Build1 publisher2 min readPublished
Two in three $100k liquidity removals were redeposited by the same wallet within six hours
CoinMarketCap's DEX liquidity endpoint accepts a maker= filter that returns one wallet's whole history on a token. A dev.to run used it to follow 335 removals of $100k or more on an 11-token, 3-chain watchlist.
The Engineer · Build desk
What happened
- A treasury bot flagged a $21,330,275 liquidity removal from UNI/WBTC, and 132 seconds later the same wallet deposited 99.8% of it, the identical 1,962,475.5391248302 UNI, into UNI/WETH one pool over.
- A sweep of 335 non-JIT removals of $100,000 or more across an 11-token, three-chain watchlist found 223 of them, or 66.6%, back within six hours.
- The write-up calls the remaining 33.4% an upper bound on real exits, because the sweep followed makers only on the chain where the removal happened.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision A desk running LP-removal alerts now picks between tuning the dollar threshold and adding one query on the actor field; only the second can tell a rebalance from a departure.
- constraint Because the free plan rejects the start-time filter, widening the correlation window past six hours costs more pages walked per alert.
- capability The market-maker question can be settled while the alert is still on screen, on a keyless tier, with the label decided by dollar shares.
The alert and the answer come out of the same URL. `/v1/dex/liquidity-change/list` returns every add and remove on a token's pools, each row carrying a USD value in `tu`, a side in `tp`, a timestamp, and the maker wallet in `m` [3]. Build the alert bot and you filter `minVolume=100000`, sort by `tu`, and ship the top row [4]. Add `maker=` and the server returns that wallet's liquidity events across every pool of the token in one keyless call [5].
Set a window and the free tier bites. On the keyless plan `startTime` returns HTTP 403 with error 1013, while `endTime` is accepted [7]. So `follow_maker` sets its floor at `t0_ms` minus `back_h * 3600_000`, the walk pages backwards with `lastId` until a page drops below that floor, and the cut on `ts` happens client-side [6][7].
Both rows the post prints carry the same wallet: the remove is 1,962,475.5391248302 UNI out of UNI/WBTC and the add is the same figure into UNI/WETH [8][2]. The dollar values are not equal: 21,330,274.56 against 21,287,254.93, a gap of 43,019.63, or about 0.2% [9][1]. Labelling runs on `tu` shares, and `FULL` is 0.70 [11][12], so a redeposit that had lost thirty per cent of its dollar value between the two rows would still clear the bar [5]. I would keep it loose. `tu` is a valuation taken at two separate instants, and the token amounts already match to sixteen figures [8].
In the sweep, 352 keyless calls covered 335 removals, about 1.05 each, over roughly twenty minutes of wall clock [15][3]. The single documented follow used 14 calls and 50.6 seconds, because it also resolved the asset to its contract on each chain where it has a market, 13 of them for UNI, and then confirmed through `/v4/dex/pairs/quotes/latest` that the destination pool holds the money now [10][14]. The base rate came from the cheap path: same chain, one follow, arithmetic on the shares [15].
For 66.6% to mean anything on another watchlist, the makers there have to behave like these ones: back inside six hours, above a $100,000 floor, on the chain they left [15][16]. 112 of the 335 removals were not seen coming back [2]. A maker who bridged out and a maker who quit produce the same rows on a same-chain follow [17].
`EXIT` is reachable only when every follow completed; a throttled page or a walk that never reached the floor yields `INCOMPLETE` [13]. In my view most alerting code defaults the other way, and lets a timed-out follow land on `EXIT`. The repo is MIT-licensed, stdlib-only Python, and runs without an API key [18].
What to watch
- Whether a cross-chain sweep converts part of the 33.4% residual into labelled migrations, and how much of it survives as real exits.
- Whether CoinMarketCap leaves maker= outside the plan gate that already blocks startTime on the keyless tier.
- Whether the follow holds up on pools where JIT liquidity dominates, since JIT removals were excluded from this sweep.