DNS/CDN/frontend hash drift

Evidence summary #

T-09 phase-2 signal. Applicable — sushi.com is the primary user frontend. MISO 2021 supply-chain attack (contractor injected malicious JS into launchpad frontend) establishes that frontend compromise is a real, historically-realized attack vector for this protocol. GoPlus security integration added 2024 for transaction-level threat detection, but front-end hash monitoring (DNS/CDN/JS-bundle hash drift vs baseline) is not currently deployed. Production baseline hash for sushi.com not established. Cannot assess current posture without production monitoring.

Sources #

Methodology #

Detect whether the hash of production frontend JS changes versus the prior published hash, or a DNS config change is detected.

See the full factor methodology and distribution across all protocols →