---
name: x-claim-audit-method
description: The X-to-chain claim audit method and the process failure that created it, 31 Aug 2026 on TWO/Twofold. Read before any token screen that involves a named promoter or narrative owner, and whenever deciding how deep to run twitterapi.io.
sources: [cowork]
aliases: [claim-audit, x-audit, promoter-audit, toady-hawk-miss]
---

# X claim audit method

Companion to [[twofold-two]] and [[crypto-token-research]].

## The failure that created this file, 31 Aug 2026

- [stated] Ben pasted screenshots of @toady_hawk's 29 Aug $TWO thread and asked why I had not surfaced it, given the twitterapi.io key exists precisely so the important claims get checked. He was right. Six analysis passes on TWO and the single most valuable checkable claim in the corpus went unchecked.
- **Four root causes, all process, none data availability:**
  1. **X was run ONCE, on pass 1, by a subagent, and never again** across five later passes. Every later pass re-pulled chain data only. The claim set was never refreshed.
  2. **The subagent's brief was CA + ticker + project handle.** It caught toady_hawk's 31 Aug posts (they tag @twofoldfi) but **never ran `from:toady_hawk` as its own timeline**, so his 29 Aug origin thread carrying every disclosure was invisible.
  3. **No cursor pagination.** The thread sat 160 tweets deep. It took 8 paginated pages to reach.
  4. **X output was treated as a "social layer / sentiment" input rather than a claim source to validate against chain**, which is exactly what `research-sources` says not to do.

## The method, run it every time

1. **Identify the narrative owner**, the named account actually on the hook for the story, not the biggest amplifier.
2. **Pull their WHOLE timeline** with `from:<handle>` and full cursor pagination. Do not filter by ticker: the origin thread that carries the disclosures usually predates the ticker chatter and often does not repeat the CA.
3. **Extract every quantitative or mechanical claim they make about their OWN position**, in their words. "I deposited $X into pool Y", "I staked for Z", "I had <tool> audit it".
4. **Check each on chain, one by one, and mark CONFIRMED / FALSE / UNRESOLVED with the receipt.** Never validate an X claim against another X post.
5. **Re-run steps 1 to 4 on every pass.** New chain data does not refresh the claim set.

## Endpoint gotchas, twitterapi.io

- **`since:` and `until:` are IGNORED by `advanced_search`.** It returns the latest 20 regardless. **Paginate with `cursor` from `next_cursor` while `has_next_page`.** A date-scoped query that "returns nothing from that day" is almost always this bug, not an absent post.
- `from:` scoping breaks if a bare `OR` sits outside the parentheses. Always `(A OR B OR C) from:handle`.
- `https://api.twitterapi.io/twitter/user/info?userName=<handle>` gives follower count, bio and account age. Use it to size a caller before quoting them. It is how @saintniko was confirmed as bio "@uniswap", 25,466 followers, and @toady_hawk as 19,012 followers, account since 2008, Base security council.

## Worked receipts from the TWO audit

- **"Deposited $5,000 into the NVDA/USDG pool" -> CONFIRMED**, and it became the most decisive number in the whole screen. `getReserves` on the DualPool hook shows USDG/NVDA holding 2,591.49 USDG + 11.88 NVDA = $5,191.60. **Every other equity pool held $177 to $623, i.e. operator seeding at ~$191 a side. One man's $5,000 was the entire external adoption of the product.** No amount of chain-only work found this, because without his post there was nothing telling me to size the pools individually.
- **"Staked most of it for a share of protocol fees" -> FALSE**, one RPC call. `rewardTokensLength()` = 1 and `rewardTokens(0)` is the TWO contract itself. He is paid in inflation. **A serious, high-signal account can be wrong about the mechanics of the thing it is promoting. Check the claim, not the credential.**
- **"Codex reviewed the contracts, no obvious red flags" -> TRUE but SCOPED.** A code review does not flag an unlocked EOA holding 98.41% of a pool's liquidity, because that is a deployment fact, not a code defect. **When a promoter cites a tool audit, state what that tool's scope structurally cannot cover, rather than treating it as contradicted or as confirmation.**
- **A promoter's own comp numbers go stale fast and must be re-measured.** He wrote "$DELTA ($18M MC)" on 29 Aug; measured $25,992,386 on 31 Aug. That is staleness, not dishonesty, and saying so is part of being fair to the source. "$UP ($6M ATH)" measured $15,667,915 (0x57C0E45cB534413D1C20A4240955d6bB250BB4F1). "$EARN ($3M ATH)" measured $3,757,603 (0xA3b6AEe90017b72c0812dC1e013De70eB2917ba3).
- **A disclosed referral link is a disclosed conflict.** Credit the disclosure, still price the incentive.
- **An engagement from a protocol employee is not an endorsement.** @saintniko (Uniswap) wrote "ahh so cool! they're using the dual pool hook!!!!" That validates the MECHANISM being used. It says nothing about the token, and it is not a review.

## THE FULL ERROR LEDGER, TWO/Twofold, six passes in one session, 30 to 31 Aug 2026
Ben asked for every mistake across all runs to be hardcoded so they cannot recur. This is the list.

