OAK — OnChain Attack Knowledge

Worked example · 2024-10

$SHAR / Sharpei Solana memecoin funnel-collapse rug — Solana — 2024-10-23/24

Loss
approximately $3.4M extracted by the operator cohort in a single coordinated sell event. Per Bubblemaps' on-chain analysis: 60% of total token supply was acquired at launch and re-distributed across more than 100 addresses; every one of those addresses subsequently funnelled its supply back into a single central wallet, which sold the entire position in one clip for ~$3.4M. The token's market cap, which had peaked above $54M within the first hour of launch under heavy influencer-promoted buying, collapsed by approximately 96% in seconds at the moment of the funnel-out sell. Aggregate retail mark-to-market loss is undisclosed; structural transfer-of-value is from the influencer-amplified buyer cohort entering on the post-launch AMM leg into the operator cohort whose bundled-launch supply concentration was funnelled into a single coordinated exit.
OAK Techniques observed
OAK-T2.001 (Single-Sided Liquidity Plant, applied to the Solana memecoin context) — once the cohort-controlled 60% concentration was funnelled into the central wallet and sold in a single clip, the public-side counter-liquidity on the AMM leg was structurally insufficient to absorb the exit, producing the recorded ~96% drawdown in seconds. OAK-T3.001 (Sybil-Bundled Launch) — the 60% / 100+address acquisition-at-launch pattern is the canonical sybil-bundled-launch fingerprint; the additional structural feature here is the single-wallet funnel-out before the sell, structurally the inverse of the NEIRO 400-address-rebroadcast pattern (NEIRO spread to obscure cohort control; SHAR re-aggregated to execute a single-block exit). OAK-T5.001 (Hard LP Drain, applied to AMM-side single-block exit) — the cohort exit was a single-clip sell rather than a slow-trickle, producing the seconds-scale 96% drawdown that distinguishes SHAR from NEIRO's slower T5.002 trickle. OAK-T3.004 (Influencer-Amplified Promotion) — the buy-side flow attracted by influencer promotion is the structural counter-party absorbing the cohort exit; multiple influencers were named in the project's promotional materials, several of whom subsequently denied involvement post-collapse.
Attribution
inferred-strong Bubblemaps published the on-chain wallet-cluster analysis publicly within hours and confirmed to Decrypt that "this would be defined as a rug pull." The 60% / 100+address / single-wallet-funnel-out fingerprint is on-chain conclusive at the wallet-cluster level. Decrypt, The Crypto Times, Cryptopolitan, and AiCoin published convergent forensic accounts. The official SHAR Twitter account ascribed the project's collapse to "FUD" and stated the project no longer had funds to continue operations; several named promotional influencers denied involvement post-collapse. No operator / deployer identity publicly named at v0.1 cutoff; no regulator action public; no civil litigation public.
OAK-Gnn
unattributed at v0.1; the cluster is a candidate seed for inclusion in a future Solana-memecoin-cohort operator-cluster OAK-G entry alongside the examples/2024-2025-pump-fun-bonding-curve-rug-cohort.md "Rug Republic" twelve-cluster framing.
Key teaching point
SHAR is the canonical October-2024 per-token T2.001 / T3.001 worked example demonstrating the bundled-launch + funnel-out + single-block AMM exit chain. The case complements examples/2024-07-neiro-solana-bundled-launch-rug.md (slow-trickle exit shape) by anchoring the single-block hard-exit shape within the same broader Solana memecoin cohort. Both NEIRO and SHAR exhibit the spread-after-launch concentration-obfuscation overlay; they diverge on exit shape. The two cases together establish the structural matrix at v0.1: cohort-control + obfuscation-overlay × {slow-trickle, hard-drain}.

Summary

Sharpei (SHAR) launched on Solana on 2024-10-23 / 2024-10-24, branded as a Shar-Pei dog-themed memecoin and promoted heavily through influencer-driven X / Twitter campaigns. The token's market cap peaked above $54M within the first hour of launch under organic buyer flow attracted by the influencer promotion. Per Bubblemaps' on-chain analysis published the same day, 60% of total supply was acquired at launch by a cohort of more than 100 addresses; every one of those addresses subsequently funnelled its supply back into a single central wallet, which sold the entire $3.4M-equivalent position in one block. The token price collapsed by ~96% in seconds.

