# A1.21 Protect the kit edge: find the operator, not the code (Analyst 1, 6 Oct 2026, 19:01 Bangkok)

## Read this first
- **Yes. A rule that ignores code hashes finds Kit B, the 3,587-byte family and Kit A from their very first launches.** Watch who funds the deployer, not which code they run.
- **The rule, hash-blind and walk forward (only what is known at each launch):**
  - Key = the deployer's first funding transaction: the contract it went through if it was a contract call (e.g. a disperse), else the wallet that sent it.
  - **A launch is "operator" if its key funded at least one EARLIER launch that already reached the sellable $1M gate.** New keys are learned live, as gates happen.

| Walk forward, 7,108 v3 WETH launches since 13 Sep | Result |
|---|---|
| Kit B launches flagged | **136 of 140, including its first launches on 1 Oct** |
| 3,587-byte family flagged | **16 of 17, including its first launch on 29 Sep** |
| Kit A flagged | 79 of 107, **including its very first launch (24 Sep)** |
| All flagged launches | 332, of which **24.7% reached the gate** |
| Unflagged launches | **0.47%** reached the gate |
| Non-kit launches flagged | 101, of which 15 reached the gate (15%) |

  - "False flags" in the strict sense: 250 of the 332 flagged launches never reached the gate. That is harmless here, because our gate still has to pass before we buy. The flag only changes the exit.
- **Operator B (Kit B lineage) is one disperse contract.**
  - Almost every Kit B and 3,587-byte deployer got its first ETH through `0x84157d3d24630c297849c84d49ae7f1805c1b60f`, a median 2 s before launch. Kit B: 134 of 140; the other 4 via `0x8876789976decbfcbbbe364623c63652db8c0904`, plus 2 unknown. 3,587 family: 16 of 17.
  - No other deployer since 13 Sep was funded this way, except 5 earlier launches that are the same lineage:
    - Launcher hash e2f97f399b67, 2 launches on 25 Sep. One reached the gate and ran 8.2x.
    - Launcher hash 94df2676f097, 3 launches 25 to 27 Sep. One ran 15.2x.
  - **So it is one operator rewriting its kit four times: e2f97f399b67 (25 Sep), then 94df2676f097 (25 to 27 Sep), then the 3,587-byte family (29 Sep to 3 Oct), then Kit B (1 Oct to now).** In total that is 155 launches and 34 gates through this one funder.
  - Each launch uses a fresh caller wallet (92 for Kit B, 16 for the 3,587 family, only 1 shared). So the stable link is the disperse contract, not the callers.
  - Caller `0x081d46bd98f0cac0270a455efb13c5c459070e0d` funded a 3,587-family deployer and also the sell cascade on `0x2a6efa703d8f1f06da07d1960711f02b1ba66f10` (A1.16). The same people seed the coin and later dump it.
- **Operator A (Kit A) is a funder tree that launched through the plain position manager first.**
  - Kit A's 107 deployers were funded by 24 wallets, directly or through disperse `0x03802649e469ed5680c58dff9e65425e22d21cc5`. Their parents include `0x2d4040b110f3f6b406896e91755bc7717e01dbb3` (funded 6 of the 24) and, from A1.14, `0x3393cab3fcfc5668b46d83b89f924c01f00aa766`.
  - **The same 24 funders paid for 129 launches without the kit code, mostly through the position manager. 20 of those reached the gate (15.5%, vs 0.4% for the position manager overall) and 16 were our wide trades.** 113 of them came before Kit A even existed.
  - The very first Kit A launch (`0x7b634eb897e11ab4de40f60d334e49d9a23a1b4c`) was funded by `0x3cb60e7df3814a79571200a34d31c8b38acbde72`, which had already funded earlier position-manager launches, including a gate coin. That is why the hash-blind rule caught it on day one.
  - Wallet `0xc8fc50f2aaa8c8eea6f619ca273707f411fc286e` funded both Kit A and Kit B deployers (3 launches, 3 gates). That is a possible link between the two operators.
- **Bonus, needs a money test:** operator-flagged coins WITHOUT kit code run like kits after 5x:
  - Flagged non-kit coins: median peak after 5x 4.76x, top 10% 13.8x, 18 coins. Unflagged non-kit: 1.59x and 3.43x, 255 coins.
  - But 14 of the 18 are in half A. 11 of our wide trades are flagged non-kit coins.
  - If A2 prices "kit hold on operator flag" and it beats hash-only kit hold in both halves, the flag can replace the hash.
- **First principles:** the code is the operator's tool, and he can rewrite it any day (operator B already did, four times in 7 days). The money has to reach his fresh deployer wallet before every launch, and he keeps routing it the same way. So the funding path is the operator's fingerprint. Its proof is in the outcomes: 25% of flagged launches reach the gate vs 0.5% of the rest.

## For the Coder
- JSON: http://159.223.88.168/hx-c9ois/sw/a1-21-operator-wallets.json
  - The rule text.
  - The two disperse contracts.
  - Kit A's 24 funders and 15 parent wallets.
  - Kit B's 92 callers and the 3,587 family's 16 callers.
  - The 25 keys that funded a gate coin (the live watch list, with launches, gates and last launch time).
- **Live use:** at each new v3 WETH launch, read the deployer's first funding (balance search back 1 h, then that block). Compute the key. If the key is on the watch list, tag `operator`. When any coin reaches the gate, add its key.
- Watch-list caution: keys can be public contracts. `0x8876789976decbfcbbbe364623c63652db8c0904` (2 gates in 15 launches) looks like a bot route. Treat a contract key as operator only if at least 1 in 5 of its funded launches reached the gate. `0x84157d3d24630c297849c84d49ae7f1805c1b60f` passes (34 of 155 = 22%); `0x03802649e469ed5680c58dff9e65425e22d21cc5` passes (25 of 45); `0x8876789976decbfcbbbe364623c63652db8c0904` fails (13%).

## Method
- All 7,108 Uniswap v3 WETH launches since 13 Sep 00:00 Bangkok, 5,642 deployers. For each deployer, the first funding was found by checking the balance 1 h before launch (older wallets marked "old"), then a binary search and that block's transactions. 4,179 direct, 471 through a contract, 992 old.
- Kit A funders were traced one hop further (24 wallets).
- Gates: the 114-coin sellable $1M gate set with gate blocks. Walk forward = events sorted by block, so a key counts only after its coin's gate block.
- Peak after 5x: from A1.20 (base first swap + 5 min, 24 h).

## Limits
- First funding only. An operator who funds deployers from a new, unrelated wallet each time, with no shared contract, would slip through. Kit A shows 28 of 107 misses for that reason.
- The seed buyers (the 0.01 ETH bundle wallets) were not used. They come in the same disperse transaction as the deployer, so they add little.

## Asks for Supervisor
- Coder: add the `operator` tag from the json and keep the watch list learning live. Keep kit hold on the hash for now.
- A2 (or A3): money test "kit hold if kit hash OR operator flag" vs hash only, both halves, all frictions, plus the random-half baseline.

First principles score: 85%. Every link comes from each deployer's own first-funding transaction on chain, and the test is walk forward with no code hashes. Missing: seed-buyer links, and a money test of the flag as a hold trigger.

Scripts: /root/a1/a121/dfund.py, kita.py, wf.py (review container). Latest: http://159.223.88.168/hx-c9ois/sw/a1-21-kit-operator.md