Integration Grants Application '26: RugBuster

#1

Application Introduction

1. Name of the project

RugBuster (Syndicate Protocol)

2. Problem statement and proposed solution

Token-launch fraud follows liquidity into growing EVM ecosystems. Rug pulls, honeypot contracts, wash-traded liquidity, malicious deployers, concentrated holder clusters, and hidden contract backdoors expose users during the first hours of a token launch, before audits or community review can react.

Conflux already has security providers and proposals for broader protocol or market-risk monitoring. However, we found no publicly demonstrated Conflux eSpace deployment focused specifically on launch-time token and contract fraud that combines deployer provenance, holder clustering, wash-pattern detection, contract backdoor analysis, and evidence-based verdicts in one integration-ready system.

RugBuster fills that gap. It is an AI-assisted, multi-chain fraud-intelligence platform already operating across Avalanche, BNB Chain, Base, Solana, and TRON. This grant will adapt RugBuster’s existing EVM integration layer to Conflux eSpace, validate it against Conflux-native data, and release the Conflux adapter, event schema, SDK, reference integrations, validation subset, and documentation as public infrastructure.

3. Alignment with Conflux Network

Benefit to the Conflux ecosystem

Wallets, DEX interfaces, launchpads, explorers, Telegram tools, and other eSpace applications will be able to request a consistent token or contract risk verdict without building a fraud-detection stack from scratch. The grant-funded Conflux adapter, normalized threat-event schema, TypeScript SDK, and reference UI components will be released under the Apache-2.0 license so other builders can reuse and extend them.

Economic benefit

RugBuster does not custody liquidity or promise TVL. Its economic contribution is safer user interaction and reusable security infrastructure that can support more confident token discovery and integration on eSpace. Impact will be reported through measurable KPIs: unique Conflux contracts and tokens analyzed, production analyses, externally initiated queries, user-facing warnings, and ecosystem integrations.

4. Competitive edge

RugBuster is a working multi-chain product rather than a proposal-stage concept:

  • Production collectors and user-facing tooling across five chains: Avalanche, BNB Chain, Base, Solana, and TRON.
  • A fine-tuned Qwen3-14B model published on Hugging Face: https://huggingface.co/ffurduj/syndicate-gguf
  • An internal labeled dataset of 358,712 examples. Dataset methodology and redacted documentation can be provided during due diligence.
  • A regression-gated release process. The public large-scale QA report covers 282 Avalanche addresses. Its hard-invariant subset includes 93 rug-factory-pattern deployments, all 93 of which were prevented from receiving a GOOD verdict. The report explicitly presents this as a robustness and safety-invariant study rather than a general accuracy claim.
  • Public source repositories, live demos, APIs, Telegram monitoring, and on-chain deployments.
  • Three consecutive Avalanche Retro9000 C-Chain rounds with publicly verifiable progression from rank #21 in Round 3 to top-20 positions of #10 in Round 4 and #6 in Round 5.

RugBuster is narrower than general DeFi or infrastructure-risk systems such as Quantir. Our focus is launch-time token and contract fraud: malicious deployer history, holder coordination, wash behavior, concentration, and backdoor logic. Because Conflux eSpace is EVM-compatible, the integration reuses an architecture already operating on Avalanche, Base, and BNB Chain instead of starting from zero.

5. Project links

Avalanche Retro9000 public results:

6. Conflux eSpace grant recipient wallet address

0x66065488Af8FbeB34705f966FA43b1BEb4015E83

7. Are you an incorporated startup?

RugBuster is not currently incorporated as a separate startup. The project is operated through Fedja Furduj PR / Fantom Studio, a registered Serbian sole-proprietor business capable of contracting and invoicing internationally. Registration and KYC documentation can be provided to the Conflux Foundation.

Technical Introduction

1. Problem recap

Conflux eSpace users and integrators need an integration-ready way to identify risky newly deployed tokens and contracts before users interact with them. Raw explorer data and generic monitoring do not provide a unified, evidence-backed launch-fraud verdict.

2. Existing solutions and feasibility

Block explorers, audit firms, general security APIs, and broader protocol-risk platforms are useful but address different layers. Quantir’s current Conflux proposal focuses on protocol, market, liquidity, transaction-pattern, and infrastructure risk. RugBuster focuses on token-launch and contract fraud at the asset and deployer level.

Feasibility is high because the seven analysis modules are chain-agnostic in design and the EVM integration pattern already operates on Avalanche, BNB Chain, and Base. The Conflux work is primarily an adapter, data-normalization, validation, SDK, and production-deployment effort rather than new foundational research.