The cohort-funnel pattern is structurally informative for OAK's T3.001 / T6 framing because it inverts the more common spread-to-obscure pattern documented in examples/2024-07-neiro-solana-bundled-launch-rug.md. NEIRO bundled at launch and spread across 400 secondary addresses to defeat naive holder-distribution heuristics before slow-trickle selling. SHAR bundled at launch, spread across 100+ addresses to defeat the same heuristic, then re-aggregated into a single wallet for a single-block hard-exit sell. The two patterns demonstrate that the cohort-control + holder-distribution-obfuscation T6 modifier is structurally orthogonal to the exit-shape choice (slow-trickle T5.002 vs hard-drain T5.001).

For OAK's T2 / T3 framing, SHAR is the canonical October-2024 per-token worked example demonstrating the bundled-launch + funnel-out + single-block AMM exit chain. Three structural features make the case load-bearing for defenders:

  1. The pre-exit funnel-in is the on-chain leading-indicator. Approximately 100+ addresses converging supply into a single central wallet is a cohort-coordination signal that materialises before the exit transaction. A defender monitoring cohort-aggregate flow (M04 funder-graph clustering applied with directional-flow tracking) would surface the funnel-in as a high-confidence pre-exit signal seconds-to-minutes before the actual single-block sell. This is materially earlier detection than monitoring the AMM-side LP-state alone.

  2. The 96% seconds-scale drawdown is the AMM-side T2.001 instantiation. The Solana AMM leg's counter-side liquidity at the funnel-out moment was structurally insufficient to absorb a ~$3.4M cohort-coordinated sell without producing seconds-scale price collapse. This is the post-graduation T2.001 manifestation on Solana: the cohort-controlled concentration is the load-bearing primitive, and the AMM-side depth is downstream of it.

  3. Influencer-amplified buy-side flow is the structural counter-party. Multiple influencers were named in SHAR's promotional materials. The buy-side flow attracted by the influencer promotion is what generated the $3.4M cohort-realisable exit at all. Several named influencers denied involvement post-collapse — a recurring pattern in the cohort that warrants the influencer-amplification mitigation surface (T3.004) being treated as load-bearing rather than ancillary.

Timeline (UTC)

When Event OAK ref
2024-10-23 (launch window) SHAR deployed on Solana with influencer-promoted launch campaign; cohort acquires 60% of supply across 100+ addresses within launch window T3.001 (sybil-bundled launch)
2024-10-23 (post-launch hour) Token market cap peaks above $54M under organic / influencer-attracted buyer flow (peak attention surface)
2024-10-23 (immediately pre-exit) 100+ cohort addresses funnel supply back into a single central wallet T6 modifier on T3.001 (cohort funnel-in)
2024-10-23 (single-block exit) Central wallet sells ~$3.4M position in one clip; price collapses ~96% in seconds T5.001 (single-block AMM exit)
2024-10-23 / 2024-10-24 Bubblemaps publishes on-chain wallet-cluster analysis identifying the 60% / 100+address / single-wallet-funnel fingerprint; confirms to Decrypt the event meets the rug-pull definition (community forensic surface)
2024-10-23 onward Decrypt, The Crypto Times, Cryptopolitan, AiCoin publish convergent forensic write-ups; SHAR official X account ascribes collapse to "FUD" (forensic record)
2024-10-23 onward Several named promotional influencers deny involvement (post-event attribution surface)
Continuing No operator / deployer identity publicly named; no regulator action public; no civil litigation public at v0.1 cutoff (attribution state)

What defenders observed

  • Funnel-in as a leading-indicator pre-exit. 100+ cohort addresses converging supply into a single central wallet is a strongly directional flow pattern that materialises before the actual sell. Cluster-aggregate flow tracking with directional resolution (M04 funder-graph clustering with funnel-out detection) is the load-bearing detection requirement for this exit shape, materially earlier than AMM-side LP-state monitoring.
  • Cluster-resolved concentration on the buy side, single-wallet on the sell side. The 60% acquisition was distributed across 100+ addresses (defeats naive top-holder concentration heuristics). The exit was through a single wallet (one transaction is the load-bearing sell event). Detection therefore requires both directions of cluster-resolution: cluster-resolving the buy-side cohort and tracking the central-wallet aggregation pre-sell.
  • Influencer-amplification is the load-bearing counter-party-recruitment surface. Multiple named influencers promoted SHAR; the post-collapse denials by several of them are the recurring cohort-fingerprint pattern. The cohort's exit at $3.4M was structurally only realisable because organic buyers entered on influencer-attracted flow. Defenders treating influencer promotion as a load-bearing risk indicator (rather than an ancillary marketing fact) are correctly calibrated for this cohort.
  • Single-block hard-exit drawdowns are the AMM-side seconds-scale signal. SHAR's ~96% drawdown in seconds is the canonical Solana AMM-side T2.001 manifestation when cohort-coordinated supply re-aggregates and exits in a single clip. AMM-side observability (price-impact-per-second on swap events) catches this at the exit, not before; the funnel-in directional-flow signal catches it before.

