Attacker wallet pre-strike probe (low-gas failing txs)
Rocket Pool's assessment for RD-F-159 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No documented pre-strike probe pattern (low-gas failing transactions from CTI-flagged wallets) against Rocket Pool core contracts. Yearn rekt3 (Apr 2023) noted unusual LST movements adjacent to Rocket Pool before that exploit, but this was attacker assets moving through the ecosystem, not reconnaissance targeting RP contracts. Mempool and CTI feed required for production deployment. Signal not firing based on available public evidence.
Sources #
- URLYearn rekt3 hack analysisYearn rekt3 — LST adjacent movements noted (Rocket Pool, Yearn, Origin, Dinero) pre-exploit; not a direct RP proberetrieved 2026-05-04
Methodology #
Detect whether a wallet in a threat-actor cluster is sending low-gas or intentionally-failing transactions to this protocol (pre-strike reconnaissance pattern).
See the full factor methodology and distribution across all protocols →