{"documented":7,"library":"eidos-attack-vector-library","monitored":4,"note":"Only monitored vectors run in the scorer. Documented vectors are versioned definitions awaiting the evidence named in evidenceRequirements; they never produce a classification.","vectors":[{"caseStudies":[{"authors":["James","Drew"],"id":"umbra-treasury-attack-2026-08","organizationName":"Umbra","organizationSlug":"umbra","proposal":"8sysa3XPrvKPmUA4qoZCn9h4vp7Mb45Ynezg542nui8Q","publishedAt":"2026-08-05","publishedLabel":"5 August 2026","publisher":"01Resolved","sourceUrl":"https://01resolved.com/research/the-umbra-treasury-attack-cost-its-attacker-4-623/","title":"Umbra's Decision Market Rejected a $1.5M Treasury Attack"}],"category":"Economic governance attack","description":"A proposer acquires the required stake, rapidly recovers and reuses it in the decision market, with wallet-funding and execution behavior providing supporting evidence.","evidenceRequirements":["Wallet history: first activity and prior onchain record","Funding path: venues and source chains for each leg","Stake accumulation and trim relative to the required threshold","Stake recovery latency and decision market reuse","Trade execution series, or a published cadence summary"],"id":"recycled-stake-treasury-extraction","indicators":[{"id":"fresh-wallet","label":"Fresh wallet with no prior history","role":"Identity context"},{"id":"bridge-funding","label":"Cross-chain / bridge funding","role":"Funding context"},{"id":"exact-stake-trim","label":"Accumulation trimmed to exact proposal-stake threshold","role":"Eligibility acquisition"},{"id":"stake-recover-reuse","label":"Stake recovered and reused in the decision market","role":"Capital reuse"},{"id":"clustered-cadence","label":"Clustered fixed-size cadence trades","role":"Market execution"}],"name":"Recycled-stake treasury extraction","scopeNote":"This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.","sources":[{"label":"01Resolved — The Umbra treasury attack cost its attacker $4,623","url":"https://01resolved.com/research/the-umbra-treasury-attack-cost-its-attacker-4-623/"}],"status":"monitored","version":"1.0.2"},{"caseStudies":[],"category":"Decision market manipulation","description":"A trader waits out most of the TWAP window, then pushes a marginal print across its threshold in the closing stretch — when the required move is fully known and defenders have the least accrual time left to trade the price back. Late trades carry the least time-weight, so the target is a market already near its threshold, not the TWAP itself. Late activity also has benign forms — organic close-out and activist pressure — so a detector must separate steering from ordinary end-of-window trading.","evidenceRequirements":["Indexed per-trade history with in-window timestamps and each pool's price","TWAP window boundaries, the printed TWAPs and the threshold they were judged against","The selected option and each pool's last price inside the window","The token's ordinary dollar price in the hours after the close"],"id":"late-window-outcome-steering","indicators":[{"id":"late-weight-concentration","label":"Aligned volume concentrated in the closing hours of the TWAP window","role":"Timing"},{"id":"single-trade-fragility","label":"Printed outcome crosses the threshold on one marginal trade","role":"Fragility"},{"id":"thin-closing-move","label":"Closing move toward pass made with little money","role":"Liquidity"},{"id":"after-close-reversal","label":"The token's own price undoes the closing edge after the window","role":"Reversal"},{"id":"spike-clears-configured-threshold","label":"Intra-window spike alone would clear the configured threshold","role":"Threshold pressure"}],"name":"Late-window TWAP outcome steering","scopeNote":"This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.","sources":[{"label":"01Resolved — research index (late-activity taxonomy and signal quality)","url":"https://01resolved.com/research/"},{"label":"MetaDAO documentation (TWAP window mechanics)","url":"https://docs.metadao.fi"}],"status":"monitored","version":"3.0.0"},{"caseStudies":[],"category":"Decision market manipulation","description":"Automated near-neutral flow inflates a market's apparent volume and economic alignment, dressing thin conviction up as broad support while contributing no real position either way. The same fingerprint matches benign arbitrage flow, which published analysis strips as routine; a detector must separate deliberate wash from ordinary arb before it can say anything. So routine conditional arbitrage — one wallet's same-side legs on two options inside the cadence window — is netted out before any indicator is counted, and a wallet's presence on several options' markets counts only with same-pool round trips of at least the minimum turnover beside it. A market may have any number of options; pass and fail are the two of a pass/fail market. Machine cadence, frequency and tilt shift count only for wallets that show wash evidence — such round trips or a near-neutral ending — so a directional bot on a timer is not wash.","evidenceRequirements":["Wallet-attributed trade history across every option's market","Ending exposure per wallet on each option","Per-wallet trade frequency over the market's lifetime","Volume tilt recomputed with the suspect flow removed"],"id":"wash-volume-alignment-inflation","indicators":[{"id":"paired-branch-executions","label":"Executions on more than one option's market from one wallet","role":"Execution