so a naive first-block cohort count is misleading on a v4 launch. Grade the holder band instead.**

**CLAIM AUDIT.** CONFIRMED: fixed supply, no owner powers, buybacks, burns, pools live on chain, site and docs live. **FALSE / MUDDLED: "Duo creates two Uniswap V2 pools" (posted 16:15) contradicts "first launchpad to use @uniswap hooks" (16:07) and the X bio "using @uniswap v4 hooks" — V2 has no hooks, and DUO's own pool is V4 (tokens sit in the V4 PoolManager).** The docs page also describes "the standard Uniswap V2 pool structure". He is muddling his own stack in public. UNRESOLVED: "4 liquidity pools per launch" — DexScreener shows 5 DUO pairs, of which 4 hold $5.71 to $25.15 of liquidity, i.e. dust.

**OPERATOR: @LaunchOnDuo. ⚠ AGED-HANDLE TELL. `createdAt` 2011-08-21T05:47:23Z, blue-verified, but only 17-18 followers, 20 posts, following 1.** A 2011 account with 17 followers and a wiped history is a bought aged handle, not an organic one. **REUSABLE: always read `createdAt` against `followers` and `statusesCount` — a 15-year-old account with double-digit followers is a purchase, and it means the distribution is zero regardless of the blue check.** Deployer wallet nonce **24**, fresh, no graveyard of prior launches and no track record either, 0.93 ETH left. Shipping inside the hour: pools live 15:47, DEX listing paid and fixed 15:50 and again 16:23, 20 posts in 45 minutes, answered a hostile technical question ("wth is pairing a token to itself") within minutes. **Q8 pump economics: engaged and actually doing it, which is rare at t+45min.**

**PMF: DEMAND EXISTS, UNSERVED, but unproven. ZERO third-party tokens have been launched on the pad.** The /explore list is client-rendered so it could not be enumerated server-side, and no Duo-launched token appears on DexScreener. Robinhood Chain is already crowded with launchpads (Pons, Nest, Snowball, pair.fund, PAR, PRM, Anypad), but "paired with itself" is a genuinely new shape, not a reskin.

**MOAT: product moat thin, rebuild 5-10 days** (wrapper + two pools + a Next.js front end). **Token moat better than most pads: creator fees buy back DUO, so pad volume feeds the token directly.**

**⚠ TICKER POLLUTION, not an impostor contract.** `$DUO` on X is dominated by a completely different Duolingo-owl DUO on X Layer / BNB Chain at ~$9M mcap, pushed all day by Chinese-language accounts (@pandaBA007 35.7K, @BTC667 7K, @BBJieRan 12.9K, @luge517 76.3K). Three other junk "DUO" tokens sit on Robinhood Chain: `0x56aAa501Fa9Eb6670d6175D686957434c3d21E18` ("iPhone Duo"), `0x49c49b086426De2064735416A6347C7cB6a8144C` ("多"), `0xaaf819b27a2EEc4b7D2553da68fc68C863fC8120`. **Search the CA, never the ticker, on this one.**

**COVERAGE: near zero. Tier-one all 0** (blknoiz06, theunipcs, pingucharts, CrashiusClay69, 0xkioto, metaversejoji, dontbuytops, each checked by name with correct `from:` parenthesisation). Replies to the project account are pure partnership spam (@0o20_ 156,215 "love to connect regarding a collaboration", @robinhodalphaX 53,273 "moonshot potential", @RobinhoodAlphas 56,769 "$Duo could be next 100x", @RobinHoodKing_ 49,782 "open to a promo collab", @TheSolanaArmy 24,468), every one at 0 likes.

**SOURCE FAILURES, named rather than dropped:** Robinhood Blockscout Cloudflare-walled again on v2 (`/api/v2/tokens/{ca}`, `/addresses/{ca}`, `/tokens/{ca}/holders` all served the "Just a moment..." challenge) — **the whole holder table was rebuilt from `eth_getLogs` Transfer events over the last 30,000 blocks instead, which works fine on a token this young and is now the preferred route when Blockscout is walled.** GoPlus does not support chain `robinhood` at all. GitHub API blocked from the container (sessions bound to configured repos), so Q6 is genuinely UNKNOWN, not "no GitHub". Chain block time measured at **0.1021 s**, so 30,000 blocks is a ~51-minute window — useful constant for future log scans on this chain. Python `urllib` failed against the Robinhood RPC through the agent proxy while `curl` with a browser UA worked; **shelling out to curl from Python is the reliable RPC transport here.**

- OUTCOME: pending, score in [[screen-log-outcomes-5]]

#### ⚠⚠ 2026-09-13 ~16:45 UTC. DUO OUTCOME: RUGGED ~3 MINUTES AFTER THE BUY VERDICT WAS DELIVERED. THE VERDICT WAS WRONG. This is the most expensive process error in the log so far and the correction is mechanical.

