Reference

FAQ & limits

What the scans can and cannot see, where the data comes from, and answers to the common rate-limit and verdict questions.

Limitations

Rico Maps is a forensic intelligence tool, not a crystal ball. Here's what to keep in mind.

We analyze the largest holders we can resolve for each token. Every scan reports its own coverage: analyzedHolders, holderCoveragePct, and a coverage note when coverage is thin. Smaller holders outside that set are not traced.

We trace a bounded number of funders per holder. Deep multi-hop funding chains may be missed.

CEX withdrawals (Binance, Coinbase, etc.) and legitimate shared services can cause false positives.

Multi-hop obfuscation (A -> B -> C -> Holder) is partially traced but not guaranteed at depth.

DEX-routed funding (through Jupiter, Raydium) is flagged but the original source may be hidden.

Threat scores are heuristic-based. A high score means elevated risk, not confirmed malice.

Bundle detection relies on transaction slot proximity. Some edge cases may be missed.

Coverage & Confidence

Confidence means coverage, not conviction. A scan's confidence (high, medium, low) reports how much of the holder population the scan saw. A low-confidence SAFE is a keyhole view, not a clean bill of health.

holderCoveragePct is analyzed holders divided by the true holder population. When the true total is unknown, the field is absent rather than guessed. A coverage note accompanies any verdict whose confidence is not high.

analysisIncomplete and degradedReasons tell you when an upstream call failed mid-scan and the result covers less than intended. Degraded scans are reported as degraded, not presented as complete.

Quick-scan may serve recent cached results for speed. Use the keyed analyze endpoint when you need a fresh, deeper read.

Data Sources & Methodology

Helius Wallet API

Funded-by tracing, batch identity lookups (5,100+ tagged accounts including known scammers, exchanges, and market makers), and portfolio data.

Helius RPC (Gatekeeper)

Token account queries, transaction history, on-chain data fetching, and enhanced transaction parsing.

DexScreener

Token metadata, trending tokens, price feeds, market cap data, and chart information for discovery.

Methodology

We use the Helius Wallet API to trace funding sources for each token holder, then cross-reference all holders to find shared funders. First-block buyers are flagged as snipers via transaction timestamp analysis. Jito bundle detection identifies wallets that transacted in the same bundle slot. Identity enrichment from 5,100+ tagged accounts flags known scammers, exchanges, and market makers. All signals are combined into a weighted threat score.

Rate Limits & Quotas

Why am I getting 429s?

Quick-scan is limited to 15 requests per minute per IP. Analyze is limited per key by tier. Per-minute 429s include a Retry-After header in seconds; wait that long and retry.

How does the monthly quota work?

Analyze quotas count requests per UTC calendar month per key. When the quota is used up, requests return 429 until the next month starts. Enterprise has no monthly cap.

Does a paid tier get better data?

No. A tier changes access only: request rate and monthly quota. It never changes scan output or scores.

Verdict Questions

Why did the verdict change between scans?

Two honest reasons: quick-scan may serve a recent cached result while a fresh scan sees newer trades, and two scans can cover different slices of the holder population. Check the coverage note and holderCoveragePct on each response before comparing them.

Can a paid tier improve a score?

No. Tiers govern access only. The scoring pipeline has no knowledge of who is asking.

Is a DANGER verdict proof of a scam?

No. Verdicts and scores are heuristic reads of on-chain behavior. They flag elevated risk, not confirmed malice, and they can be wrong in both directions.