Program labels and token locks

Not every address on a Scout canvas belongs to a person. Many are programs: exchange pools, swap routers, staking programs, bridges, and token locks. Scout looks each address up in the Wallet Sleuth program catalogue and names it, so you can tell at a glance whether funds were swapped, sent to another blockchain, or locked for someone.

What you'll see

Names on the canvas

  • A program address shows its name and what kind of account it is next to the address, for example "Raydium · CPMM pool" or "Streamflow · vesting escrow".
  • The icon in the node says what the program does: a lock for a token lock or vesting contract, two arrows for an exchange pool, a route for a bridge, and a red shield for an address that a security researcher has reported as a wallet drainer.
  • "Program" on its own means the address is a program, or is owned by a program, that is not in the catalogue yet. Wallet Sleuth reviews these and adds them over time.
  • "couldn't check" means the blockchain data provider did not answer when Scout looked. It does not mean the address is a plain wallet.

The program card

Select a named node to open its inspector. A card above the timeline shows the program's name, its operator, its category, how sure the catalogue is, and the public sources the name comes from.

How sure the catalogue is:

  • Verified: the operator's own documentation names this address.
  • Unconfirmed: a public registry or explorer names it, but the operator has not been confirmed.
  • Reported by a security source: a named security researcher or company published the address as part of a scam or drainer report. The card links to that report.

Token locks

When funds go into a token lock that Scout can read, the card also shows what the lock holds, read live from the blockchain:

  • who deposited the tokens and who they pay out to
  • how much was deposited, how much has been withdrawn, and how much is left (some locks only record the amount still locked, or what the recipient has earned so far, and the card names that amount instead)
  • when the lock's cliff (the first date anything unlocks) is, and when it ends, with a bar showing how far through its schedule the lock is today
  • whether the depositor can cancel the lock and take the unvested part back, or whether the lock is permanent

Some locks pay out to whoever holds a position NFT. The card says "Current NFT holder" for these, because the NFT can be sold or sent to someone else. For a few lock programs the card shows the withdrawal address recorded in the lock, which is where the lock pays out when it unlocks.

Some lock programs are named but not read. A lock that has been cancelled or closed, or that uses a layout Scout cannot read, shows "Lock contents not decoded" and is not followed.

Steps

To follow locked funds to the wallet they pay out to:

  1. Trace the wallet that sent the funds, as in Your first investigation. When the funds went into a lock Scout can read, the trace draws a "Vests to" link from the lock to its recipient and adds the recipient to the canvas.
  2. If the link is not there yet, select the lock node and select Follow to recipient on its card. Scout adds the recipient and the link.
  3. Select the recipient and trace it like any other wallet to see where the funds went after they unlocked.

If the recipient is already on your canvas, the card shows Show recipient instead and nothing is added twice.

Scout does not follow funds that went into a permanent lock (the principal never leaves), a lock whose contents could not be read, a lock that pays back to the wallet that deposited it, or an airdrop distributor (there is no recipient until someone claims). It names these and stops.

Lock links are drawn in Scout on the web. The Wallet Sleuth iPhone app does not show them yet.

Hiding program wallets

Hide program wallets in Filters hides exchange pools, swap routers, staking programs, core programs and programs that are not in the catalogue. Token locks, bridges and reported drainers always stay on the canvas, because they change what happened to the funds.

In an evidence report

An evidence report lists the locks the funds went into right after its summary, with each lock's recipient and unlock schedule, and treats a recipient whose funds have not unlocked yet as a wallet of interest.

  • For locks that hold a single position each, the report also lists the recipient's withdrawals out of the lock and follows them.
  • For locks held in a shared contract that also holds other people's positions, the report names the recipient and what is still locked, and says that withdrawals were not traced.
  • When the report cannot tell which position in a deposit received the reporter's funds, it says the depositor could not be determined and does not treat that recipient as a wallet of interest.

Funds that went into a bridge are named as having left the blockchain; the report does not follow them onto another chain.

Related