Small Solana bot cluster showed nearly 3x WSOL edge

Researchers analyzed on-chain activity for 200 addresses tied to two trading-oriented bot services and identified a 12-address cluster with a marked difference in wrapped SOL (WSOL) outcomes. Between Oct. 1 and Nov. 1, 2025, transactions from that cluster that invoked HumidiFi produced positive WSOL balance changes in 152,502 of 244,733 trades (62.3%). Other transactions from the same cluster produced positive WSOL changes in 45,949 of 218,678 trades (21.01%), a rate ratio of about 2.97.

The study selected the top 100 addresses linked to Trojan and the top 100 linked to SolanaMevBot, then grouped 158 addresses into four clusters using measures such as transaction intensity, execution success, fees and asset breadth; 42 addresses were treated as noise. The 12-address cluster routed a large share of its trades through Jupiter and also invoked proprietary automated market maker programs including HumidiFi. Venue identification used program IDs extracted from each transaction and cross-referenced on-chain annotations.

The paper used a profit proxy defined as the change in WSOL token balance between pre-transaction and post-transaction snapshots. That measure is not a fully netted calculation of strategy returns and does not isolate fees, tips, slippage, timing effects, route-level profit and loss, or other address-level behaviors. The authors note these limits and say the observed association does not establish that HumidiFi access caused the WSOL outcome gap.

Separate patterns appeared in other clusters. The researchers labeled three clusters totaling 56 addresses as MEV-like after observing round-trip, cross-venue trading patterns consistent with arbitrage; WSOL appeared in 70.90% to 99.94% of transactions across those groups. A different 102-address cluster concentrated 80.9% of its activity on the Pump.fun ecosystem, illustrating distinct venue preferences within the sample.

The study also scanned 586 public bot software repositories on the software side, but that sample was built independently and was not linked to the 200 on-chain addresses under analysis. The team published a replication package on Zenodo to allow other researchers to reproduce the results.

“The data show a correlation within this cluster, not proof that HumidiFi access caused the gap,” the paper states. The report does not allege misconduct or connect HumidiFi or the sampled bots to front-running or other harms, and it does not measure retail fills, slippage or user losses.