The Cassandra Rulebook — v0 Draft

Status: Draft. Each rule below is a hypothesis we are validating against historical exit events. Thresholds will be tuned in beta with public backtest results.

Why this is public: A risk agent that asks you to trust it without showing its rules is just another black box. Cassandra's rulebook is the opposite — every signal Cassandra reacts to, every threshold that triggers a verdict, and every known false-positive case is documented here. If you disagree with a rule, you can argue with it. If you find one we missed, open an issue.

How verdicts work: Each rule emits one of three states per token, per block:

• OK — signal is within normal range
• WARN — signal is elevated; Cassandra logs and notifies but does not act
• EXIT — signal is in terminal range; Cassandra issues an exit verdict

The composite verdict for a position aggregates across all eight rules. A single EXIT rule does not trigger autonomous exit in v0 — the user's chosen risk profile (Conservative / Standard / Aggressive) determines how many rules and at what levels combine into action.

Rule 01 · Liquidity Depth Collapse

What it watches: The deepest available trade route for the token, denominated in stable + blue-chip pairs (USDC, ETH, cbBTC), measured as the size of a swap that can be executed at ≤ 2% slippage.

The hypothesis: Almost every rug and most slow exit-scams are preceded by a measurable drop in exit liquidity in the hours before price action moves. Insiders remove LP before they sell; the sell can only land into what is left.

Thresholds (v0 draft):

• WARN — exit liquidity drops by ≥ 30% within any rolling 60-minute window
• EXIT — exit liquidity drops by ≥ 60% within 60 minutes, OR drops by ≥ 40% with concurrent rule 04 (mint authority) flag

Known false positives we're tuning around: Scheduled LP migrations between protocols (Aerodrome → new venue) can mimic this signal. We are building a whitelist of known migration events.

Rule 02 · Holder Concentration Spike

What it watches: Distribution of token supply across top-10, top-50, and top-100 wallets, recomputed every block. We track both the absolute concentration and the rate of change.

The hypothesis: Tokens that are about to dump usually consolidate first. A small number of wallets accumulate ahead of an exit; or, in slow-rug patterns, dev/team wallets quietly aggregate before disposal.

Thresholds (v0 draft):

• WARN — top-10 wallet concentration increases by ≥ 5 percentage points within 24 hours
• EXIT — top-10 concentration exceeds 80% AND increased ≥ 10 percentage points within 24 hours

Known false positives: New token launches with intentional team/treasury allocations will trigger this on day one. Cassandra excludes from the calculation any wallet labeled as: known CEX, locked vesting contract, DAO treasury, or LP pair.

Rule 03 · Large-Wallet Exit Cluster

What it watches: Sell-side flow originating from wallets that we tag as "informed" — wallets that bought into the token early, hold larger-than-median positions, or are linked to dev/team addresses via onchain heuristics.

The hypothesis: Informed wallets exit first. A cluster of large informed-wallet sells in a short window is one of the highest-precision precursor signals available.

Thresholds (v0 draft):

• WARN — ≥ 3 informed wallets sell ≥ 10% of their position within a 30-minute window
• EXIT — ≥ 5 informed wallets sell ≥ 25% of their position within a 30-minute window, OR any single dev-linked wallet sells ≥ 50% of its position

Known false positives: Rebalancing by funds that hold the token as part of a basket can look like an exit cluster. We will publish the "informed wallet" tagging methodology separately and accept reports of mislabeled addresses.

Rule 04 · Mint Authority & Upgrade Flag

What it watches: Whether the token contract retains mint authority, whether ownership has been renounced, whether the contract is behind a proxy that can be upgraded, and whether any upgrade has been initiated in the last 24 hours.

The hypothesis: Most rugs are not exotic — they are contracts that were always able to mint or upgrade, used by an owner who eventually used the ability. A token that retains mint or upgrade capability is one decision away from terminal dilution.

Thresholds (v0 draft):

• WARN — token has mint authority not renounced AND non-zero supply increase in last 7 days
• WARN — token contract is upgradeable proxy AND an upgrade transaction is pending or confirmed in the last 24 hours
• EXIT — mint transaction occurs that increases total supply by ≥ 5%, OR upgrade transaction modifies fee / transfer / blacklist logic

Known false positives: Some legitimate protocols use proxies for genuine upgrade governance. Cassandra distinguishes by checking whether the upgrade authority is a multisig, a timelock, or a single EOA — single-EOA upgrade authority is treated more severely.

