New contract with similar bytecode to exploit template
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when a newly deployed contract on the same chain has bytecode similarity above a configurable threshold (default: 85% Jaccard similarity on function-selector sets) to a known-exploit-template contract targeting this protocol's architecture. The signal is generated by continuously sweeping new contract deployments and comparing their selector sets and bytecode patterns against a curated library of exploit-template contracts from prior incidents. Category 6 context: deploying an exploit contract is a final preparation step before the attack — this signal fires during the setup phase, typically within hours of the actual exploit execution.
Why it matters
Post-mortem analysis of flash-loan and reentrancy exploits consistently reveals that the attacker deployed an attack contract in the same block or a few blocks before the exploit transaction. The Beanstalk governance exploit ($181M) involved a malicious contract created within the same governance window. Protocol-specific exploit templates — particularly for Compound V2 fork empty-market attacks, flash-loan reentrancy patterns, and oracle manipulation sequences — are reused across the Compound fork family with minimal modification. A bytecode-similarity sweep against these templates provides a credible pre-exploit detection window.
Green / Yellow / Red
Green is the baseline when no new contract deployments in the trailing 24 hours match known-exploit templates above the similarity threshold. Yellow fires when a new deployment shows elevated similarity (70–85%) but does not match any single template with high confidence. Red fires when a new contract deployment matches a known-exploit template at or above 85% similarity, particularly if deployed by a fresh or mixer-funded wallet.
Common gray cases
Gray applies when the protocol operates on a chain where new contract deployment volume is so high (e.g., high-activity L2s) that false positive rates make the signal operationally impractical, or when the exploit-template library lacks coverage for this protocol's architecture.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect whether a freshly deployed contract has high bytecode similarity to a known exploit template targeting this protocol class.