Demystifying Solana Bots: From GitHub Blueprints to On-Chain Fingerprints
Source: arXiv:2607.28424 · Published 2026-07-30 · By Xiaoye Zheng, Yujing Chen, Minghao Wu, David Lo, Difan Xie, Daoyuan Wu et al.
TL;DR
This paper performs the first comprehensive empirical study characterizing Solana bots from both their off-chain software implementations and their on-chain transaction footprints. Solana’s high throughput and low fees make it an attractive platform for bots engaged in DeFi activities, especially MEV (Maximal Extractable Value) operations, but prior work lacked a systematic understanding of what these bots actually implement and how these implementations translate into observable on-chain behaviors. To fill this gap, the authors curate a large dataset of 586 open-source Solana bot repositories from GitHub and 200 blockchain addresses linked to bots, which collectively submitted over 44 million transactions. They derive a grounded taxonomy of bot functionalities spanning 15 categories within five domains, identify a canonical five-stage operational pipeline common across bot implementations, and uncover distinct clusters of bots on-chain with differing trading patterns and profitability. Their results reveal a bot ecosystem dominated by trading automation and MEV strategies, systemic technical lag in dependencies, and nuanced on-chain execution variations tied to bot types and platforms.
Key findings
- A taxonomy of 15 bot functionality categories grouped into 5 domains (Trading Operations, MEV, Market Manipulation, On-chain Analytics, and Tooling/Infrastructure) derived from 586 GitHub repositories.
- 90% of the 2,003 identified code-level building blocks appear in fewer than 3.1% of repositories, indicating high implementation diversity across bots.
- A shared five-stage operational pipeline is distilled, covering Setup, Observation/Acquisition, Analytics, Planning/Decision, and Execution/Reporting phases.
- @solana/web3.js is used in 85.9% of JavaScript/TypeScript bot repos, evidence of heavy reliance on Solana SDKs.
- Over 30% of third-party dependencies are over one year behind the latest release versions, showing substantial technical lag.
- Four distinct clusters of bot addresses emerge on-chain based on transaction submission intensity and execution effectiveness.
- MEV bot clusters pivot heavily (~71%-99.9%) on WSOL token, with MEV bots invoking proprietary AMMs achieving 62.3% positive profit rate—3x higher than non-AMM MEV bots.
- Trading Operations bots cluster mainly on the Pump.fun platform, accounting for 80.9% of their activity.
Threat model
The paper implicitly considers adversaries as trading bots competing in a high-throughput, low-fee environment on Solana, aiming to maximize profit through strategies such as arbitrage, sniping, sandwich attacks, or market manipulation. These bots operate off-chain yet submit on-chain transactions, attempting to exploit latency, order sequencing, and transient price differences. The adversaries cannot control the underlying blockchain protocol, but they have programmatic access to submit transactions rapidly and construct atomic batches.
Methodology — deep read
The study examines Solana bots through two main datasets: (1) 586 bot code repositories mined from GitHub using keyword searches, metadata filters, and manual screening to ensure Solana-specific and automation-related code, (2) 200 bot-associated on-chain addresses from leading Solana bot services (Trojan, SolanaMevBot, Axiom). Data collection spans multiple months capturing over 44 million transactions with detailed on-chain traces, such as signatures, invoked program IDs, fees, and token balance changes.
For RQ1 (taxonomy), the authors extract 78,300 functions via tree-sitter from the repos, summarize functions with a large language model (DeepSeek v3.2), and apply LLM-assisted open card sorting to cluster function summaries into repository-level semantic tags. Two authors independently create and reconcile a taxonomy of 15 categories within 5 domains with high inter-rater agreement (Cohen’s kappa 0.78). Repository dominant categories are assigned based on function-level tag prominence and manually validated on a sample with kappa 0.81.
For RQ2 (implementation), the authors embed normalized function code using Qwen3-Embedding-0.6B to generate 1,024-d vectors, then reduce dimensions with UMAP and cluster with HDBSCAN tuned for silhouette quality, yielding 5,007 function clusters. Clusters are labeled with LLM-generated short descriptions and consolidated into 2,003 building blocks after manual validation (kappa 0.71). They then analyze co-occurrence and call relationships of these building blocks in representative repositories to infer a canonical five-stage bot pipeline.
Third-party dependency usage is extracted from language-specific manifest files, filtering out standard libraries, yielding 15,524 dependency entries across 3,194 libraries. The authors measure technical lag of dependencies by comparing specified versions to latest releases.
