Avg attacker reconnaissance time for peer-class protocols
crvUSD (Curve Stablecoin)'s assessment for RD-F-163 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Attacker wallet reconnaissance time before strike (days, for similar class). This is a static/historical metric characterizing protocol-class reconnaissance risk. For crvUSD and the broader Curve ecosystem: (1) June 2024 crvUSD cascade: UwU Lend exploited June 10, cascade triggered June 12 — 2-day precursor-to-effect window; attacker used stolen funds to open crvUSD borrow positions (brief reconnaissance-to-action timeline); (2) Aug 2022 Curve DNS attack: same-day execution, no documented advance reconnaissance; (3) May 2025 DNS attack: registrar credential obtained and exploit executed, no documented extended reconnaissance; (4) July 2023 Vyper exploit (affected Curve pools, not crvUSD): vulnerability was public knowledge for months before exploitation — weeks-scale reconnaissance window. For DPRK-class (78-day USPD model), there is no confirmed DPRK targeting of crvUSD. Yellow: reconnaissance times vary from same-day to weeks; protocol-class is an active target demonstrating multiple
Sources #
- URLCurve DNS hack 2022Decrypt 2022: Curve DNS hack Aug 2022 — same-day execution attack classretrieved 2026-05-16
- crvUSD incident history for reconnaissance-time characterization00-profile.md §10 incidents: 2023-07-30 Vyper reentrancy (did not affect crvUSD); 2024-06-12 depeg; 2026-03-02 LlamaLend donation — attack timeline documentationretrieved 2026-05-16
- LlamaRisk crvUSD depeg incident reportLlamaRisk: UwU exploit June 10 → crvUSD cascade June 12; 2-day attacker-action-to-effect windowretrieved 2026-05-16
Methodology #
Report the average number of days of attacker reconnaissance activity before a strike on peer-class protocols (lending/DEX/bridge/perps), sourced from the hack database.
See the full factor methodology and distribution across all protocols →