LEAK documentation

Quick start

In the browser: open leak-audit.com, paste a wallet address and pick 24 hours, 7, 30 or 90 days. The report fills in while LEAK reads the transactions.

From code: one request returns the whole summary as JSON.

curl "https://www.leak-audit.com/api/v1/audit?address=YOUR_WALLET&days=7"

How an audit works

1. Transaction list. LEAK asks the RPC for every signature that touches the wallet, newest first, back to the start of the period. Very active wallets are capped (2,500 with an archival RPC, 150 on the public one) and the report says so.
2. Transactions the wallet paid for. Each transaction is fetched and kept only when the wallet is the fee payer. Transfers other people sent to it do not count as its costs. The report shows both numbers: "paid by this wallet, out of N it appears in".
3. Cost split. Every kept transaction is split into the trade itself and what was paid on top: bot fees, network and priority fees, Jito tips, or the fee of a failed attempt.
4. Sandwich check. The largest swaps (30 with an archival RPC) are checked against the block they landed in.
5. Report. Totals, a daily or hourly breakdown, costs per platform and venue, the costliest transactions and any sandwiches found.

The web app runs these steps in chunks of 50 transactions so no single request runs longer than a serverless function allows. The API does the same work in one call with lower caps.

What is counted

All amounts are in SOL. Times are UTC. The USD figure uses the current SOL price from Jupiter, not the price at the time of each trade.

Bot fees

SOL transfers from the wallet to the known fee wallets of trading bots and terminals inside the same transaction, plus WSOL token transfers to token accounts those bots own. Transfers in a failed transaction were reverted and are not counted. Transfers under 0.0001 SOL outside a swap are ignored, because they are address-poisoning spam aimed at well-known fee wallets.

Priority & network fees

The fee field of every successful transaction the wallet paid for: 5,000 lamports per signature plus the priority fee set by the wallet or its bot. The median priority fee per transaction is shown under Unit costs.

Jito tips

Transfers from the wallet to one of Jito's eight tip accounts, read from Jito's block engine. Tips inside failed transactions are not counted.

Failed transactions

The full fee of every transaction that failed. Bots that send the same trade through several relays at once create many of these: one copy lands, the rest fail and still pay.

Sandwich attacks

For each checked swap LEAK reads its block and looks for a wallet that:

• signed a trade in the same token, in the same direction, earlier in the block;
• sold back the same amount, within 3%, later in the same block;
• ended with a net SOL gain on that token of at least 0.0001 SOL and 0.1% of your swap, and no more than half of it.

The attacker's net gain is reported as your estimated loss. Volume bots that trade both ways around other swaps net out near zero and are filtered out by the gain rule.

Volume & cost rate

For a swap, the SOL that moved for the trade is the wallet's SOL balance change plus its WSOL change, with fees, tips, bot fees and token-account rent taken back out. A transaction counts as a swap when a non-SOL token balance of the wallet changed and that SOL flow is at least 0.0001 SOL. Swaps between two tokens without SOL are not part of volume. Cost rate is total cost divided by swap volume.

Trading bots covered

LEAK recognizes 44 bots and terminals through 124 fee wallets, collected from the Dune spellbook bot-trade models, DefiLlama's dimension adapters and the solana-dex-parser-go project. Legacy wallets stay on the list so older trades still match.

Limits & accuracy

• History. Up to 2,500 transactions per audit with an archival RPC, 150 on the public Solana RPC. The report says when it covers only the latest ones.
• Exact vs estimate. Bot fees, network and priority fees, tips and failed-transaction fees are read exactly from chain data. Sandwich losses are estimates.
• Not measured yet. Slippage against the pool price, the exit value of open positions and token risk flags.
• Prices. USD values use today's SOL price from Jupiter.

API overview

The same numbers the web app shows are available as JSON. No key or account is needed.

• Base URL https://www.leak-audit.com
• Format JSON, amounts in SOL, timestamps in milliseconds since epoch (UTC).
• CORS open to any origin, so you can call it from a browser.
• Caching a finished audit is kept for 5 minutes per wallet and period; meta.cached tells you when you got a kept copy.

GET /api/v1/audit

Runs a whole audit in one call and returns the report summary. To fit a single 60 second function it reads the latest 300 transactions and checks the 6 largest swaps for sandwiches (20 and 1 when the server runs on the public RPC). It also stops reading after about 35 seconds, so a slow RPC returns fewer transactions instead of a timeout. capped: true means the period had more.

Response

Example

const res = await fetch('https://www.leak-audit.com/api/v1/audit?address=YOUR_WALLET&days=7');
const report = await res.json();
console.log(report.costs.total, 'SOL lost outside trades');
console.log(report.bots.map(b => `${b.name}: ${b.fees} SOL`));

import requests

r = requests.get("https://www.leak-audit.com/api/v1/audit",
                 params={"address": "YOUR_WALLET", "days": 7}, timeout=70)
report = r.json()
print(report["costs"]["total"], report["meta"]["cached"])

// shape of a response, values shortened
{
  "address": "Hr9b…TqCY", "days": 7, "capped": true,
  "swaps": 157, "failed": 142, "volume": 18.75,
  "costs": { "bot": 0.1875, "network": 0.0028, "tips": 0.012, "slippage": null, "sandwiches": 0, "failed": 0.0021, "total": 0.2044 },
  "bots": [{ "name": "Padre", "swaps": 157, "volume": 18.75, "fees": 0.1875 }],
  "meta": { "api": "v1", "cached": false, "tookMs": 31250, "limits": { "maxTransactions": 300, "sandwichSwaps": 6 } }
}

GET /api/v1/bots

The fee wallets LEAK matches, grouped by bot, plus the Jito tip accounts. Useful if you want to label transactions yourself.

{
  "count": 44, "wallets": 124,
  "bots": [{ "name": "Axiom", "wallets": ["7LCZ…1Qjj", "…"] }],
  "jitoTipAccounts": ["96gY…rZU5", "…"],
  "sources": ["Dune spellbook bot_trades models", "…"]
}

Chunked endpoints

The web app uses these to read long histories in steps. Use them when you need more than the one-call cap.

Returns signatures (sig, slot, t, failed), capped, the chunk sizes to use and solUsd.

Body { "address": "…", "sigs": ["…"] }, up to 50 signatures (15 on the public RPC). Returns one analyzed record per transaction the wallet paid for, and how many were missing.

Body { "address": "…", "swaps": [{ "sig", "slot", "t", "mint", "side", "size" }] }, up to 4 swaps, with size in lamports. Returns checked and incidents.

Symbol and logo for up to 50 token mints, from Jupiter.

To turn records into a report, use summarize() from /js/core.js, the same module the page runs.

Errors & limits

Every error has the shape { "error": "message" }.

Try it

Runs GET /api/v1/audit from your browser. A large wallet can take up to a minute.

// the response will appear here

Self-hosting

LEAK is a static page plus a few Node functions, with no dependencies.

cp .env.example .env      # add RPC_URL
npm run dev               # http://localhost:3000
node scripts/audit-cli.js YOUR_WALLET 7

On Vercel, set the same variables in the project settings. vercel.json serves public/ and runs api/**/*.js as functions with a 60 second limit.

Changelog