3. Purpose of the system

Provide Conflux eSpace users and builders with a real-time, queryable risk verdict for newly deployed tokens and contracts, including machine-readable evidence, confidence, and an explicit INSUFFICIENT_DATA outcome when the available evidence does not justify a safety decision.

4. Scope

In scope:

  • Conflux eSpace mainnet and testnet collector/adapter
  • Normalized threat-event schema
  • Integration and validation of the seven RugBuster analysis modules
  • Rate-limited public API and TypeScript SDK
  • Telegram and public dashboard access
  • Wallet-warning and token-risk-badge reference integrations
  • Public validation methodology and reproducible security-safe harness subset
  • Documentation, usage reporting, and 12 months of maintenance

Out of scope:

  • Custody, trading, financial advice, or token issuance
  • General RugBuster company development unrelated to Conflux
  • Conflux Core Space support during this grant period

5. Objectives and success criteria

  • Ship a public Conflux eSpace adapter and normalized event schema.
  • Evaluate all seven detection modules against Conflux eSpace data.
  • Put at least five modules into production, documenting any unavailable module and its technical dependency.
  • Analyze at least 100 unique Conflux contracts or tokens during validation.
  • Complete at least 1,000 production analyses by the final milestone, excluding health checks and internal automated tests.
  • Publish the SDK, API documentation, dashboard, two live reference integrations, validation report, and adoption report.

6. Definitions and abbreviations

  • CIA Intelligence Engine: RugBuster’s seven-module behavioral and contract-risk analysis system.
  • Canonical scoring engine: The deterministic, evidence-based service that produces the final verdict, confidence, and supporting reasons.
  • HMAC: Hash-based Message Authentication Code used between the public gateway and the private canonical scoring service.
  • eSpace: Conflux’s EVM-compatible execution environment.
  • INSUFFICIENT_DATA: A mandatory non-safe outcome returned when available evidence is incomplete or unreliable.

7. References

Technical Proposal

1. Functional overview

The production path is:

Conflux eSpace collector/adapter -> normalized threat-event schema -> seven CIA evidence modules -> private canonical scoring engine -> verdict, confidence, and evidence -> optional model-assisted explanation -> API, SDK, Telegram bot, dashboard, and third-party integrations.

The seven modules are:

  1. Funding-origin and deployer-provenance tracing
  2. Deployment-latency analysis
  3. Transaction-entropy analysis
  4. Wash-pattern detection
  5. Holder-cluster age analysis
  6. Contract-backdoor detection
  7. Holder-concentration analysis

The canonical verdict is deterministic and evidence-based. The language model may summarize evidence in human-readable form, but it cannot override module evidence, confidence thresholds, the final verdict, or the INSUFFICIENT_DATA fallback. Frontends never calculate risk independently.

Basic public queries will be available through a rate-limited gateway without registration. The gateway will authenticate internally to the private canonical scoring service using HMAC-SHA256.

Conflux-specific implementation

  • Conflux eSpace mainnet chain ID 1030 and testnet chain ID 71.
  • HTTP and WebSocket RPC ingestion of blocks, transactions, and logs using standard EVM methods including eth_getLogs.
  • Recent-transaction trace support through trace_transaction and/or debug_traceTransaction, with the working provider, limitations, and reproducible transaction hashes documented publicly.
  • ConfluxScan API as a supplementary source for token transfers, holdings, contract verification status, and ABI data.
  • RugBuster’s lightweight indexer for historical coverage where public RPC pruning or query limits prevent sufficient lookback.
  • Initial DEX/liquidity adapters targeting Swappi and vSwap, subject to implementation-time confirmation of active pools and accessible event interfaces.

Open-source and proprietary boundaries

The following grant-funded components will be released under Apache-2.0:

  • Conflux eSpace collector/adapter
  • Normalized threat-event schema
  • TypeScript SDK
  • Wallet-warning and token-risk-badge reference integrations
  • Reproducible validation harness containing a security-safe subset
  • Technical and integration documentation

The private canonical scoring engine, scoring weights, private training dataset, cross-chain intelligence graph, and production anti-abuse controls remain proprietary. The fine-tuned model weights are already public on Hugging Face.

