Then 3 days on POPCAT mainnet, every alert checked against Solscan.
3 more bugs, incl. a wallet holding dust that showed "Position +594,210%". Now: "New holder!"
Real traffic finds what tests don't.
Full write-up + the parsing code below 👇
Bug 2: worked on Windows, silent on Linux. Env var names are case-insensitive on Windows, not on Linux.
Bug 3: .gitignore shipped as "gitignore". Without the dot it does nothing. Users could have pushed their bot token to GitHub.
Test on the OS your users run.
Bug 1: doubled amounts.
I summed token transfers. A swap moves tokens out of the pool AND into the buyer, so both got counted.
Fix: ignore transfers. Read preTokenBalances / postTokenBalances and compute the net change per wallet. Pools are never buyers.
I audited the Solana buy bot I was selling.
Found 5 bugs. One doubled every buy amount. Another posted zero alerts on every Linux VPS.
I stopped selling it and rewrote it. Here's the post-mortem 🧵