What this example tells contributors writing future Technique pages

  • T3.001 evasion overlays come in two structural shapes — spread-to-obscure (NEIRO) and spread-then-funnel (SHAR). Both defeat naive top-holder-concentration heuristics; the discrimination is on the exit shape (slow-trickle T5.002 vs single-block T5.001). v0.x sub-Technique enumeration should name both overlay patterns explicitly so detection guidance can address both.
  • Funnel-in directional-flow tracking is a discrete v0.x M04 sub-Mitigation. Standard funder-graph clustering identifies cohorts; the funnel-in pattern requires directional flow tracking — outflows from many cohort addresses converging into a single recipient — to surface the pre-exit signal. The directional refinement is materially distinct from the static cluster-membership signal and warrants explicit naming in M04's v0.x update.
  • Influencer-promotion is load-bearing in the Solana memecoin cohort. SHAR's recorded $3.4M extraction was only realisable because influencer-attracted organic flow entered on the post-launch AMM leg. T3.004 (Influencer-Amplified Promotion) should be treated as a primary technique alongside T3.001 in this cohort, not as a downstream amplifier. Future per-token worked examples in this cohort should record the influencer surface (named promoters, post-collapse denial pattern, paid-vs-organic discrimination) as a load-bearing structural feature of the case.
  • Hard-drain seconds-scale exits anchor the AMM-side T2.001 framing on Solana. SHAR's ~96% drawdown in seconds is the AMM-side observability signal; combined with the funnel-in pre-exit signal, the case provides a clean two-stage detection model — funnel-in detected at minutes-scale before exit, AMM-side drawdown detected at seconds-scale at exit. The v0.x detection guidance should treat the two stages as complementary rather than alternatives.

Public references

Discussion

SHAR is the canonical October-2024 per-token T2.001 / T3.001 worked example demonstrating the bundled-launch + funnel-out + single-block AMM exit chain. The case complements examples/2024-07-neiro-solana-bundled-launch-rug.md (slow-trickle exit shape) by anchoring the single-block hard-exit shape within the same broader Solana memecoin cohort. Both NEIRO and SHAR exhibit the spread-after-launch concentration-obfuscation overlay; they diverge on exit shape. The two cases together establish the structural matrix at v0.1: cohort-control + obfuscation-overlay × {slow-trickle, hard-drain}.

The funnel-in directional-flow signal is the case's most defensively-actionable observation. The 100+ cohort addresses converging supply into a single central wallet before the sell is a leading-indicator that materialises seconds-to-minutes before the AMM-side drawdown. Standard funder-graph clustering identifies cohort membership at deploy-time; directional-flow funnel-detection identifies imminent cohort-exit at pre-execution time. The two detection layers are complementary and v0.x M04 guidance should treat them as a unified detection model with cohort-membership-clustering as the static layer and funnel-in flow-tracking as the dynamic layer.

The influencer-amplification surface is structurally load-bearing in the SHAR case. Multiple named promoters drove the buy-side flow that generated the $3.4M cohort-realisable exit; several denied involvement post-collapse. This is a recurring pattern across the broader 2024-2025 Solana memecoin cohort — promoters typically receive incentive payments at the cluster-of-launches level and individually disclaim involvement when specific tokens collapse. T3.004 (Influencer-Amplified Promotion) should be enumerated as a primary technique in this cohort rather than a downstream amplifier. Future SHAR-class worked examples should record the named-promoter set and the post-collapse-denial pattern as load-bearing structural features.

For OAK's broader cohort coverage, SHAR sits between examples/2024-07-neiro-solana-bundled-launch-rug.md (anonymous-operator slow-trickle case) and examples/2024-12-hawk-tuah-celebrity-memecoin.md (celebrity-amplified per-token case) in the spectrum: anonymous-operator + influencer-amplified + single-block exit. The three cases collectively span the load-bearing structural variations of the 2024 Solana memecoin cohort at v0.1.

Techniques demonstrated (4)