Abnormal gas-price willingness from attacker wallet
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when a wallet submitting transactions to the protocol pays a priority fee at least five times the current exponential moving average baseline — a pattern consistent with an attacker racing against MEV bots or other frontrunners to execute a time-sensitive exploit transaction. The five-times EMA threshold is configurable per protocol tier. The signal is generated by monitoring priority-fee (EIP-1559 tip) values relative to a rolling EMA for each address interacting with the protocol. Category 6 context: abnormal gas-price willingness is an exploit-in-progress signal — by the time this fires, the attacker has already committed capital and is executing.
**Why it matters** Attackers executing flash-loan-based exploits frequently submit high-priority transactions to prevent MEV bots from frontrunning the profit extraction step, or to race governance execution windows. PancakeBunny ($45M) and Euler Finance ($197M) both involved large flash loans with associated high-priority execution. The Sonne Finance exploit involved the attacker frontrunning the market activation window with a high-priority transaction. While high gas prices alone are not exploit indicators — congested networks produce elevated fees legitimately — the combination of an unusually high tip from a fresh or mixer-funded wallet interacting with a protocol in a way consistent with exploit mechanics is a stronger signal.
**Green / Yellow / Red** Green is the baseline when all recent protocol interactions show priority fees within three times the EMA baseline. Yellow fires when a wallet pays three to five times EMA — elevated but potentially explainable by network congestion. Red fires when a wallet pays more than five times EMA while submitting a transaction matching known-exploit-class interaction patterns (flash loan initiation, admin function call, large liquidity position establishment).
**Common gray cases** Gray applies during periods of general network congestion when the EMA baseline is itself elevated and the relative signal is unreliable, or on chains where priority fees are not meaningful (fixed-fee chains).
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect whether a wallet pays ≥5× median gas priority fee (indicating MEV race or urgency), interacting with this protocol.