Karnóc risk methodology
Karnóc is the engine behind every Cradara-Karnóc result. Detection is deterministic: tested rules decide the level. An AI model may only explain a finished result, must cite the evidence, and is checked by a validator before anyone sees its words.
Risk levels
| Level | Meaning |
|---|---|
| Critical | A confirmed scam pattern, such as a failed sell simulation or a known-bad deployer |
| High | Several serious warning signs |
| Medium | Some warning signs worth reviewing |
| Low | Checks completed and no significant warning signs found |
| Insufficient evidence | Key checks could not run; the result lists which ones |
"Low" never reads as "safe". Every result shows the checks that ran, the ones that did not, and the data age. Critical findings override the combined score.
Checks (detectors)
| Check | Version | Weight | Needs |
|---|---|---|---|
| Contract permissions | 1.0.0 | 1 | rpc.code, rpc.owner, rpc.proxy |
| Honeypot and tax | 1.0.0 | 1.5 | honeypot.sim |
| Liquidity | 1.0.0 | 1 | market.pairs |
| Holder concentration | 1.0.0 | 0.8 | explorer.holders |
| Deployer history | 1.0.0 | 1 | explorer.deployer |
| Impersonation | 1.0.0 | 1.2 | known.tokens |
| Scam-code similarity | 1.0.0 | 1.2 | scam.refs |
| Known-bad lists | 1.0.0 | 2 | lists.internal |
Scoring
- Each check returns pass, warn, fail, or could not run, with its evidence.
- Hard rules first: any single critical finding sets the level to Critical.
- The other findings combine with published weights (rules-1.0.0): High at 75+ or two serious failures, Medium at 25+.
- If a required check could not run (contract permissions, buy/sell simulation, liquidity, known-bad lists), the level is Insufficient evidence.
- The engine writes the evidence bundle and returns its id with the result.
Freshness
Every result shows its data age. Monitored tokens are rescored when older than 15 minutes; cached free checks after 24 hours. If a data provider is down, the result says so instead of showing old data as current.
Evidence bundles
Each bundle records every input with its source, retrieval time and block number; detector and rule versions; each finding and its weight; the final level including missing inputs; and the explanation with the evidence ids it cites. Bundles are named by their SHA-256 hash, written once, chained in an append-only index and can be replayed.
Data sources (free tier, swappable)
- Public Ethereum and Base RPC nodes (contract code, owner, proxy slots, calls)
- Blockscout explorers (verified source, creator, holders, logs)
- DexScreener and GeckoTerminal (pools, liquidity, prices, candles)
- honeypot.is (buy/sell simulation and tax)
- OFAC SDN digital-currency addresses, the Chainalysis on-chain sanctions oracle, ScamSniffer and MetaMask phishing lists
- Cradara's own confirmed cases from the validation dataset and reviewed disputes
AI explanations
Banned wording: "safe", "guaranteed", "buy now", "sell now", price predictions, or any instruction to trade. Every sentence must cite an evidence id; numbers and addresses must match the bundle. If the text fails, you see the template explanation built from the findings.
Known limitations
- Liquidity lock expiry dates are not readable from free sources; they show as unknown.
- Solana runs fewer checks (mint/freeze authority, holders, liquidity).
- Scam-code similarity only compares with confirmed cases in our reference set.
- Free data providers have rate limits; when one is down, results say which checks did not run.