**WHAT HAPPENED.** Coordinated exit in blocks **62096782 to 62096815**, a span of **3.4 seconds**, 42.8 minutes after the mint and ~3 minutes after the screen was delivered. Pool ETH went **7.9134 -> 1.09177** (~6.82 ETH, ~$17,050, extracted). Mcap **$177,964 -> $3,379**, price -98.17% on the 5m. 5m txns flipped to 29 buys / 99 sells.

**THE DEPLOYER WAS IN THE CLUSTER.** `0xbd98898ef101b7d4b7e248b4fe2a29420dad7dab` sold his entire remaining 21,808,479 (2.18%) in the SAME 3.4-second window as the farm wallets, tx `0x5e3db294d41f7941193b574851dae4d179e8d12f46ea62dfc4f252a74164b690`. Every wallet in the even 1.2-2.5% band exited in that window: `0x0592bb781de9edc33f91cc1761c867b9bb2f5a70` 25.3M, `0x9cb8a2ea066d4679b0826abcf987894b50166713` 23.9M, `0xdd544a4ea53f51be4d629bbb559c0969c6487a16` 20.2M, `0xd9dab772ffec66757cc5bdca4ea1785cc109c7a3` 20.0M, `0xf167c87576a8dc77618ed0e9fbf1233314064ef0` 19.3M, and ~20 more.

**⚠ THE EXACT MISS, AND IT WAS A FILTER, NOT A MISSING DATASET.** The launch-cohort check WAS run during the screen and printed "Recipients within 3s of deploy: 82". It was **dismissed as routing noise because the TOP of the list was pool/router contracts (285M, 204M, 126M)**. The whole cohort was discarded instead of dropping the contracts with `eth_getCode` and counting the EOAs underneath. Filtered correctly the same data says: **37 EOAs bought 93.6% of supply inside 15 seconds of the mint; 22 of them in an even 1.0-3.0% band; all 37 now at zero.** The deployer is row 15 of that list at 3.00%, i.e. he sniped his own launch. **STANDING RULE: never discard a launch-cohort read because its largest entries are contracts. Drop contracts by `eth_getCode`, then count the EOAs. The contracts at the top are the pool; the cluster is underneath them.**

**⚠ SECOND MISS: A BALANCE-BASED HOLDER SCAN CANNOT SEE A CLUSTER THAT HAS ALREADY SOLD.** The first version of the gate script scored current balances and returned "clean" on DUO after the rug, because all 37 cluster wallets held zero. **The cohort must be measured by tokens ACQUIRED inside the window, never by current balance.**

**⚠ THIRD MISS, AND IT INVERTS A FINDING THAT WAS GRADED AS THE STRONGEST POSITIVE. THE BUYBACK WAS BAIT.** The deployer burned 25M — which came from his **free** 30M launch allocation — and kept the 16.8M he **bought with 1.1 ETH (~$2,750)**. The bought tokens are exactly what he dumped. The split was written down in the screen row above and the conclusion was not drawn from it. **NEW STANDING TEST, apply to every buyback claim: did he burn what he BOUGHT, or did he burn the FREE allocation and keep the bought bag? Burning free supply while holding bought tokens is marketing spend dressed as value accrual, and it is a rug tell, not a positive. A buyback only counts when the bought tokens go to the burn address.**

**FOURTH MISS: the band wallets' nonces were never checked.** They run 30 to 93 (`0x3dbd440606d13ab9a3707566956dd9ec5aa2ba85` 30, `0xf167c87576a8dc77618ed0e9fbf1233314064ef0` 42, `0xd9dab772ffec66757cc5bdca4ea1785cc109c7a3` 45, `0x0592bb781de9edc33f91cc1761c867b9bb2f5a70` 74, `0x7efe4e5fe2494c06ff074f208a3783b7418edc5c` 80, `0xdd544a4ea53f51be4d629bbb559c0969c6487a16` 93). Seasoned bot wallets, not fresh buyers. **Only the deployer's nonce was checked. Run the nonce on the whole cohort, not just the deployer.**

**FIFTH, ON TIMING: they also topped up in sync.** Second coordinated add across the cluster at blocks 62073750-62073782 (~3.7 min after mint). Three synchronized block windows (entry, add, exit) is the full signature.

