Attacker wallet pre-strike probe (low-gas failing txs)
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when a wallet in the threat-actor cluster sends low-gas or deliberately failing transactions to the monitored protocol — a pattern consistent with pre-strike testing of contract state, function reverts, and gas estimation for exploit transaction sizing. Detection requires mempool monitoring combined with threat-actor cluster cross-referencing. Low-gas failing transactions are identified as transactions with a gas limit below the expected minimum for the called function. Category 11 context: mempool probing is a documented reconnaissance behavior where the attacker tests the vulnerable state before committing full capital to the exploit.
**Why it matters** Radiant Capital II ($53M) includes the clearest example: a failed exploit attempt occurred six days before the successful attack, and the preparation window was ignored. The Deus DAO 2 oracle pre-poisoning transaction (four minutes before the main attack) represents a different variant of pre-strike testing. The T-01 synthesis identifies three in-sample hack precedents for this pattern. Failing transactions sent by threat-actor cluster addresses are among the highest-specificity signals available — legitimate users do not intentionally send failing transactions — but the signal requires both mempool access and a current threat-actor cluster, making it PH curation.
**Green / Yellow / Red** Green is the baseline when no threat-actor cluster addresses are sending failing transactions to the protocol in the current mempool observation window. Yellow fires when low-gas failing transactions are detected from an unclassified address at a rate inconsistent with normal testing patterns — possibly a researcher or arbitrageur probing for MEV. Red fires when a confirmed threat-actor cluster address sends one or more low-gas failing transactions to a protocol contract, particularly if the function being probed corresponds to a known vulnerability class for this protocol architecture.
**Common gray cases** Gray applies when mempool observation is not available for the protocol's chain (private mempools, some L2 sequencers), or when the threat-actor cluster lacks an entry for the specific address pattern observed.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect whether a wallet in a threat-actor cluster is sending low-gas or intentionally-failing transactions to this protocol (pre-strike reconnaissance pattern).