symmetry"},{"id":"fixed-size-cluster","label":"Fixed-size trade clusters at machine cadence","role":"Cadence"},{"id":"near-neutral-net","label":"Near-neutral ending exposure despite high turnover","role":"Exposure"},{"id":"arb-frequency-band","label":"Per-wallet trade frequency in the arbitrage band","role":"Frequency"},{"id":"stripped-tilt-shift","label":"Net volume tilt moves materially once the flow is stripped","role":"Alignment distortion"}],"name":"Wash-volume alignment inflation","scopeNote":"This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.","sources":[{"label":"01Resolved — research index (bot detection and strip-the-bot methodology)","url":"https://01resolved.com/research/"},{"label":"01Resolved — platform (Decision Market Analysis Model)","url":"https://www.01resolved.com/"}],"status":"monitored","version":"4.0.0"},{"caseStudies":[],"category":"Economic governance attack","description":"An operator splits stake acquisition or market activity across coordinated wallets so no single address crosses the eligibility thresholds the organization enforces or the attribution thresholds a reviewer watches. Coordination alone is not an attack — multi-wallet holders and coordinated defenders share parts of this shape — so the mechanism is the threshold evasion, not the wallet count.","evidenceRequirements":["Cross-wallet funding graph for the proposal window","First-activity timestamps for each participating wallet","Per-wallet positions measured against the stake requirement","Per-wallet execution series for fingerprint comparison"],"id":"coordinated-multiwallet-stake-assembly","indicators":[{"id":"common-funding-source","label":"Participating wallets linked by funding: one upstream source, or one funded by another","role":"Funding context"},{"id":"synchronized-first-activity","label":"Wallets first active inside a tight shared window","role":"Identity context"},{"id":"split-threshold-assembly","label":"Combined position crosses a stake threshold no single wallet crosses","role":"Eligibility acquisition"},{"id":"shared-execution-fingerprint","label":"Matching trade-size and cadence fingerprint across wallets","role":"Market execution"},{"id":"synchronized-exit","label":"Coordinated exit across the wallet set after resolution","role":"Exit behavior"}],"name":"Coordinated multi-wallet stake assembly","scopeNote":"This classification is scoped to one monitored attack vector, not a validated composite proposal-risk score or a complete claim of safety.","sources":[{"label":"01Resolved — Ownership Score, what the first experiment reveals","url":"https://01resolved.com/research/ownership-score-what-the-first-experiment-reveals/"},{"label":"01Resolved — The Umbra treasury attack cost its attacker $4,623","url":"https://01resolved.com/research/the-umbra-treasury-attack-cost-its-attacker-4-623/"}],"status":"monitored","version":"3.0.0"},{"caseStudies":[],"category":"Decision market manipulation","description":"A governance rule resolves on a TWAP measured over only a short terminal slice of a much longer decision period, on pools that need only clear a published minimum-liquidity floor. The entire resolving window is the closing stretch: the capital needed to own the print is calculable in advance from the floor and the window length, and defenders have no earlier accrual to lean on. Distinct from late-window outcome steering, which targets the tail of a full-length TWAP window — here the rule itself confines every unit of resolving weight to the terminal window. Genuine late information arrival produces the same late repricing, so a detector must separate engineered capture from honest end-of-period discovery.","evidenceRequirements":["The ratified rule: resolving-window length, liquidity floor, and pass condition as published","Pool depth series across the decision period, with full-range liquidity measured against the floor","Per-trade history with timestamps covering pre-window and in-window activity","Post-resolution price series for reversion checks"],"id":"terminal-window-twap-capture","indicators":[{"id":"terminal-only-weight","label":"All resolving TWAP weight accrues in a terminal window that is a small fraction of the decision period","role":"Window structure"},{"id":"floor-hugging-liquidity","label":"Full-range depth sits at or barely above the published liquidity floor","role":"Liquidity"},{"id":"quiet-then-capture","label":"Markets stay quiet until the resolving window opens, then absorb concentrated aligned flow","role":"Timing"},{"id":"in-window-inversion","label":"Pass/fail ordering flips inside the resolving window after holding steady before it","role":"Fragility"},{"id":"post-window-reversion","label":"Prices revert once the terminal window closes and weight stops accruing","role":"Reversal"}],"name":"Terminal-window TWAP capture","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"Kleros KIP-76 — Futarchy-Based Governance Rule for PNK Minting (Snapshot, kleros.eth)","url":"https://snapshot.org/#/kleros.eth/proposal/0xa213179debfca1cb5b8f65ac9d641e6e4e8fb5df480196c909e9ae1ab548daa7"},{"label":"ethresear.ch — Futarchy is insecure without a trusted gatekeeper","url":"https://ethresear.ch/t/futarchy-is-insecure-without-a-trusted-gatekeeper/25235"}],"status":"documented","version":"1.0.0"},{"caseStudies":[],"category":"Governance-signal manipulation","description":"Where a decision market is advisory — its price signal informs a vote or a bound delegate but executes nothing — moving the signal is cheap: no treasury settlement