**THE MECHANICAL FIX. `snipe_cluster.py` is written and verified against DUO.** Lives at `/home/claude/snipe_cluster.py` in the session that produced it; the full source is in the dd-process skill. Usage `python3 snipe_cluster.py <ca> [rpc]`. It pulls Transfer logs from the mint, finds the mint block, measures block time, sums tokens ACQUIRED per address inside a 15-second window, drops contracts with `eth_getCode`, and prints each EOA with % bought in window and % held now. **GATE: >= 8 EOAs buying inside 15s and together holding >= 20% of supply => CLUSTER DETECTED => verdict AVOID, and NO clean-contract, buyback, burn, dev-reactivity or shipping finding may overturn it.** On DUO it prints `EOAs buying inside 15s: 37 = 93.6% of supply / CLUSTER DETECTED`. **This gate must run and return clean before any screen prints a buy verdict.**

**WHAT WAS ACTUALLY RIGHT IN THE SCREEN, AND WHY THAT DID NOT SAVE IT.** The uniform 1.2-2.5% band WAS flagged, and the named falsifier was literally "the even 1.2-2.5% wallet band starts unloading together". **Detection without action is not a pass. The band was graded as "the ugly bit" and then outweighed by clean contract + real buybacks + live product + shipping dev. That weighting is the error: a coordinated launch cohort is a GATE, not a factor to be traded off against positives.** Every positive in that screen was true and none of them mattered.

### 2026-09-15 ~22:55 BKK. Three-project review: CEREBRO, NOTE (Note Systems), RATSPEAK. Ben pasted two Robinhood Chain DexScreener pools, then added a Base pool mid-turn, then corrected me twice ("Note has had its contract checked officially", "note had their contract checked by nethermind"). Deliverable: artifact "Cerebro, Note, Ratspeak" https://claude.ai/artifact/EJAjLgHuPiwM2XuxbCBFJJ

**VERDICTS. CEREBRO = NO (done). NOTE = short list, not a buy here. RATSPEAK = short list, pending LP-lock check.**

**CEREBRO `0xEb24a2663af4Ee979dCbfE39cB95B5F12D369c4B`, pool `0xb553e268a7790255e0db206aa27fa32e805b431645b230441fbd8beeb7618fc8` (Uniswap v4, quoted in NVDA).** Deployed 09 Sep 2026 22:21 BKK. Mcap $1,742,202, liq $119,324, v24 $668,974, h24 836 buys / 1,590 sells, holders 874. ATH daily-close $0.00811097 on 12 Sep ($8.11M cap) -> **-78.5% off ATH**. Net buy for 10x ~$129,013.
**DECIDING FACT: 23 EOAs acquired 68.52% of supply inside the first 15 seconds (blocks 58,649,580-58,649,730), contracts dropped with `eth_getCode` per the post-DUO rule.** Then on **12 Sep 19:30 BKK, blocks 61,107,286-61,107,372 (7 seconds), 20 of those wallets each sent their entire stack to a different brand-new wallet, one transfer per block, in sequence, interleaved with zero-value probe transfers** — 22.20% of supply, scripted, trail reset. Strict 40-wallet cluster (20 senders + 20 receivers): **bought only 1.74% of supply from the pool, holds 21.42%, sold 5.38% all of it BEFORE the rotation, zero sold since.** ~20% of supply was never purchased, it was allocated. Overhang $373,101 at spot against a $59,662 quote-side reserve; ratio at 10x = **19.8x, cannot clear**.
**TIMING: @KAPOTHEGOAT01 (177,035 followers, 22,124 views) called it 12 Sep 15:37 BKK at "only $2.5M mcap"; same-day intraday range 0.00104-0.00811 (7.8x); rotation 4 hours after the call; price now BELOW his call price.**
Contract itself CLEAN: plain OZ v5 ERC20Burnable, no owner/mint/pause/fee/blacklist/maxwallet, fixed 1,000,000,000. Clean contract, dirty cap table.
CLAIM AUDIT: "ex-Senior engineer Google Chrome" CONFIRMED-as-self-stated (@antonkarlovskiy bio "Sr. software engineer who worked at @GoogleChrome & @nuxt_js", 627 followers). **"and Mantle" FALSE — appears nowhere in bio or history, invented by the caller.** "3000+ GitHub commits" UNRESOLVED (GitHub blocked from container). "<1K holders" TRUE (874). **"1.50% fee, 50% to AI Credit Pool" DOESN'T RECONCILE: 7-day cumulative volume ~$4.46M implies ~$66,950 fees and ~$33,475 into the pool; team's own distributed total is $1,955.94 = 5.8% of the stated mechanism.**
X: ticker AND CA searches both return near-identical "vote for $CEREBRO on the CoinMarketCap Top 100 Leaderboard" spam from @JdsgVEF16, @sergiormirez191, @EARTH_5087, @Carlos8704t, @raymond_blakley, all 1,000-4,500 followers, same template minutes apart. Paid engagement farm. Tier-one zero.

