Known-exploit function-selector replay
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when a transaction to the monitored protocol matches a known-exploit-replay template — a specific sequence of function selectors, calldata shapes, or inter-contract call patterns that matches a previously documented exploit execution against this protocol or a protocol of the same class. The signal library is maintained from post-mortem calldata analysis. Category 6 context: selector-pattern matching is an exploit-in-progress signal — it fires when the exploit transaction is already in the mempool, providing a last-moment alert window before block confirmation.
Why it matters
Copy-cat exploits within the Compound fork family are the clearest evidence that selector-pattern replay detection would have value: AutoShark was exploited eight hours after PancakeBunny using the same attack pattern, and Merlin Labs was exploited one week later using an identical pattern. If a selector-pattern alert had fired after PancakeBunny, protocols running the same code would have had a warning window to pause. Onyx Protocol was exploited twice with the same empty-market vector — the second exploit eleven months after the first used the identical calldata pattern, meaning a replay template from the first exploit would have fired on the second.
Green / Yellow / Red
Green is the baseline when all transactions to the protocol contain no selector patterns matching the exploit-replay library. Yellow fires when a transaction contains a partial selector-pattern match — individual selectors appear in the exploit library but the full sequence does not match. Red fires when a transaction matches a complete known-exploit-replay template, particularly if the transaction is submitted by a fresh wallet or follows a flash loan origination.
Common gray cases
Gray applies when the protocol's legitimate functionality overlaps significantly with selector patterns in the exploit library (e.g., a lending protocol that legitimately uses flash loans for liquidations), making false positive rates unacceptably high.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect whether a call-pattern matches a known-exploit replay template (specific selector sequence and calldata shape) against this protocol.