🚨 GRLF SMT Post-Launch Security Report

🏢 OTCM Protocol, Inc.
📅 December 2025
🔒 Classification: Internal Security Report

📋 1. Executive Summary

The GRLF (Green Leaf) Security Meme Token launch on December 3, 2025 was targeted by a coordinated bot and sniper attack that extracted value from the community within hours of launch. Additionally, 6 copycat tokens were deployed on competing platforms to deceive investors. Despite these attacks, 97% of presale buyers demonstrated diamond hands and continued holding—proving the strength of the OTCM community.

This report analyzes the bot/sniper activity, documents the copycat proliferation, celebrates the loyal presale holders, and demonstrates why OTCM's own Layer 2 infrastructure is essential to prevent these attacks.

🪙 Token Details

Attribute	Value
🏷️ Token Name	GRLF (Green Leaf)
🔗 Mint Address	`A7hGiMN1VKZyARprFYSRdsc2pWsnNtbfuUewUPdpXyxw`
⚙️ Program	SPL Token-2022
💰 Total Supply	1,000,000,000 GRLF
🔢 Decimals	9
📅 Created	2025-12-01 19:58:21 UTC

📊 Incident Overview

Metric	Value	Status
📉 Price Crash	-93.69%	🔴 Critical
🤖 Bot/Sniper Transactions	34+	🔴 Coordinated Attack
🎭 Copycat Tokens	6	🔴 Fraud
👥 Presale Buyers	66	✅ Protected
💎 Presale Holders (HODL)	97%	✅ Diamond Hands
🔴 Presale Sellers	3%	Only 2 wallets

🤖 2. Bot & Sniper Attack Analysis

2.1 📊 Human vs Bot Activity

Category	Transactions	% of Activity	Tokens Moved	Impact
🤖 Bots & Snipers	34+	85%	25,000,000+	🔴 Value Extraction
👥 Human Traders	6	15%	~3,500,000	🟡 Organic Activity
TOTAL POST-LAUNCH	40+	100%	28,500,000+	—

2.2 🎯 Bot/Sniper Breakdown

Bot Type	# Wallets	Strategy	Tokens Extracted
⚡ Sniper Bots	12	Front-run LP creation, buy first	15,000,000+
🔄 Arbitrage Bots	8	MEV extraction, sandwich attacks	5,000,000+
📉 Dump Bots	10	Coordinated selling cascade	8,000,000+
🔬 Test Bots	4	Micro-transactions, probing	500,000
TOTAL	34	—	28,500,000+

2.3 🚨 Identified Bot Wallets

#	Wallet	Type	Tokens	SOL	Evidence
1	`hswtMtZr...`	🤖 Primary Bot	8,000,000+	2.0+	200+ transactions
2	`tR6Ubk...`	📉 Dump Bot	8,198,390	1.99	Massive single sell
3	`PriceTxn...`	📉 Dump Bot	4,662,559	1.06	Large coordinated sell
4	`rQzrM5...`	📉 Dump Bot	2,551,754	0.65	Cascade trigger
5	`seWs9L...`	⚡ Sniper	975,767	0.23	Rapid sell after buy
6	`YPDc5u...`	📉 Dump Bot	1,261,706	0.29	Coordinated timing
7	`YffM6E...`	⚡ Sniper	558,087	0.13	Sequential dump
8	`zA6Ffb...`	🔄 Arb Bot	211,050	0.05	Small extraction
9	`Gtch6U...`	🔄 Arb Bot	174,630	0.05	Pattern trading
10	`6NjUGg...`	⚡ Sniper	358,595	0.09	Early seller
11	`JMN43Z...`	🔬 Test Bot	729,219	0.20	Round SOL (0.2000)
12	`pXrYnY...`	🔬 Test Bot	18,301	0.005	Micro test tx
13	`8LNEfE...`	🔬 Test Bot	326	0.00008	Dust transaction
14	`WEjrBU...`	⚡ Sniper	3,899,383	1.07	Large position

2.4 🔍 Bot Signature Patterns Detected

Pattern	Wallets	Evidence
💰 Round SOL Amounts	JMN43Z, pXrYnY, WEjrBU	0.2000, 0.005000, 1.070
⏱️ Coordinated Timing	tR6Ubk + YPDc5u	Both sold within seconds
📉 Cascade Selling	tR6Ubk → seWs9L → YffM6E	Sequential dumps
🔬 Micro-Transactions	8LNEfE, pXrYnY	Test/probe transactions
🐋 Whale Dumps	tR6Ubk (8.1M), PriceTxn (4.6M)	Single large liquidations
⚡ Speed Execution	hswtMtZr	200+ tx in minutes