**NOTE / Note Systems `0xc4f730335Fb9e439ca5552f7b52B8E638c4245B0`, pool `0x378b102395b2c4f9a9ebe650b5b501d0810c60126f886107d8812ca7ff7f9f91` (v4, ETH).** Deployed 09 Sep 2026 04:36 BKK. Mcap $6,137,877, liq $594,981, v24 $1,630,789, h24 1,810 buys / 2,842 sells. ATH $0.147142 on 14 Sep -> -31.4%. Net buy for 10x ~$643,251.
**⚠ THE FINDING THE AUDIT TALK HIDES. Owner is an EOA `0x0b64b35c6dd23944d6d4029864d2ca2aa1b66422`, nonce 166, empty code, NOT renounced. Simulated with `eth_call` against live state: `pause()` SUCCEEDS from owner, reverts for everyone else — one man can freeze every transfer including every exit. `setMinter(address,bool)` SUCCEEDS from owner, reverts `OwnableUnauthorizedAccount` for others. `mint()` today reverts `NotMinter()` for everyone including owner, and there is NO cap anywhere in the bytecode — so the owner is exactly one transaction from unlimited mint.** Custom error selector `0xf8d2906c` = `NotMinter()`, resolved with a local pure-python keccak (`/home/claude/kec.py`) because openchain.xyz 500s and 4byte is unreachable from the container.
**⚠ CORRECTION DELIVERED TO BEN: Note has NOT had its contract checked by Nethermind.** The 13 Sep @notesystems post says, verbatim, "we have conducted an initial analysis using available tooling from @Nethermind — no high or critical findings across 71 contracts" — **the team ran Nethermind's open tooling on their own code and reported their own result. Self-scan, not an engagement.** Their own docs settle it: note.systems/docs/security/audits/ says "No third-party audit of the Note Systems contracts has been completed, and none is in progress at the time of writing... If you see a claim of an audit that is not listed on this page, treat it as false." The Cyfrin engagement is real but was announced **15 Sep 18:15 BKK**, is IN PROGRESS, and covers the 18,830-line testnet protocol, **not the live token**. The number that misled: "71 contracts" sounds like audit scope and is the team's own count of their own testnet files.
**PRODUCT: the token is the ONLY mainnet deployment.** The docs' own Addresses page lists NoteCore, SeriesRegistry, NoteLegs, OracleAdapter, Treasury, Desk, veNOTE and the promised 48h Timelock all as "TBD — not deployed" on Robinhood Chain mainnet; 24 contracts verified on testnet. Paying $6.1M for a testnet.
**SUPPLY: 16,454,442 NOTE = 27.42% of the 60,000,000 supply sits in one unverified contract `0x4a53afd9c4d707c8fddd6415947ef0a1e67518b8` that exposes NO readable getters at all.** It received 7,454,442 in the deploy block and has paid 3,000,000 out to the owner EOA (2,000,000 on 12 Sep 19:34 BKK, 1,000,000 on 13 Sep 02:18 BKK).
**LIQUIDITY HANDLING, not what a locked LP looks like:** owner put 11,000,000 NOTE into the v4 PoolManager 09 Sep 05:30-06:02 BKK; **13 Sep 03:48 BKK pulled 9,167,841 back OUT**; 03:58 returned 4,946,259; 04:00 sent the remaining **4,221,582 (7.04% of supply) to treasury contract `0xfdd983c66d4da2ef64769b6a2eba9cd838289962`**. One positive: that treasury IS a contract, not another EOA. **Today 15 Sep 22:03 BKK, four fresh wallets each received exactly 225,000 NOTE from the owner wallet within one minute, unannounced.**
X discourse is real people, unlike CEREBRO: @LordDurden 42,651, @TheCryptoKazi 98,892, @digitaldynastyz 24,194, @AltcoinSensei 15,370, @rafael_on_chain 21,091. Tier-one zero.