For RQ3 (on-chain behavior), transaction traces linked to 200 bot addresses are analyzed for submission intensity, execution success rate, costs, and asset types. Clustering based on these metrics reveals execution phenotype clusters aligned with bot function (MEV vs Trading Operations) and platform engagement. Profitability is correlated with interaction with proprietary AMMs.
Evaluations use inter-rater statistics for taxonomy and label validations, silhouette scores for clustering, and cross-dataset validation on multiple months. The paper provides detailed methodology for data collection, function extraction, embedding, clustering, labeling, and on-chain trace analytics. No mention of code release was found; datasets are partly from public GitHub and on-chain data queried via Dune Analytics SQL engine.
Technical innovations
- LLM-assisted open card sorting and function-level summarization to derive a detailed taxonomy grounded in actual Solana bot code implementations.
- Use of a UMAP-HDBSCAN pipeline on 1,024-d function embeddings to identify fine-grained code-level building blocks representing bot functionalities.
- Derivation of a canonical five-stage operational pipeline abstracted from heterogeneous open-source bot implementations.
- Integrated on-chain clustering of bot addresses linking transaction-level execution patterns to implementation categories and trading platform usage.
Datasets
- Solana bot repositories — 586 repos — collected via GitHub GraphQL API keyword and metadata search, manually filtered and screened for automation and Solana-specific code.
- Solana bot on-chain addresses — 200 addresses — from top-ranked Solana bot services Trojan, SolanaMevBot, and Axiom, with 44,118,825 transactions collected via Dune SQL engine across multiple monthly windows.
Baselines vs proposed
- N/A — study is primarily an empirical characterization with no predictive model baselines.
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.28424.
Fig 3: Transaction success rate vs. submission rate across
Fig 4: Total profits Distribution across clusters. Bands
Limitations
- Reliance on public GitHub repositories may incur sampling bias toward open-source bots, excluding proprietary or private implementations.
- On-chain address datasets cover only bots from select top-ranked services; less prominent bots are not represented, possibly biasing behavioral findings.
- Technical lag analysis does not assess the impact of outdated dependencies on bot performance or vulnerabilities.
- Profitability correlations are observational without causal inference; unobserved confounders may exist.
- The study lacks adversarial robustness evaluation or active probing of bot resilience to detection or mitigation strategies.
- Function clustering and LLM labeling depend on embeddings and summaries that might miss semantic nuances or context-specific functionality.
Open questions / follow-ons
- How do variations in technical lag of dependencies affect bot stability, security, and profitability?
- Can on-chain execution fingerprints be leveraged to detect and mitigate malicious or collusive bot activities in real-time?
- What is the causal impact of using proprietary AMMs on MEV bot profits, and can similar advantages be engineered in other platforms?
- How do bot design choices evolve over time in response to protocol upgrades and ecosystem changes?
Why it matters for bot defense
For bot-defense and CAPTCHA practitioners, this study offers a rare implementation-grounded perspective into the operational mechanics of bots on the Solana blockchain, beyond superficial transaction monitoring. Understanding that bots instantiate through complex, multi-stage pipelines and diverse code building blocks highlights the challenge in distinguishing automated behaviors from legitimate actions solely via on-chain data. The observed clusters and execution fingerprints suggest that behavioral pattern analysis at the transaction level can support detection frameworks, but detecting bots with heterogeneous and long-tailed implementations remains difficult.
The technical lag in dependencies and reliance on standard SDKs may expose attack surfaces exploitable for defense mechanisms. Practitioners could harness insights on profitable MEV behaviors to design economic disincentives or delay mechanisms. The methodology combining off-chain implementation analysis with on-chain transaction clustering also provides a blueprint for multi-modal bot detection strategies that combine code signature analysis with behavioral telemetry, an approach potentially transferable to other blockchain ecosystems or smart-contract driven platforms.
Cite
@article{arxiv2607_28424,
title={ Demystifying Solana Bots: From GitHub Blueprints to On-Chain Fingerprints },
author={ Xiaoye Zheng and Yujing Chen and Minghao Wu and David Lo and Difan Xie and Daoyuan Wu and Xiaohu Yang and Zhiyuan Wan },
journal={arXiv preprint arXiv:2607.28424},
year={ 2026 },
url={https://arxiv.org/abs/2607.28424}
}