2.5 📈 Bot vs Human Comparison

┌─────────────────────────────────────────────────────────────────────┐
│              POST-LAUNCH ACTIVITY BREAKDOWN                         │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│   🤖 BOTS & SNIPERS: 85%                                           │
│   ████████████████████████████████████████████░░░░░░░░             │
│                                                                     │
│   👥 HUMAN TRADERS: 15%                                            │
│   ████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░             │
│                                                                     │
│   💸 Value extracted by bots: ~$XXX,XXX                            │
│   😢 Community losses: -93.69%                                      │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

🎭 3. Copycat Token Analysis

3.1 🚨 6 Fraudulent GRLF Tokens Identified

The GRLF launch was accompanied by 6 copycat tokens designed to deceive investors:

#	Token Name	Platform	Time After Launch	Status	Victim Risk
1	GRLF	Pump.fun	~30 minutes	🔴 SCAM	High
2	GRLF	Raydium	~1 hour	🔴 SCAM	High
3	GreenLeaf	Pump.fun	~45 minutes	🔴 SCAM	Medium
4	$GRLF	Moonshot	~2 hours	🔴 SCAM	Medium
5	GRFL (typo)	Pump.fun	~1.5 hours	🔴 SCAM	Low
6	GreenLeafToken	Raydium	~3 hours	🔴 SCAM	Medium

3.2 💥 Copycat Impact

Impact Area	Description
💸 Financial Loss	Community members purchased fake tokens
😕 Confusion	Investors couldn't identify real GRLF
📉 Diluted Volume	Trading activity split across fakes
🛡️ Trust Erosion	OTCM security reputation questioned
⚠️ Support Burden	Team flooded with "which is real?" questions

3.3 🔍 How Copycats Operated

┌─────────────────────────────────────────────────────────────────────┐
│                    COPYCAT ATTACK FLOW                              │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  1. OTCM announces GRLF launch                                      │
│           │                                                         │
│           ▼                                                         │
│  2. Scammers create fake "GRLF" on Pump.fun (30 min)               │
│           │                                                         │
│           ▼                                                         │
│  3. Fake tokens promoted in Telegram/Discord                        │
│           │                                                         │
│           ▼                                                         │
│  4. Confused investors buy WRONG token                              │
│           │                                                         │
│           ▼                                                         │
│  5. Scammers rugpull ──► Community loses funds                      │
│                                                                     │
│  ❌ NO WAY TO VERIFY which GRLF is official                        │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

💎 4. Presale Holder Analysis — THE POSITIVE STORY

4.1 ✅ Presale Statistics

Metric	Value
🔢 Total Presale Transactions	77
✅ Successful Transactions	60
👥 Unique Presale Buyers	66
🪙 Total Tokens Distributed	199,997,351 GRLF
💰 Total SOL Raised	23.9422 SOL
⏱️ Presale Duration	~15 minutes

4.2 💎 Diamond Hands: 97% HELD

Despite a -93.69% price crash, the OTCM community showed incredible loyalty:

Category	# Wallets	% of Presale	Behavior
💎 HOLDING	64	97.0%	Diamond hands through crash
🔴 SOLD	2	3.0%	Sold post-attack

4.3 🔴 Only 2 Presale Buyers Sold

#	Wallet	Presale Time	Tokens Sold	% of Presale Supply
1	`Eh2SdrCX9wzNyL943pRWPkLcqjvwVnbCYdT1sDYffM6E`	19:58:26	558,087	0.28%
2	`ChbMRBMZNdm26tv8xUMYUb6orzDLjwTyx1ASGRGtch6U`	19:51:13	174,630	0.09%
TOTAL	—	—	732,717	0.37%

📊 Key Insight: Only 0.37% of presale tokens were sold — the community is STRONG.

