Partial-drain test transactions
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal monitors for one or more small-value drain transactions from the protocol that fit a known pre-strike test pattern: unusually small withdrawals from a fresh wallet, failed transactions probing contract state, or micro-transfers that match the structure of a larger drain but scaled down. The signal is generated by pattern-matching against a library of known pre-exploit test transaction templates derived from post-mortem analysis. Category 6 context: test transactions represent the reconnaissance phase of an exploit — the attacker is verifying that the vulnerable state exists before committing full capital.
Why it matters
Radiant Capital II ($53M, 2024) provides the clearest dataset example: a failed exploit attempt occurred six days before the successful attack, and the team did not act on this warning signal. Deus DAO 2 ($13.4M, 2022) showed a pre-poisoning transaction four minutes before the main attack — a test of the oracle manipulation vector. Test transactions are present in the Medium detectability hacks across the dataset, representing a pattern where earlier monitoring would have provided an actionable warning window. The signal requires pattern-matching rather than simple threshold alerting, making it programmatically harder (PH curation) than basic TVL or oracle deviation monitors.
Green / Yellow / Red
Green is the baseline state when no test-pattern transactions have been observed from addresses not in the protocol's known user set. Yellow fires when small anomalous transactions are detected from a new address but the pattern does not yet match a known pre-exploit template. Red fires when a transaction sequence from a fresh or mixer-funded wallet matches a documented pre-exploit test template for this protocol class, particularly if followed by contract state queries consistent with vulnerability verification.
Common gray cases
Gray applies when the protocol's normal usage patterns include high-frequency small transactions (e.g., MEV bots, arbitrageurs) that make test-transaction detection unreliable, or when the pattern library does not yet include templates for this protocol's architecture.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect one or more small-value outflows prior to a larger drain that match a known pre-strike pattern (low-value same-function calls from new wallet).