# 3 wl_wlink rugs 16 Oct: same deployer? (research, #2678)
fw/rugs.json: pools 0x9faa90 (11 Oct? t=1791963317), 0x4e40ff and 0x68d5f0 (16 Oct 09:50 UTC, 272 s apart).
| pool | deployer (nonce) | LP remove | after create |
|---|---|---|---|
| 0x9faa90.. | 0xb49b5120e0fe.. (2) | 4.48 ETH | 64 s |
| 0x4e40ff.. | 0xadd408a97d5b.. (2) | 4.83 ETH | 71 s |
| 0x68d5f0.. | 0xdadbe5da882b.. (2) | 7.35 ETH | 172 s |
Findings
- Three different wallets. No shared deployer, no shared LP owner (the remover = the deployer each time). Each wallet made exactly 1 pool, so blocking these wallets blocks nothing: they are one-shot.
- Shared pattern: v3, fee 100, supply 1e9, deployer nonce 2 (fresh wallet, 2 txs), pull 1-3 min after create.
- Base rate (v3live+deployer.db since 11 Oct): nonce-2 deployers made 260 pools, 190 (73%) pulled within 10 min. Nonce-2 is the norm for pulls but also for most pools, so it is not a clean gate (same conclusion as seed-size #2603 and r60 #2648).
- Funder not found: blockscout API is behind a Cloudflare challenge (403) from research-box; not circumvented. If ppdata has a funder feed, check whether the 3 wallets share a funder.
- Deployer blocklist for the 3 wallets added nothing to protect; no action taken (research does not touch live config). Real protection = exec's pause rule (3 rugs stop) / smaller size on wlink.