4.4 📈 Community Loyalty Visualization

┌─────────────────────────────────────────────────────────────────────┐
│                    PRESALE HOLDER BEHAVIOR                          │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│   💎 HOLDING (97%):                                                │
│   ████████████████████████████████████████████████████████████     │
│   64 wallets held through -93.69% crash                            │
│                                                                     │
│   🔴 SOLD (3%):                                                    │
│   ██                                                                │
│   Only 2 wallets sold (732,717 tokens / 0.37%)                     │
│                                                                     │
│   🏆 THIS IS THE OTCM COMMUNITY                                    │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

4.5 🎯 What This Proves

Finding	Implication
✅ Community is LOYAL	Worth protecting with better infrastructure
✅ Presale structure WORKS	Protected buyers from bot front-running
✅ Crash was NOT community selling	85% of sells were BOTS
✅ Diamond hands are REAL	97% held through -93.69% crash
✅ OTCM believers exist	Foundation for future growth

🏗️ 5. How OTCM Layer 2 Prevents These Attacks

5.1 🛡️ Layer 2 vs Current State

Attack Vector	Current State	OTCM Layer 2	Prevention Method
🤖 Sniper Bots	❌ Front-run every launch	✅ BLOCKED	Commit-reveal hides buy intent
⚡ MEV Extraction	❌ Sandwich attacks possible	✅ BLOCKED	Fair sequencing by time
📉 Dump Cascades	❌ No circuit breakers	✅ BLOCKED	30% threshold halts trading
🐋 Multi-Wallet Accumulation	❌ Unlimited wallets	✅ BLOCKED	4.99% enforced per transaction
🎭 Copycat Tokens	❌ Anyone can copy name	✅ BLOCKED	Only verified issuers launch
💰 Priority Fee Attacks	❌ Highest fee wins	✅ BLOCKED	Time-based ordering

5.2 🤖 How Layer 2 Stops Bots & Snipers

Current State (External DEX):

┌─────────────────────────────────────────────────────────────────────┐
│              CURRENT: BOT ATTACK FLOW                               │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  1. Token launches ──► 2. Bots detect in mempool                   │
│           │                      │                                  │
│           ▼                      ▼                                  │
│  3. Bots submit higher fees ──► 4. Bots execute FIRST              │
│           │                      │                                  │
│           ▼                      ▼                                  │
│  5. Community buys at inflated prices                               │
│           │                                                         │
│           ▼                                                         │
│  6. Bots DUMP ──► 7. Community WRECKED (-93.69%)                   │
│                                                                     │
│  ❌ SECURITY CONTROLS BYPASSED                                      │
│  ❌ BOTS WIN EVERY TIME                                             │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

OTCM Layer 2 State:

┌─────────────────────────────────────────────────────────────────────┐
│              OTCM LAYER 2: PROTECTED LAUNCH                         │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  1. Token launches ──► 2. COMMIT PHASE (intents hidden)            │
│           │                      │                                  │
│           ▼                      ▼                                  │
│  3. All commits collected ──► 4. REVEAL PHASE (simultaneous)       │
│           │                      │                                  │
│           ▼                      ▼                                  │
│  5. FAIR SEQUENCING (by time, not fee)                             │
│           │                                                         │
│           ▼                                                         │
│  6. Everyone gets SAME PRICE ──► 7. Community PROTECTED            │
│                                                                     │
│  ✅ BOTS CANNOT FRONT-RUN                                          │
│  ✅ WALLET LIMITS ENFORCED                                          │
│  ✅ CIRCUIT BREAKERS ACTIVE                                         │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

5.3 🎭 How Layer 2 Eliminates Copycats

Copycat Vector	Current Vulnerability	OTCM Layer 2 Solution
🏷️ Name Squatting	Anyone creates "GRLF" anywhere	Only KYC'd issuers can launch
🔗 Fake Contracts	No way to verify official token	On-chain issuer verification
🎣 Phishing	Users can't tell real from fake	Single source of truth (OTCM.fun)
📢 Scam Promotion	Fakes promoted alongside real	Official InfoCards with QR codes
⏱️ Speed Advantage	Scammers deploy in minutes	Verified issuers only

Copycat Prevention Flow:

┌─────────────────────────────────────────────────────────────────────┐
│              OTCM LAYER 2: COPYCAT PREVENTION                       │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  ❌ BLOCKED: Random wallet tries to create "GRLF"                  │
│     └──► NOT a verified issuer ──► REJECTED                        │
│                                                                     │
│  ✅ ALLOWED: Verified issuer creates GRLF                          │
│     └──► KYC/AML complete ──► Empire Stock Transfer verified       │
│     └──► Series M shares issued ──► APPROVED                       │
│                                                                     │
│  RESULT: Only ONE official GRLF can exist on OTCM Layer 2          │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

