Newsletter #51

This week in Forta! Forta’s precompile proposal could change on-chain security forever. The Attack Detector detects THREE hacks before exploitation. Forta powers Failsafe to protect web3 users. Research on attack funding patterns unearths interesting attacker behaviors.

Forta’s precompile proposal could change on-chain security forever. RIP-7614 proposes a new precompile for L2s giving smart contracts more visibility into addresses in the transaction call stack. This additional visibility will enable DeFi protocols to perform robust transaction screening, and most importantly… block exploits. The introduction of RIP-7614, enables what Forta is calling “Threat Oracles”, an on-chain blocklist DeFi protocols can leverage to screen for and block malicious activity.

The Attack Detector detects THREE hacks before exploitation. While web3 sleeps, Forta’s Attack Detector is busy flagging hacks. Here are three hacks from December that flew under the radar:

- On December 13th, Forta detected the $264k Peapods Finance hack before exploitation. The attacker was funded via Fixed Float and deployed a single attack smart contract.

- On December 21st, Forta detected the $52k Pine Protocol hack before exploitation. The attacker was funded via Change New and deployed a single attack smart contract invoking it six times.

- On December 30th, Forta detected the $320k Channels Finance hack before exploitation. The attacker was funded via Change Now and deployed three separate attack smart contracts.

These projects could have protected all (or most) of the stolen funds if they had set up automated incident response for their protocols. Get protected in the Forta App.

Forta powers Failsafe to protect web3 users. FailSafe is now utilizing Forta's real-time threat intelligence to fuel their automated system for detecting and counteracting wallet threats. FailSafe automatically blocks all transactions with high-risk entities, identified using Forta's Scam Detector. In a world where a single click on a phishing site can drain a wallet, more automated response solutions, like FailSafe powered by Forta threat intelligence, are needed.

Research on attack funding patterns unearths interesting attacker behaviors. Hackers traditionally relied on platforms like Tornado Cash for funding their activities, but the landscape has evolved, with Forta's analysis of 32 flash loan attacks revealing diverse sources of hacker funding. Tornado Cash remains the primary source, accounting for 46% of the analyzed attacks, but new players like Railgun, along with centralized exchanges without stringent KYC processes such as ChangeNow and FixedFloat, also contribute significantly. See the rest of the metrics in Forta’s thread on X.

Forta Around the Web

- Forta’s Andy Beal draws a crowd in X Spaces event with KuCoin
- Have you ever had funds stolen on-chain?
- Listen to FailSafe’s X Spaces event with the Forta team detailing the integration