Rule 05 · Peer Divergence

What it watches: Price action of the token relative to a peer basket — other tokens in the same Virtuals cohort, same launchpad week, same category tag.

The hypothesis: A token dumping while its peer group holds is more likely token-specific (bad news, insider exit) than market-wide. A position that diverges significantly negative from its peer median deserves elevated scrutiny.

Thresholds (v0 draft):

• WARN — token underperforms peer median by ≥ 15% over a 4-hour window
• EXIT — token underperforms peer median by ≥ 30% over a 4-hour window AND any one of rules 01–04 is also in WARN or EXIT

Known false positives: Genuine project-specific good news (unrelated airdrop, partnership) can also cause divergence — in the opposite direction. We are not currently triggering on positive divergence; only negative.

Rule 06 · Bridged-Asset Linkage Risk

What it watches: For tokens that are bridged representations or have liquidity dependent on a bridge contract, the health of the underlying bridge: validator set changes, paused state, exploit reports.

The hypothesis: A non-trivial share of historical losses on Base and other L2s came not from the token itself but from the bridge holding the underlying reserve. If the bridge breaks, the token breaks regardless of its own contract.

Thresholds (v0 draft):

• WARN — the bridge backing this token has paused or rotated validators in the last 24 hours
• EXIT — the bridge backing this token has a confirmed exploit or reserve discrepancy ≥ 5% of TVL

Known false positives: Scheduled validator rotations on multi-sig bridges. We maintain a list of routine rotation schedules per bridge.

Rule 07 · Honeypot & Transfer-Tax Behavior

What it watches: Cassandra periodically simulates a small sell transaction from a wallet matching the user's profile and observes whether the sell succeeds, whether it incurs an unexpected transfer tax, and whether the tax rate changes between simulations.

The hypothesis: Some rugs are not dumps — they are honeypot contracts where buys succeed and sells silently fail or are taxed at 99%. A contract that exhibits asymmetric or shifting sell behavior should be exited immediately.

Thresholds (v0 draft):

• WARN — simulated sell incurs a tax above 10%, or sell tax has been changed in the last 7 days
• EXIT — simulated sell fails entirely (honeypot), OR sell tax exceeds 30% on simulation

Known false positives: Tokens with legitimate, declared, stable transfer taxes (some reflection tokens) will register as WARN constantly. Cassandra allows users to whitelist a known-and-accepted tax rate per token.

Rule 08 · Social Anomaly

What it watches: A narrow set of public signals around the project: official handle deletion, abrupt deletion of past posts, sudden change of project name or domain, and known team handles being deactivated.

The hypothesis: Some exits are signaled offchain before they happen onchain. This rule is intentionally conservative — most "social signals" are noise — but the specific patterns of handle/domain deletion have historically been close-to-exit indicators.

Thresholds (v0 draft):

• WARN — project's verified social handle is deactivated or the linked domain stops resolving
• EXIT — both the project handle and at least one team handle are deactivated within 24 hours

Known false positives: Account suspensions by the platform, brand renames, domain migrations. We log every trigger of this rule with manual review before any v1 autonomy is granted to it.

What's not in v0 (and why)

Several signals we considered are explicitly deferred:

• Price-only technical patterns (RSI divergence, MA crosses): not predictive enough on Virtuals-cohort timeframes; rejected.
• Sentiment analysis from social media volume: too easy to manipulate, low precision; deferred to v2.
• Cross-token wallet linkage (same exit pattern across multiple positions): high value but requires more data; targeted for v1.
• Audit status of the underlying contract: useful as a static signal but not actionable in real-time; will surface as a portfolio-level dashboard view, not a verdict input.

How to contribute

This document lives at cassandradefi.com/rulebook. If you have:

• A historical rug we should backtest against
• A rule we missed
• A false-positive case for one of the existing rules
• A threshold you think is wrong

— open an issue on the linked GitHub repo or DM the team handle. Contributions that materially change a rule will be credited in the next version.

v0 draft · last updated: 2026-05-19