**RATSPEAK `0xf1e9Baa65d418A9025e1851DD2D37f1AD208bba3` (BASE), pool `0x5e9782079683037fc8bb57625683359d9efaef80f2b829c4bb5b1896c6bb40b6` (v4, WETH).** Pool created 18 May 2026 03:05 BKK, 4 months old. Mcap $1,267,962, liq $331,634, v24 only $69,911, h24 72 buys / 149 sells. ATH $0.00006707 on 27 Aug -> **-80.4%**. Net buy for 10x ~$358,571.
**CLEANEST CAP TABLE OF THE THREE. 3,969 holders. Largest holder is the v4 PoolManager at 14.54% (that's the liquidity). Largest non-pool holder 5.63%, then 2.90 / 2.78 / 2.60 / 1.79. 4.00% burned to dead. Creator `0x256b3cc1e516d124b3027ecd083aa5a940d1328e` holds ZERO. Overhang ratio at 10x = 0.4x — the only one of the three where the biggest holder can exit without breaking the pool.** Token = ERC20 + Votes + Permit + Burnable: no mint, no fee, no pause, no blacklist, no max-wallet; owner `0x660eaaedebc968f8f3694354fa8ec0b4c5ba8d12` not renounced but gates nothing harmful in the readable surface.
**⚠ THE ONE REAL RISK: 99.98% of the LP position sits in one holder `0xb71c456ac0628ee694f68cba62a1a04985999504` and GoPlus reports it NOT locked. Unresolved, and it is the first thing to check before any entry.**
PRODUCT SHIPS: offline-capable encrypted mesh, desktop/iOS/Android/GrapheneOS plus firmware for T-Deck Plus, Cardputer Adv, T-Pager; v1.0.31 released 27 Aug with named bug fixes; Starlink + radio field tests in Pike National Forest 01 Sep; live node map over LoRa/I2P/IPv4-6. **Built on Reticulum (someone else's open-source protocol) so the site's "a new protocol for mesh networking" is overstated — it is an app/distribution layer.** Four burns, fourth took 543,210,899 tokens out 05 Sep.
FOUNDER @defidude: account created **23 Oct 2011**, 20,600 followers, 8,567 posts, bio "prev @kybernetwork / @aave / @buildaprotocol". Strongest operator identity of the three by a distance.
**THESIS HOLE: the token captures NOTHING from the network — free app, no subscription, no token gate, no data-credit burn. On 11 Sep @defidude posted asking the community to form a working group to "explore new tokenomics". Four months in, the reason to hold is still an open question the founder is crowdsourcing.**
X mixed: real = @Malik_Farooq_01 (19,590) "absolute sleeper at $1.5m", @100xDarren (23,158) listing it in a Nansen smart-money-on-Base screen 14 Sep. Fake = a farm of 20-70-follower accounts posting "Scanana scan read HOLD at $159k, +3943%" with fake report reference codes. **⚠ @GVRCALLS (147,004 followers) is pumping "$0.02 -> $0.077, now $0.042" under this ticker — that is the BRC-20 $RATS, not this token, which trades at $0.0000132. Ticker pollution with a big account on the wrong asset.** Tier-one zero.

**NEW REUSABLE METHOD FROM THIS SCREEN.**
1. **⚠ THE WALLET-ROTATION SIGNATURE, new and it decided CEREBRO. N distinct senders each moving their full stack to N distinct fresh receivers, one transfer per block, in sequence, interleaved with zero-value probe transfers, is a script resetting the on-chain trail — not N people. Scan every token's transfer log for windows where recipient-count and sender-count are both high and each pair appears exactly once. Then measure that group's BOUGHT-from-pool versus HELD: if held >> bought, the difference was allocated, not purchased, and it is pure overhang.**
2. **A clean contract and a clean cap table are independent axes and can be opposite.** CEREBRO has the best contract of the three and the worst cap table. RATSPEAK has an un-renounced owner and the best cap table. Never let one stand in for the other.
3. **Simulate owner powers with `eth_call` and a `from` field instead of reading an audit claim.** `pause()` / `setMinter()` / `mint()` from the owner address versus from `0x...dEaD` settles in two calls what a marketing thread will never tell you. Works with no archive node and no verified source.
4. **Resolve custom error selectors with a local keccak.** `/home/claude/kec.py` (pure-python keccak-256, verified against the Transfer topic) plus a candidate-name list resolved `0xf8d2906c` = `NotMinter()` and found `setMinter(address,bool)` in the bytecode. openchain.xyz returns 500 from the container, sourcify does not know chain 1237, and Blockscout was Cloudflare-walled the whole session — **this is now the primary route to a contract's real function surface on Robinhood Chain.**
5. **Read the project's OWN docs for the audit status before believing any audit post about it.** note.systems' Audits page pre-emptively told me every third-party audit claim was false. That is a stronger source than the team's X account and it took one fetch.
6. **⚠ The Robinhood RPC silently TRUNCATES large `eth_getLogs` ranges without erroring.** The NOTE reconstruction reconciled only 42.6M of 60M supply and my splitting loop never fired because no error was returned. **Always reconcile positives against `totalSupply()`, and re-read any load-bearing holder figure with a direct `balanceOf` call.** CEREBRO reconciled exactly to 1,000,000,000 so its figures are sound; NOTE's were all re-read individually.
7. **Robinhood Chain is now L2Beat Stage 0** (upgraded from below-Stage-0 at the last check), TVS $2,856,168,960, +0.5% over 7 days, single sequencer. **DefiLlama still indexes ZERO protocols on Robinhood Chain**, so nothing on this chain can be priced off measured protocol revenue — only off what a team says it distributes.
8. **Correct the user's stated premise when the chain disagrees with it.** Ben told me twice that NOTE's contract had been "checked officially" / "checked by nethermind". Both were good-faith readings of a carefully-worded team post, and saying so plainly, with the verbatim quote and the project's own contradicting docs page, was the highest-value paragraph in the whole review.