2. Non-functional overview

Usability

  • REST API, TypeScript SDK, Telegram access, dashboard, and reference UI components
  • Basic risk queries without user registration, subject to public rate limits
  • Copy-paste integration examples and documented response schemas

Reliability

  • Golden-dataset regression suite as a mandatory deployment gate
  • No silent SAFE default when data is missing
  • Explicit data-freshness, confidence, and evidence fields
  • Health monitoring for RPC, indexer, API, and scoring-service dependencies

Performance

  • Target response time of seconds for normal pre-interaction checks
  • Cached immutable metadata and bounded RPC requests where appropriate
  • Graceful INSUFFICIENT_DATA response when upstream sources are unavailable

Implementation

  • Reuse of production EVM integration patterns
  • Modular adapter interface so Conflux-specific code remains isolated and testable
  • Public repositories, release tags, issue tracking, and milestone reports

User interface

  • Public Conflux dashboard
  • Telegram query flow
  • Wallet-warning reference application
  • Embeddable token-risk badge reference application

Total Budget

Grant size requested

$30,000 USD equivalent, paid in CFX according to program terms.

Cost justification

Cost category Amount
Conflux adapter, indexer, RPC and trace integration $8,000
CIA module integration, data validation and QA $8,000
SDK, API and reference integrations $7,000
Mainnet launch, documentation and ecosystem adoption $5,000
Infrastructure, monitoring and initial maintenance $2,000
Total $30,000

The grant funds Conflux-specific engineering, validation, open-source deliverables, documentation, deployment, and initial adoption. General company development remains self-funded. Payments are requested only after milestone acceptance criteria are met.

RugBuster’s existing multi-chain product, public model, cross-chain QA work, architecture, and initial Conflux research are pre-grant contributions and are not charged to this grant. The requested funding begins with working Conflux-specific technical implementation.

Development Roadmap

Total timeline: 9-11 weeks

Milestone Deliverable Funding Timeline
M1 eSpace adapter and threat-event schema $6,000 2 weeks
M2 CIA integration and validation benchmark $8,000 3 weeks
M3 SDK, API and reference integrations $8,000 2-3 weeks
M4 Mainnet launch, reporting and adoption $8,000 2-3 weeks
Total $30,000 9-11 weeks

Budget mapped to milestone payments:

Milestone Cost allocation Amount
M1 Conflux adapter, indexer and RPC integration $6,000
M2 Remaining RPC/trace integration ($2,000) and CIA validation/QA ($6,000) $8,000
M3 Remaining CIA validation/QA ($2,000) and SDK/API/reference integrations ($6,000) $8,000
M4 Remaining SDK/API work ($1,000), mainnet launch/documentation/adoption ($5,000), and infrastructure/monitoring/initial maintenance ($2,000) $8,000
Total $30,000

Milestone 1: eSpace adapter and threat-event schema

Funding: $6,000
Timeline: 2 weeks

Acceptance criteria:

  • Public Apache-2.0 Conflux collector repository.
  • Documented eSpace mainnet and testnet configuration.
  • Ingestion of blocks, transactions, logs, and token-transfer events.
  • Demonstrated trace retrieval for recent transactions using trace_transaction and/or debug_traceTransaction; traces are not an optional deliverable.
  • Publicly documented provider limitations and reproducible sample transaction hashes.
  • Versioned normalized threat-event schema with example payloads.

Verification and payment trigger: Public repository release, setup instructions, example payloads, and ConfluxScan links for the documented sample transactions. The $6,000 tranche is requested only after all M1 acceptance criteria are publicly available and reproducible.

Milestone 2: CIA integration and validation benchmark

Funding: $8,000
Timeline: 3 weeks

Acceptance criteria:

  • All seven CIA modules evaluated against Conflux eSpace data.
  • At least five modules enabled in production; every unsupported module must include a documented technical limitation and implementation path.
  • Conflux validation sample containing at least 100 unique contracts or tokens.
  • The maintained regression suite continues to prevent GOOD verdicts for all 93 rug-factory-pattern deployments in the public QA set.
  • Published distribution of SAFE, CAUTION, HIGH_RISK, and INSUFFICIENT_DATA outcomes for the Conflux sample.
  • Manual review of every SAFE verdict in the labeled Conflux validation sample.
  • Public validation methodology, sample counts, known limitations, and reproducible security-safe harness subset.

Verification and payment trigger: Versioned public validation report, anonymized or security-safe reproducible sample/harness, published result counts, and links to the relevant ConfluxScan records. The $8,000 tranche is requested only after all M2 acceptance criteria are published.

Milestone 3: SDK, API and reference integrations

Funding: $8,000
Timeline: 2-3 weeks

Acceptance criteria:

  • Apache-2.0 TypeScript SDK published with versioned releases.
  • Public API documentation and response-schema examples.
  • Rate-limited public Conflux risk-query gateway.
  • Wallet-warning reference integration in the public repository.
  • Token-risk-badge reference integration in the public repository.
  • Automated integration tests covering successful, high-risk, upstream-failure, and INSUFFICIENT_DATA paths.

