Known-exploit-template selector deployed by any address
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This episodic signal fires when any address deploys a contract containing a function-selector pattern matching a known-exploit template for a protocol of this class — regardless of who deployed it or their threat-actor status. The signal is generated by sweeping all new contract deployments on the monitored chain and comparing their function-selector sets against a library of known-exploit-template patterns derived from post-mortem calldata analysis. Category 11 context: this extends the attacker-specific monitoring of RD-F-094 to the ecosystem level — any deployment of an exploit template in the wild is a threat intelligence signal even if the deployer is unidentified.
**Why it matters** Copy-cat exploits within protocol families are well-documented. AutoShark was exploited eight hours after PancakeBunny using the same attack contract pattern; Merlin Labs was exploited one week later with an identical template. The Compound V2 empty-market exploit was used against Hundred Finance, Sonne Finance, Onyx Protocol, and Radiant Capital I — each time using the same exploit-contract structure. A deployed exploit template for a protocol class in the wild indicates that someone is preparing an attack, even if the protocol they intend to target is not yet identified. Protocols in the same class as a recently deployed exploit template face elevated risk.
**Green / Yellow / Red** Green is the baseline when no new contracts matching exploit templates for this protocol's class have been deployed on the monitored chain in the trailing seven days. Yellow fires when an exploit-template-like contract is deployed but by an address with normal on-chain history and no threat-actor labels — could be a security researcher or CTF solution. Red fires when an exploit-template contract is deployed by an address with threat-actor-cluster characteristics (mixer-funded, fresh address, or labeled attacker), particularly within days of the monitored protocol's architecture being publicly discussed.
**Common gray cases** Gray applies when the exploit-template library lacks coverage for this protocol's specific architecture, or when the protocol operates on a low-activity chain where deployment sweep coverage is incomplete.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether any contract has been deployed containing a function-selector pattern matching a known exploit template targeting protocols of this class.