Attacker wallet pre-strike probe (low-gas failing txs)
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when a wallet in the threat-actor cluster sends low-gas or deliberately failing transactions to the monitored protocol — a pattern consistent with pre-strike testing of contract state, function reverts, and gas estimation for exploit transaction sizing. Detection requires mempool monitoring combined with threat-actor cluster cross-referencing. Low-gas failing transactions are identified as transactions with a gas limit below the expected minimum for the called function. Category 11 context: mempool probing is a documented reconnaissance behavior where the attacker tests the vulnerable state before committing full capital to the exploit.
Why it matters
Radiant Capital II ($53M) includes the clearest example: a failed exploit attempt occurred six days before the successful attack, and the preparation window was ignored. The Deus DAO 2 oracle pre-poisoning transaction (four minutes before the main attack) represents a different variant of pre-strike testing. The T-01 synthesis identifies three in-sample hack precedents for this pattern. Failing transactions sent by threat-actor cluster addresses are among the highest-specificity signals available — legitimate users do not intentionally send failing transactions — but the signal requires both mempool access and a current threat-actor cluster, making it PH curation.
Green / Yellow / Red
Green is the baseline when no threat-actor cluster addresses are sending failing transactions to the protocol in the current mempool observation window. Yellow fires when low-gas failing transactions are detected from an unclassified address at a rate inconsistent with normal testing patterns — possibly a researcher or arbitrageur probing for MEV. Red fires when a confirmed threat-actor cluster address sends one or more low-gas failing transactions to a protocol contract, particularly if the function being probed corresponds to a known vulnerability class for this protocol architecture.
Common gray cases
Gray applies when mempool observation is not available for the protocol's chain (private mempools, some L2 sequencers), or when the threat-actor cluster lacks an entry for the specific address pattern observed.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect whether a wallet in a threat-actor cluster is sending low-gas or intentionally-failing transactions to this protocol (pre-strike reconnaissance pattern).