- OUTCOME: pending, score in [[screen-log-outcomes-5]]

#### ⚠⚠ 2026-09-15 ~23:40 BKK. SELF-VERIFICATION PASS ON THE ROW ABOVE, RUN BECAUSE BEN ASKED ("double-check all your findings... especially the Cerebro 23 wallet thing... check if there are other explanations"). FOUR CLAIMS DID NOT SURVIVE. Artifact updated to v2.0, same URL.

**⚠ CEREBRO ERROR 1, THE WORST ONE: "~20% of supply was never purchased, it was allocated" IS FALSE. THEY PAID.** I measured buys as inbound legs FROM the v4 PoolManager `0x8366a39cc670b4001a1121b8f6a443a643e40951`, but the launch buys never touched the PoolManager — they went through the launchpad router `0x55c20f86d1aac3282782ab7646e704cdbaf36599`. **Opening the launch transactions shows every one of the 20 wallets sent a real tx carrying exactly 0.1500 ETH.** Total 3.00 ETH (~$7,262 at the $2,421 ETH implied by the NOTE pool) for 656,765,270 CEREBRO. **STANDING RULE: "bought vs allocated" can NEVER be decided from a Transfer log alone. Open the transactions and read `value` and `to`. On a launchpad token the buy door is the pad's router, not the AMM.**

**⚠ CEREBRO ERROR 2: "23 EOAs took 68.52%" was OVERSTATED by double-counting tokens that passed through a wallet twice.** The clean, unambiguous measure is **direct transfers OUT of the launch contract**: `0x23d6020029974538a8c3fc94da5e59fee02543db` held 100% of supply and emptied itself completely in **23 blocks (~2 seconds)** to 24 addresses, never receiving a token again. Split: 28.571% to pool/hook `0x7ed598bcef8bd9edd8c97a195c6d13f40801ec7e`, 5.441% to routers `0xb1000000096bd2f8ca9b6883182eccaf31e7c3fd` + `0x65050a9b7e5075a2ba5ced7b1b64ee66262c40dc`, **65.68% to 20 wallets**, 0.311% to one other. **METHOD THAT FOUND IT, now standing: reconcile summed positive balances against `totalSupply()`, then list addresses with a NEGATIVE computed balance. Those hold supply from before your window. Here there was exactly ONE (`0x23d60200...` at -100%), and it named the launch contract in a single step.**

**✅ THE BUNDLE IS STILL A BUNDLE, AND THE PROOF IS NOW MUCH BETTER. THREE INDEPENDENT AXES, each checked against the real buyers who arrived seconds later.** (a) **NONCE: all 20 at nonce 0** — the launch buy was the first transaction of each wallet's existence; the real buyers behind them run nonce 44, 396, 649, 1258, 1260, 2883, 3173, 4905, 5256, 6751, 9835. (b) **SIZE: all 20 paid exactly 0.1500 ETH**; the real buyers paid 0.0100, 0.0220, 0.0330, 0.0330, 0.0500, 0.0500, 0.0505, 0.1000, 0.1000, 0.1250. (c) **ROUTE: all 20 through one router**; the real buyers used three different ones. **NEW STANDING TEST — THE THREE-AXIS BUNDLE PROOF: nonce, size, route. Any one alone is weak; all three agreeing is conclusive, and having the organic population in the same dataset as the control is what makes it readable.**

