DNS/CDN/frontend hash drift
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when the hash of the production frontend JavaScript bundle changes from the last published hash, or when a DNS configuration change is detected for the protocol's primary domain. Hash monitoring is conducted by periodic comparison of the loaded JS content against the last known-good hash stored at assessment time. DNS change detection covers nameserver changes, A-record modifications, and CDN configuration updates. Category 6 context: frontend compromises represent the off-chain attack surface that smart contract audits cannot cover; the Badger DAO and Curve Finance DNS incidents demonstrate that these attacks operate with no on-chain pre-signal.
Why it matters
Badger DAO ($120M, 2021) is the clearest example: the Cloudflare frontend compromise injected a malicious script that inserted approval-harvesting calls into user transactions, and the malicious frontend persisted for approximately 12 days before the drain was executed. The attack would have been detected immediately by a frontend hash monitor. SwissBorg ($41.5M, 2025) involved a Kiln API compromise where malicious authorization was embedded in routine transactions — adjacent infrastructure. Curve Finance's DNS nameserver hijack ($575K) illustrates that DNS monitoring provides an independent alert channel from contract monitoring. AnySwap V3 ($7.9M, 2021) showed MPC key compromise enabling frontend-level attacks.
Green / Yellow / Red
Green is the baseline when the frontend hash matches the last published hash and DNS records are unchanged from the baseline configuration. Yellow fires when a minor frontend update is detected that could represent a legitimate deploy — the system checks whether a corresponding GitHub release or commit was published within six hours. Red fires when a frontend hash change is detected with no corresponding public release, or when a DNS nameserver or A-record change occurs without any prior announcement from the protocol team.
Common gray cases
Gray applies when the protocol does not have a traditional web frontend (e.g., fully on-chain UI via ENS or IPFS with content-addressed hashes), or when the CDN configuration is managed by a third party whose change events cannot be independently monitored.
Notable historical examples
- Badger DAO ($120M, 2021): Cloudflare frontend compromise; malicious script injected; 12-day window before drain.
- SwissBorg (via Kiln) ($41.5M, 2025): Third-party API compromise enabling malicious authorization in routine transactions.
- MonoX ($31.4M, 2021): Off-chain infrastructure dependency compromise contributing to attack surface.
- AnySwap V3 ($7.9M, 2021): MPC ECDSA nonce reuse enabling off-chain signing compromise.
Measurement what to look for#
Detect whether the hash of production frontend JS changes versus the prior published hash, or a DNS config change is detected.