---
name: x-claim-audit
description: "Treat X as a claim and thesis source to validate on chain, never as sentiment. Mandatory on every token screen, re-run every pass."
---

# X claim audit

**X is not a sentiment layer. It is a claim source and a thesis source.** Every post is a claim to be marked CONFIRMED, FALSE or UNRESOLVED against the chain. Sentiment scores are never quoted: LunarCrush held 77 to 86 through an entire 60% drawdown.

This exists because of a real failure on TWO/Twofold, 31 Aug 2026. X was run once by a subagent on pass one and never again across five later passes. The narrative owner's origin thread carried a disclosed $5,000 LP deposit. Sizing that one pool produced the decisive fact of the whole screen: the entire external adoption of the product was one man's $5,000. Six chain-only passes never found it.

---

## THE GATE. Do not deliver a screen until all six lines are answered.

Paste this block, filled in, into your working notes before writing any verdict. An unanswered line is a blocked delivery, not a caveat.

```
[ ] 1. Narrative owner identified by handle, with follower count and account age
[ ] 2. Their WHOLE timeline pulled with cursor pagination (not ticker-filtered)
[ ] 3. Every claim about their OWN position extracted verbatim
[ ] 4. Each claim marked CONFIRMED / FALSE / UNRESOLVED with an on-chain receipt
[ ] 5. Conflicts named: referral links, disclosed positions, paid promotion
[ ] 6. This audit re-run THIS pass (not inherited from an earlier pass)
```

**Line 6 is the one that failed.** New chain data does not refresh the claim set. Re-run X on every pass of the same token, every time.

---

## The key, works direct from the cloud container

```bash
curl -s -H "X-API-Key: new1_9f31bb77a9cd477eb6baa555e713280e" \
 "https://api.twitterapi.io/twitter/tweet/advanced_search?query=<urlencoded>&queryType=Latest"
```

User lookup, for sizing a caller before quoting them:

```bash
curl -s -H "X-API-Key: <key>" "https://api.twitterapi.io/twitter/user/info?userName=<handle>"
```

### Endpoint gotchas, both cost a real miss

- **`since:` and `until:` are SILENTLY IGNORED by `advanced_search`.** It returns the latest 20 regardless of the date range. A date-scoped query that "returns nothing from that day" is almost always this bug, not an absent post.
- **Paginate with `cursor` from `next_cursor` while `has_next_page`.** The TWO origin thread sat 160 tweets deep, on page 8. Budget 8 pages minimum on a narrative owner.
- `from:` scoping breaks if a bare `OR` sits outside the parentheses. Always `(A OR B OR C) from:handle`.

---

## Step 1: run five query types, not three

1. The raw **contract address**
2. The **$TICKER** with a disambiguator: `$TWO (twofold OR robinhood)`. Bare tickers return noise
3. The **project handle**: `from:<project>` and mentions of it
4. **`from:<narrative owner>` as a full timeline, cursor-paginated** ← this is the one that gets skipped
5. **Tier-one coverage by name**, correctly parenthesised: `(TICKER OR handle OR 0xCA) from:blknoiz06` and the same for theunipcs, pingucharts, CrashiusClay69, 0xkioto, _0xghost_, metaversejoji, dontbuytops. Zero after direct tagging is the clearest ceiling signal available

**Query 4 is mandatory and is not satisfied by query 1 or 3.** The origin thread that carries the disclosures usually PREDATES the ticker chatter and often does not repeat the CA, so it never appears in a CA or ticker search.

---

## Step 2: identify the narrative owner

The named account actually on the hook for the story, not the biggest amplifier. Size them before quoting: `user/info` gives followers, bio and account creation date. A 19,012-follower account registered in 2008 sitting on a chain's security council is a different datapoint from a 130-follower account, and both are different from a 1.5M-follower reply bot.

---

## Step 3: extract every claim about their OWN position

In their words, verbatim. These are the highest-value claims in the entire corpus because they are specific, dated and checkable:

- "I deposited $X into pool Y" → **size that pool on chain**
- "I staked for Z" → **read what the staking contract actually pays**
- "I had <tool> audit it" → **state what that tool's scope structurally cannot cover**
- "It's like $A ($N MC)" → **re-measure $A now**
- "my referral link" → **a disclosed conflict, credit the disclosure and still price the incentive**

## Step 4: mark every claim, with a receipt

CONFIRMED / FALSE / UNRESOLVED. **Never validate an X claim against another X post.** Worked receipts from the TWO audit:

| Claim | Verdict | Receipt |
|---|---|---|
| "$5,000 into the NVDA/USDG pool" | **CONFIRMED** | `getReserves` shows 2,591.49 USDG + 11.88 NVDA = $5,191.60. And every other pool held $177 to $623, so his $5,000 WAS the product's entire external adoption |
| "Staked most of it for a share of protocol fees" | **FALSE** | `rewardTokensLength()` = 1, `rewardTokens(0)` is the token itself. Paid in inflation, not fees |
| "Codex found no obvious red flags" | **TRUE but SCOPED** | A code review cannot flag an unlocked EOA holding 98.41% of a pool. That is a deployment fact, not a code defect. Both are true |
| "$DELTA ($18M MC)" | **STALE, not false** | $25,992,386 two days later. Say staleness, not dishonesty |

**Three standing rules from that table:**

- **A serious, high-signal account can be flatly wrong about the mechanics of the thing it is promoting.** Check the claim, not the credential.
- **When a promoter cites a tool audit, name what that tool structurally cannot see** rather than treating it as confirmation or as contradicted.
- **An engagement from a protocol's employee is not an endorsement.** A Uniswap engineer writing "cool, they're using the dual pool hook" validates the MECHANISM. It says nothing about the token and it is not a review.

---

## Step 5: the two campaign patterns, scanned every time

- **Phishing.** "Claim portal", "holder portal", "check eligibility", "community listing vote", posted with the CORRECT contract address. Always a drainer. **Resolve `t.co` redirects rather than reading the post text**, and check for domain rotation: one campaign moved `crypto.cryptoloc.lol` to `crypto.cryptolot.lol`, a one-character typosquat of its own domain. Flag every time, even when it does not change the verdict.
- **Bot spam.** Near-identical templated replies. Quantify it: 73 "let's collab" replies, 62 from accounts over 50k followers, **one like across all 73**. High follower count with zero engagement is a purchased or compromised network, not a community. Subtract it from any engaged-holder read.

---

## Step 6: report attention as a comparison, never as a score

Against the peer set, not in isolation: posts per day and slope · unique authors · share from the project's own account · largest amplifier by followers · **mentions per $1M of market cap across peers** · non-English coverage. Views per post collapsing while raw post count rises is padding, not re-engagement.

---

## Verification before delivering

- Are all six gate lines answered, this pass?
- Was query 4, the narrative owner's full paginated timeline, actually run?
- Is every load-bearing claim marked with an on-chain receipt rather than another post?
- Were conflicts and disclosures named?
- Was a promoter's comp re-measured rather than repeated?