Verification and payment trigger: Public SDK package and tagged repository release, live API documentation, passing public integration-test results, and runnable wallet-warning and risk-badge examples. The $8,000 tranche is requested only after all M3 acceptance criteria are demonstrated.

Milestone 4: Mainnet launch, reporting and adoption

Funding: $8,000
Timeline: 2-3 weeks

Acceptance criteria:

  • Production deployment on Conflux eSpace mainnet.
  • At least 1,000 production analyses, excluding health checks and internal automated tests.
  • At least 100 unique Conflux contracts or tokens analyzed.
  • Public Conflux dashboard and aggregate usage-statistics page.
  • Wallet-warning reference application deployed as a live public demo.
  • Token-risk-badge reference application deployed as a live public demo.
  • Integration documentation delivered to at least three relevant Conflux ecosystem projects.
  • Public adoption report listing contacted projects, technical discussions, feedback, and next steps.

External partner adoption is a target, but not a payment condition because final integration decisions are controlled by third parties.

Verification and payment trigger: Live public URLs, ConfluxScan-verifiable mainnet activity, aggregate dashboard statistics excluding internal tests, tagged repository releases, and the public adoption report. The final $8,000 tranche is requested only after all controllable M4 acceptance criteria are demonstrated; third-party adoption remains reported separately and does not gate payment.

Maintenance

RugBuster commits to at least 12 months of maintenance for the grant-funded Conflux adapter, SDK, reference integrations, and public API compatibility. Maintenance includes dependency and security updates, Conflux protocol and RPC compatibility, documentation corrections, monitoring, and public-repository issue triage.

Risks and Mitigations

  • Limited Conflux-specific historical fraud labels: Initial validation will combine Conflux-native observations with the existing cross-chain regression methodology. We will not claim Conflux-specific precision or recall until a sufficiently large and reliably labeled local dataset exists.
  • RPC pruning and historical-depth limitations: Mitigated with a lightweight RugBuster indexer and explicitly documented lookback limits.
  • Trace/debug RPC availability: Milestone 1 requires a working recent-transaction trace path. Any provider-specific limitations will be documented and reflected in module confidence.
  • Early-stage Conflux integrator relationships: Mitigated through low-friction reference integrations, direct delivery of documentation to at least three ecosystem projects, and a public adoption report.
  • DEX interface changes or inactivity: Swappi and vSwap targets will be confirmed at implementation time. If an interface is inactive or unavailable, an active eSpace liquidity source with equivalent public events will replace it and the change will be documented.
  • False confidence from incomplete data: INSUFFICIENT_DATA is mandatory when evidence quality does not support a verdict; the model cannot override this outcome.

Economic KPIs and Public Reporting

The following metrics will be reported publicly in monthly updates in the original forum thread:

  • Unique Conflux contracts and tokens analyzed
  • Production analyses, excluding health checks and internal automated tests
  • Externally initiated API, SDK, Telegram, and dashboard queries
  • User-facing warnings displayed, where measurable
  • Active public reference integrations
  • Ecosystem projects contacted and technical discussions initiated
  • Third-party integrations completed
  • RPC/indexer availability and material service incidents
  • Milestone deliverables, repository releases, delays, and next steps

Team

Fedja Furduj - Founder and Lead Engineer

Responsibilities: Product architecture, blockchain integrations, analysis-module development, model development, security validation, deployment, documentation, ecosystem outreach, and 12-month maintenance.

Relevant experience: More than 20 years of professional experience in 3D visualization, digital production, and software-driven technical workflows. Since June 2025, Fedja has independently built and shipped the RugBuster multi-chain fraud-intelligence stack across five networks, including production collectors, APIs, user-facing security tools, Telegram monitoring, public repositories, a fine-tuned model, and regression-gated deployment workflows.

Public profiles and repositories:

RugBuster is operated through Fedja Furduj PR / Fantom Studio, a registered Serbian sole-proprietor business. Full registration and KYC documentation can be provided privately to the Conflux Foundation.

Terms of Use

I agree to all of the following terms of use in applying to a Conflux Ecosystem Grant:

  1. I have read and understood the Conflux Grants Ecosystem Overview.
  2. I have read about and understood that the Conflux Technical Grants are subject to a No-Sale rule.
  3. I agree to provide KYC information to the Conflux Foundation for the sake of overall ecosystem security.
  4. I understand that I will be required to follow public grant reporting requirements.
#2

Thank you for reviewing the application. We’re happy to provide any additional technical details or demo access if useful.