Skip to content
Fuga Labs
Scope an engagement
Sector preset

Exchanges & settlement venues

For venues where the fraud is almost never in the transaction, and almost always in what did not happen beside it.

Scope an engagement Every sector preset
PresetonboardCexDetectors in play19Boundaries declared3Refusals at onboarding0

How this sector loses money.

Exchange losses are almost never a contract bug. They are an operations story: a signer phished, an approval left open, an MFA toggle flipped at 02:00, a withdrawal that looks like the ten thousand before it. The fraud is in what did not happen alongside it.

Answered by
  • 19Deterministic rules

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardCex(platform, config) 6 configured
  1. 01Hot, warm and cold wallet monitoring, plus every Safe in the signing path
  2. 02Deposit screening and withdrawal screening against the live label graph
  3. 03Reserve reconciliation from signed attestations, with proof of control per address
  4. 04Signed off-chain event ingest, correlated to chain movement on occurrence time
  5. 05Signer-set structure: overlap, delegatecall shape, ECDSA nonce reuse
  6. 06Sanctions screening with a named source and a consulted-at timestamp
Detectors in play
  • rules.safe-structure-delegatecall
  • rules.multisig-signer-overlap
  • rules.ecdsa-nonce-reuse
  • rules.proportional-drain
  • rules.multi-token-sweep
  • rules.approval-blast-radius
  • rules.sanctioned-interaction
  • rules.admin-authority-change
  • rules.offchain-unauthorised-outflow
  • rules.offchain-login-then-authority-change
  • rules.offchain-activity-after-offboarding
  • rules.offchain-mfa-disabled-then-movement
  • rules.reserve-shortfall
  • rules.reserve-unexplained-drain
  • rules.reserve-control-unproven
  • rules.reserve-attestation-stale
  • rules.reserve-liability-spike
  • rules.reserve-window-dressing
  • rules.reserve-address-set-change

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge The matching engine and order book run inside your infrastructure, not on a chain.
Closed by Closed by the signed off-chain ingest lane. Authenticated event streams are correlated against chain movement on occurrence time, and the flagship rule keys on the ABSENCE of an expected approval, so an outflow with no authorising event upstream is the signal.
The edge Customer liabilities never appear in chain state.
Closed by Closed by attested liability reporting: you sign the liability side, Fuga Labs measures the asset side continuously, and reserve-shortfall and liability-spike fire on the delta rather than on a quarterly PDF.
The edge Screening can only be as good as the label graph behind it.
Closed by Closed by refusing to guess. A screen with no live source consulted returns insufficient-data, never a pass. When Fuga Labs says clear, a source was consulted, named and timestamped.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Hot, warm and cold addresses separated as distinct subjects, every Safe in the signing path, and an authenticated stream from your internal systems. Control is demonstrated per address rather than asserted.

  2. Step 2

    Detect

    Chain movement is correlated to your signed events on occurrence time, not arrival time. The flagship rule fires on the absence of an authorising event, so an ordinary-looking withdrawal is exactly the one that pages.

  3. Step 3

    Prevent

    The bounded action is a withdrawal freeze on a named address set. It rehearses against your live outflow first, and the bar is duration, volume and distinct subjects.

What runs underneath.

The hash-chained export is the piece an examiner actually uses, because every question about a withdrawal turns out to be a question about sequence.

The base under all eleven presets

Scope Exchanges and settlement venues coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset