Partial-drain test transactions
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal monitors for one or more small-value drain transactions from the protocol that fit a known pre-strike test pattern: unusually small withdrawals from a fresh wallet, failed transactions probing contract state, or micro-transfers that match the structure of a larger drain but scaled down. The signal is generated by pattern-matching against a library of known pre-exploit test transaction templates derived from post-mortem analysis. Category 6 context: test transactions represent the reconnaissance phase of an exploit — the attacker is verifying that the vulnerable state exists before committing full capital.
**Why it matters** Radiant Capital II ($53M, 2024) provides the clearest dataset example: a failed exploit attempt occurred six days before the successful attack, and the team did not act on this warning signal. Deus DAO 2 ($13.4M, 2022) showed a pre-poisoning transaction four minutes before the main attack — a test of the oracle manipulation vector. Test transactions are present in the Medium detectability hacks across the dataset, representing a pattern where earlier monitoring would have provided an actionable warning window. The signal requires pattern-matching rather than simple threshold alerting, making it programmatically harder (PH curation) than basic TVL or oracle deviation monitors.
**Green / Yellow / Red** Green is the baseline state when no test-pattern transactions have been observed from addresses not in the protocol's known user set. Yellow fires when small anomalous transactions are detected from a new address but the pattern does not yet match a known pre-exploit template. Red fires when a transaction sequence from a fresh or mixer-funded wallet matches a documented pre-exploit test template for this protocol class, particularly if followed by contract state queries consistent with vulnerability verification.
**Common gray cases** Gray applies when the protocol's normal usage patterns include high-frequency small transactions (e.g., MEV bots, arbitrageurs) that make test-transaction detection unreliable, or when the pattern library does not yet include templates for this protocol's architecture.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect one or more small-value outflows prior to a larger drain that match a known pre-strike pattern (low-value same-function calls from new wallet).