**Measurement errors, each one changed a number I reported to him:**
1. **"$102/day of third-party volume"** off DexScreener. It indexes 3 of 20 Uniswap v4 hook pools and misses the flagship entirely; GeckoTerminal returns all-null for the same poolId. **Never measure a v4 hook pool's volume from an aggregator.**
2. **"$1.2M to $1.7M/day routed"** off live.json withdrawal amounts. **Overstated ~25x.** A JIT cycle withdraws capital, fills, and returns most of it: $3,399.53 out, **$641.52** to the PoolManager, $2,758.01 back. **Only the leg touching the PoolManager is swap volume.** Real figure ~$58,000/day.
3. **"Zero tax, round trip is impact only"** off GoPlus `buy_tax`/`sell_tax` = 0. Those are TRANSFER taxes. The main pool's fee tier is **1%**, so the round trip is **2%** before impact. I also called the pool 0.30% for two passes.
4. **"No fatal flags"** for three passes, because I never checked who owns the v4 LP position. The operator EOA holds 98.41% of the main pool's in-range liquidity, unlocked. **GoPlus structurally cannot see v4 LP concentration**; it reported 2 LP holders and missed it.
5. **Nearly reported "$0 in all 20 pools"** from a guessed `tickSpacing` in the PoolKey. A wrong PoolKey returns zeros identical to an empty pool.
6. **Nearly misread zero in-range PoolManager liquidity as emptiness.** On a JIT hook that is the expected state, not a finding.
7. **USDe priced at $11.47M per unit** by DexScreener on this chain. Hardcode $1 for a known stablecoin rather than trusting a thin pool.

**Interpretation errors, where the number was right and the story was wrong:**
8. **"Other LPs are exiting"** from operator share drifting 97.76 to 98.41%. Price fell 25% in the same window, so positions moving OUT OF RANGE explains it equally. **Report the level, not a causal story you cannot separate.**
9. **"Holders falling, this is the end"** on 1,416 to 1,397, a 1.3% move. Inside explorer noise. **Require a slope over hours, not two reads.**
10. **"Hook TVL falling means adoption reversed."** The transfers show the hook paying USDG and receiving TWO, i.e. the AMM absorbing sellers. Same direction, wrong mechanism. **Read the transfer legs before naming a cause.**

**Framing errors:**
11. **Anchored the whole first verdict on 180x cap/TVL against Solana** without first asking whether the category is tokenised at all. It barely is: Arrakis $55.16M TVL, Steer $18.49M, Snuggle $7.99M, all with NO token. **Answer "is this category tokenised" BEFORE quoting any sector multiple.**
12. **Never sized the 20 pools individually until X told me to.** That one call produced the decisive fact of the entire screen.
13. **Kept advising across six passes without ever establishing whether Ben holds the token.** Asked twice, never insisted, kept going. **A hold question cannot be answered without position status. Ask once, then state the assumption in the first line and hold to it.**
14. **Delivered prose walls** against a standing bullet-point preference, twice, until he called it unreadable.

## Two encoding traps found the same day, both nearly reported as findings

- **A wrong PoolKey returns zeros that look exactly like an empty pool.** I nearly reported "$0 in all 20 Twofold pools". The cause was a guessed `tickSpacing`. **Solve it: brute force `tickSpacing` until `keccak(PoolKey) == poolId`, then use the verified key.** For Twofold at fee 3000 it is 60.
- **On a JIT hook, zero in-range liquidity in the PoolManager is EXPECTED, not a finding.** The whole design is that liquidity is not resting in the pool. Read reserves from the hook's own `getReserves(PoolKey)` instead.

## ⚠ ENDPOINT TRAP FOUND 6 Sep 2026 — the tier-one check silently returns FALSE POSITIVES
Caught during the stonksonchain first-mover pass ([[stonks-onchain-lanes]]), one step before it shipped as a finding.

**twitterapi.io `advanced_search` SUBSTRING-matches the ticker and ignores recency.**
- `(ORBIO OR $ORBIO OR 0xaa07a0e9209e16ac99708c3ec70159c6ef3128a3) from:blknoiz06` returned **20 posts, ZERO containing "orbio"**. It was matching **"bio"** inside "check my **bio**".
- Same on every other candidate: SHROOM matched "shroom retreat" (2021), NUDES matched "no nudes in there bro" (2024), UBIK matched a 2022 Solana NFT platform called Ubik.
- Raw counts across the tier-one list read **81 / 14 / 7 / 1 hits**. After filtering, the true count was **0 on every single one** (ICOIN, SHROOM, LIGERCOIN, UBIK, NUDES, ORBIO, RKST).
- I was one step from telling Ben that Ansem, Unipcs, Crash, Ghost, joji, DineroDom and dontbuytops had all covered ORBIO. **None of them ever mentioned it.**

**THE RULE, apply to every `from:` tier-one query and every short or word-like ticker:**
1. Filter the returned posts to those whose TEXT actually contains the ticker or the contract address, case-insensitive.
2. Then check the date. `since:`/`until:` are ignored, so years-old unrelated posts come back looking current.
3. **Never quote a raw hit count.** Report the filtered count, and quote at least one matching post as the receipt.
4. Tickers that are substrings of common words (BIO, NUDES, SHROOM, ANY, IF, UP, NET, MOO, GG) are the highest risk. A distinctive-looking ticker is not protection: ORBIO looked safe and was the worst offender.

**Why this matters more than a normal bug:** zero tier-one coverage is, per `research-sources`, "the clearest ceiling signal available". Getting it backwards inverts the single most load-bearing qualitative input in a screen, in the bullish direction, which is the direction that costs money.

**Credit state, same day: twitterapi.io is FUNDED AGAIN, 1,999,854 recharge credits + 158,644 bonus, control query returns 20.** The 402 outage recorded in [[rh-infra-bottom-screen]] and [[delta-liquidity-2]] is over. Always run a throwaway control query (`bitcoin`) before concluding a ticker is quiet.