Live Detection

Attackers spent months cultivating the team, then used Solana durable nonces to get Security Council members to pre-sign transactions handing over administrative control. They whitelisted a worthless token as collateral at an invented price, deposited 500 million of it, and withdrew real USDC, SOL and ETH. The withdrawal ran twelve minutes.

Thirty-one transactions against one protocol in twelve minutes is a rate, and a rate is what a velocity rule is for. Detection fires on the first few; the armed Circuit Breaker caps outflow per window at a ceiling the treasury set, so the rest revert at your own entrypoint.

It takes more than one wall. Ops Monitor sees the administrative handover as it happens, and an Asset Ratings floor read at collateral onboarding refuses a token with no verifiable structure. Any one narrows this; all three stop it.

A rounding inconsistency in the pool invariant maths let an attacker suppress pool-token prices and extract value through repeated arbitrage. A single swap loses a negligible amount; sixty-five batched into one transaction compound into a drain. It ran across six networks in under half an hour, and copycats hit unpatched forks.

One transaction of sixty-five internal operations that leaves the pool worse off is a value-conservation failure, checked inside the transaction rather than alerted after it. The Circuit Breaker reverts it at the venue's own entrypoint. The shared threat graph means a pattern seen on one deployment is already known to every fork.

An overflow check in a shared maths library failed to reject values above its limit. The attacker flash-loaned, opened a position in a very narrow price range, and added one unit of a token. The overflow reset the calculation to a far smaller number, crediting liquidity worth millions against a deposit of one.

The check that matters is arithmetic and local: liquidity minted must be consistent with tokens actually supplied, in the same transaction. Stated as an invariant on the venue's entrypoint, the Circuit Breaker reverts the mint. No off-chain pipeline is fast enough here, and we do not claim one is.

A former employee's package account was phished, and the attacker published malicious versions of a library loaded by hundreds of dApp front ends. The injected code asked users to sign approvals and transfers routed to the attacker. Every dApp was legitimate, every domain correct, every hardware wallet working as designed.

There is exactly one place to catch this: between confirm and signature, by reading what the transaction actually does. A pre-signature verdict returns block on an unlimited approval to an address first seen minutes ago, with a reason the wallet renders in plain language.

An upgrade added a function that reduced the caller's own collateral without running the solvency check every other fund-moving function ran. The attacker flash-loaned, used the donation to push their position into insolvency, then self-liquidated it at a discount and collected the difference.

No alerting pipeline can interrupt one transaction: there is no gap between the first step and the last to send a message into. The only thing that stops this is a check inside the same transaction, in a contract the venue itself calls. That is the Circuit Breaker, and it works with Fuga Labs offline.