**✅ THE 21.42% OVERHANG SURVIVED AND GOT STRONGER.** Re-read with live `balanceOf`: the 20 rotation receivers hold **214,179,786 CEREBRO = 21.42%**. **19 of those 20 wallets are at NONCE 0 — they have never sent a single transaction, so not one token can have been sold out of them.** That is mechanical proof of "unsold", far better than inferring it from a transfer log. The 20 SENDING wallets were then swept to between 0.00001907 and 0.00001910 ETH — a 0.02% spread across 20 supposedly unrelated people. **CORRECTION: I first printed these as "exactly 0.000019 ETH identical"; they are NOT identical, that was a 6-decimal rounding artifact. Print exact wei before calling two balances identical.**

**⚠⚠ NEW MAJOR FINDING THAT ONLY APPEARED UNDER VERIFICATION: CEREBRO IS A DUO.RICH LAUNCH. SAME PAD AS DUO, WHICH RUGGED 3 MINUTES AFTER MY BUY CALL ON 13 SEP.** The wrapper `0x267444d099b10fb5ed7c3cc7b7c767adca574952` (recorded in the DUO row above as "holds 81.6M DUO") holds **exactly 81,632,653 = 4/49 of supply of 160 DIFFERENT TOKENS**, CEREBRO among them: TRUMP `0x648a56b933e207846f7c68b01e9880f4f73642e2`, MEMES `0xb7f09b40eb98e3a01f8bdd5a043f5e2ce1d8c2b9`, PEBBLES `0x4f81f09399ad24af628c9003f9e72176ec1466e8`, pdom `0x7a9b7393dbe1d27e69f57080aec29e675cf2c241`, LINO `0x81fc8e7ce649dc47761265c3c60c2f55961863ca`, ROBERT `0x25b19ecaa3265e9a5f5681e151e037d9d3e0ca11`, COLLECTIBLE `0x2ad71d0eeea14c5af2b26be96d2917f45bd66127`, QUBO `0xf8157f390d8e10dacb16b50d680aec9c90f53d04`, PUSH `0x1d1fd1da832dc8223d6332af9588cc13d8cbf103`, NEON `0xc90e357a781b9eb6a70b34df00f5c96aa3d88c85`, BOXCAT `0x102b2917de585694e48241afbbe8a19746e7b8ac`. Allocation fractions identical on DUO and CEREBRO: **2/7 to the pool contract, 10/49 and 4/49 to the pad** (the "285M / 204M / 126M routing contracts" noted in the DUO row are the same 2/7 and 10/49 slices). **METHOD, cheap and now standing: `eth_getLogs` with topics[2] = a suspected pad contract and NO address filter over a few windows returns every token it has ever received. Identical amounts across many tokens = a shared launchpad wrapper, and it identifies the pad in one call with no site scraping.** **OPEN, and the highest-value thing left to measure: does the 20-wallet / 0.15-ETH-each bundle repeat across the other 159 duo.rich launches? If yes, the pad itself is the operator signature and every duo.rich token is an automatic AVOID.**

**⚠ RATSPEAK ERROR 3, AND IT WAS THE ONE THING I TOLD BEN TO CHECK BEFORE BUYING. "99.98% of the LP sits in one holder and GoPlus says NOT locked" IS WITHDRAWN IN FULL.** All 15 Ratspeak pools are **Uniswap v4** except one v3 dust pool ($81.88) and one hydrex pool ($35.50). **Uniswap v4 HAS NO LP TOKENS** — liquidity is in the PoolManager singleton and positions are NFTs, so there is nothing to hold or lock in the v2 sense. `0xb71c456ac0628ee694f68cba62a1a04985999504` is an ordinary EOA, 0 code, nonce 52, unrelated to the $331,303 WETH pool. **STANDING RULE: NEVER quote a GoPlus `lp_holders` / `is_locked` field without first checking the venue. GoPlus answers v2-shaped questions about v4 pools instead of declining, and I turned that into a fabricated rug risk.** The real open question, much smaller: who owns the v4 position NFT behind the main pool. Unresolved.