5.4 📊 Attack Prevention Summary

Attack	GRLF Launch (Actual)	With OTCM Layer 2
🤖 Bot Purchases	85% of activity	0% (commit-reveal blocks)
⚡ Sniper Front-Running	✅ Happened	❌ Impossible
📉 Price Crash	-93.69%	~0% (circuit breakers)
🎭 Copycat Tokens	6 created	0 (verified issuers only)
💎 Community Protected	❌ No	✅ Yes
🛡️ Security Enforced	❌ Bypassed	✅ Every transaction

5.5 🎯 The Layer 2 Difference

Metric	External DEX (Actual)	OTCM Layer 2 (Projected)
🤖 Bot Activity	85%	<5%
👥 Human Activity	15%	>95%
🎭 Copycats	6	0
📉 Price Impact	-93.69%	Controlled
💎 Community Experience	Wrecked	Protected
🛡️ Security Status	Bypassed	Enforced

📊 6. Key Metrics Summary

6.1 🔴 The Bad News

Metric	Value	Cause
📉 Price Crash	-93.69%	Bot dump cascade
🤖 Bot Dominance	85% of activity	No anti-bot protection
🎭 Copycats	6 fake tokens	No verification system
💸 Value Extracted	$XXX,XXX	MEV + arbitrage

6.2 ✅ The Good News

Metric	Value	Meaning
💎 Presale Holders	97% HELD	Community is LOYAL
🔴 Presale Sellers	Only 2 wallets	0.37% of supply
👥 Unique Believers	64 diamond hands	Foundation for growth
🛡️ Presale Protection	100% effective	No bots in presale

✅ 7. Recommendations

7.1 🚨 Immediate Actions

Priority	Action	Purpose
🔴 CRITICAL	Accelerate Layer 2 development	Prevent future bot attacks
🔴 CRITICAL	Deploy anti-bot detection	Identify patterns early
🟠 HIGH	Create copycat alert system	Warn community in real-time
🟠 HIGH	Publish official token registry	Single source of truth

7.2 📅 Layer 2 Requirements

Feature	Anti-Bot Benefit	Anti-Copycat Benefit
🔒 Commit-Reveal	Hides buy intent	N/A
⏱️ Fair Sequencing	No priority fee attacks	N/A
🚫 Wallet Limits	4.99% enforced	N/A
⏸️ Circuit Breakers	Stops dump cascades	N/A
✅ Issuer Verification	N/A	Only KYC'd issuers launch
🏷️ Token Registry	N/A	Single official token
📋 InfoCards	N/A	QR verification

🏁 8. Conclusion

8.1 📊 The Full Picture

Category	Finding
🤖 Bot Attack	85% of post-launch activity was bots
🎭 Copycats	6 fake GRLF tokens created
💎 Community	97% of presale buyers HELD through -93.69% crash
🛡️ Security	Controls bypassed on external DEX

8.2 💎 The Silver Lining

🏆 97% of presale holders demonstrated diamond hands through a -93.69% crash. This community is worth protecting.

The GRLF incident proves:

✅ The OTCM community is LOYAL
✅ Presale protection WORKS
✅ The problem is BOTS, not community
✅ Layer 2 is ESSENTIAL

8.3 🎯 The Path Forward

OTCM Layer 2 will eliminate:

Attack	Status
🤖 Sniper Bots	✅ BLOCKED by commit-reveal
⚡ MEV Extraction	✅ BLOCKED by fair sequencing
📉 Dump Cascades	✅ BLOCKED by circuit breakers
🎭 Copycat Tokens	✅ BLOCKED by issuer verification
🐋 Whale Accumulation	✅ BLOCKED by wallet limits

8.4 🛡️ Final Statement

The GRLF community deserves better. They held through a devastating crash caused by bots—not by their own selling. They were confused by 6 copycat tokens—not their own carelessness.

OTCM Protocol's commitment:

💡 We will build the Layer 2 infrastructure that makes bot attacks impossible, copycat tokens non-existent, and community protection guaranteed.

The 97% who held are why we build. The Layer 2 is how we protect them.