**⚠ RATSPEAK ERROR 4 (in my favour, still an error): the owner is a CONTRACT, not an address I should have called un-renounced-and-scary.** `0x660eaaedebc968f8f3694354fa8ec0b4c5ba8d12` has **5,707 bytes of code, nonce 1**, and holds 0 tokens. Also **GoPlus `is_mintable = 1` on RATSPEAK is a FALSE POSITIVE** — no mint selector exists in the runtime bytecode and a simulated mint from the owner reverts. **Everything else verified directly on Base with `balanceOf`: totalSupply 100,000,000,000; dead `0x000000000000000000000000000000000000dEaD` 4,000,000,000 = 4.000% (matches the four announced burns); v4 PoolManager `0x498581fF718922c3f8e6A244956aF099B2652b2b` 14,536,993,488 = 14.537%; largest non-pool holder `0x96c33027948124a63e885fc34c29692d5a898765` 5,630,391,368 = 5.630%; creator 0.**

**⚠ NOTE ERROR 5: "13 Sep 03:48 BKK pulled 9,167,841 NOTE back OUT of the pool" IS THE WRONG FRAMING.** The receipt for `0x91e5ef39921317f740514e6e0962a13c47b858610350239bfddf71defe4aa38e` shows the owner calling `0x4a53afd9c4d707c8fddd6415947ef0a1e67518b8` (selector `0x134008d3`), which fired **six Uniswap v4 Swap events on the NOTE/USDG pool `0x0e13a8f96118...`** plus a USDG transfer to the owner. That is a MARKET OPERATION, not a liquidity withdrawal. **Direction UNRESOLVED — the v4 Swap data came back 128 bytes and did not decode to signed int128 amounts with the standard layout; do not guess it.** The redistribution is still exact and still true: 9,167,841 in, then 4,946,259 back to the PoolManager + 4,221,582 to treasury `0xfdd983c66d4da2ef64769b6a2eba9cd838289962` within 12 minutes. **STANDING RULE: a Transfer FROM the v4 PoolManager is ambiguous three ways (swap output, LP removal, fee claim). This is the same trap the DUO row already recorded for buybacks — open the receipt and count Swap events before naming the mechanism.**

**✅ NOTE OWNER POWERS SURVIVED, AND THE THIRD CONFIRMATION IS THE ONE TO REUSE.** `unpause()` from the owner reverts with **`ExpectedPause()` (0x8dfc202b)** — an OpenZeppelin STATE error, not an ACCESS error. The owner passed the permission check and failed only because the token is not currently paused. `pause()` from a random address reverts with a caller-specific error (`0x6b1883f3` + the caller address, name unresolved). `setMinter` from a random address reverts `OwnableUnauthorizedAccount(address)` (0x118cdaa7). **NEW STANDING TEST: distinguishing an ACCESS-control revert from a STATE revert is how you prove someone holds a key without them ever using it. A state error coming back means the caller was authorised.**

**✅ NOTE 0x4a53afd9 CONFIRMED at 27.42% by `balanceOf` BUT REFRAMED, FAIRER.** It is not a silent stash — it is an operational contract the owner drives and that routes v4 swaps, most likely the launch-auction or treasury module the docs describe. The objection is narrower and still stands: **unverified, schedule unreadable from outside, holds >1/4 of supply.**

**✅ ALL THREE ATH FIGURES RE-CHECKED ACROSS EVERY POOL OF EVERY TOKEN, not just the main one.** CEREBRO high $0.0081109748 on 12 Sep in the main NVDA pool is genuinely the highest of its 5 pools (USDG pool peaked $0.0050615214) -> -78.5% confirmed. NOTE main-pool high $0.14714161 on 14 Sep -> -30.9%; a $535-liquidity USDG pool printed $0.1566939 on 15 Sep and was **correctly ignored as a dust print**. RATSPEAK $0.00006707 on 27 Aug over 121 daily candles -> -80.4% confirmed. **STANDING: run the ATH across ALL pools, then discard prints from pools under ~$1k liquidity rather than taking the max blindly.**

**THE SHAPE OF ALL FOUR ERRORS, and this is the generalisable lesson.** Every one was **measuring through the wrong door and not noticing, because the number that came back was still shocking enough to feel like a finding.** Wrong AMM door (CEREBRO buys), wrong venue model (Ratspeak v4 vs v2 LP), wrong event type (NOTE swaps vs LP), wrong precision (rounded ETH balances read as identical). **PRE-DELIVERY GATE TO ADD: for every load-bearing number, name the door it came through and ask what else could produce that same number. A shocking number is the moment to check the door, not the moment to stop.** Note that the verdicts did NOT change — CEREBRO stayed NO, NOTE stayed short-list, RATSPEAK stayed short-list — but one of the four errors (the Ratspeak LP scare) was a **fabricated risk on the only name I was recommending**, which is the most damaging error type available: it would have talked Ben out of the single best candidate for a reason that did not exist.