forces the manipulator to hold losing risk, and thin honest flow is the norm. An inflated print then travels as social proof through forums, delegates, and dashboards that cite the market as an endorsement. Honest participants also trade advisory markets at low volume, so a detector must separate manufactured endorsement from a thin but genuine signal.","evidenceRequirements":["The advisory rule as published: what reads the signal, when, and at what threshold","Wallet-attributed trade history across both conditional markets","Timestamps of signal reads or bound-delegate executions against the flow series","Position series after the signal is consumed, for unwind checks"],"id":"advisory-signal-inflation","indicators":[{"id":"stakeless-directional-print","label":"Directional prints arrive without exposure held through the signal read","role":"Exposure"},{"id":"signal-scale-mismatch","label":"Signal-moving flow is trivial against the decision's stated stakes","role":"Capital sizing"},{"id":"read-timed-concentration","label":"Aligned flow concentrates just before the signal is read or a bound delegate executes","role":"Timing"},{"id":"venue-alignment-divergence","label":"Market signal diverges from the venue's own vote and forum alignment","role":"Cross-check"},{"id":"post-read-unwind","label":"Positions unwind once the advisory signal has been consumed","role":"Reversal"}],"name":"Advisory-signal inflation","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"Gnosis forum — GIP-145 futarchy pilot discussion","url":"https://forum.gnosis.io/t/11816"},{"label":"Gnosis forum — futarchist.eth, a delegate bound to the futarchy signal","url":"https://forum.gnosis.io/t/12197"},{"label":"Optimism governance — Futarchy v1 preliminary findings","url":"https://gov.optimism.io/t/futarchy-v1-preliminary-findings/10062"}],"status":"documented","version":"1.0.0"},{"caseStudies":[],"category":"Proposal-priceability failure","description":"A proposer leaves delivery discretionary, defends the pass/fail spread, and performs the promised work only when corrective trading makes continued price defense more expensive than delivery. The market can price the value of the promised work without pricing an enforceable obligation to perform it. This is a candidate mechanism from published threat-model research, not an observed attack finding.","evidenceRequirements":["The proposal's signed delivery obligations, milestones, deadlines, and remedies for non-performance","Wallet-attributed pass/fail executions and proposer funding paths across the decision window","Timestamped delivery evidence measured against corrective market pressure","Enforcement, escrow, slashing, or recovery records after missed obligations"],"id":"resistance-contingent-delivery","indicators":[{"id":"discretionary-delivery-terms","label":"Proposal terms leave value-creating delivery at the proposer's discretion","role":"Delivery terms"},{"id":"pass-defense-before-delivery","label":"Proposer-controlled pass-price defense appears before evidence of delivery","role":"Market execution"},{"id":"resistance-linked-performance","label":"Delivery begins or improves only after corrective sell pressure rises","role":"Contingency"},{"id":"unenforceable-nonperformance","label":"Non-delivery carries no enforceable loss comparable with the proposal benefit","role":"Enforcement"}],"name":"Resistance-contingent delivery","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"LessWrong — Futarchy is insecure without a trusted gatekeeper","url":"https://www.lesswrong.com/posts/oAKsuX5XpPxFSEoHM/futarchy-is-insecure-without-a-trusted-gatekeeper"}],"status":"documented","version":"1.0.0"},{"caseStudies":[],"category":"Proposal-priceability failure","description":"Corrective pass-branch selling is constrained because a spot holder who sells is conditionally exiting the underlying asset, not merely opposing the proposal, while non-holders may lack short access and synthetic sellers bear adverse-selection risk. Mild proposal harm can therefore face less corrective supply than its holder base suggests. This is a candidate market-access mechanism, not evidence that a thin book was manipulated.","evidenceRequirements":["Venue rules for minting, selling, borrowing, or shorting each conditional asset","Holder-attributed pass-branch inventory and reserve-price or order-book depth across the decision window","Synthetic short availability, collateral terms, borrow capacity, and observed utilization","Proposal benefit, estimated holder harm, and corrective flow measured at the configured passage threshold"],"id":"conditional-holder-exit-supply-failure","indicators":[{"id":"holder-only-pass-supply","label":"Pass-branch sell flow is limited to existing holders willing to exit after passage","role":"Participation access"},{"id":"no-synthetic-short-access","label":"Non-holders cannot create pass-branch short exposure","role":"Market access"},{"id":"corrective-flow-below-private-benefit","label":"Corrective flow below the passage threshold is small against the proposer's private benefit","role":"Capital sizing"},{"id":"short-side-adverse-selection","label":"Withheld proposal information creates material adverse-selection risk for corrective sellers","role":"Risk bearing"}],"name":"Conditional holder-exit supply failure","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"LessWrong — Futarchy is insecure without a trusted gatekeeper","url":"https://www.lesswrong.com/posts/oAKsuX5XpPxFSEoHM/futarchy-is-insecure-without-a-trusted-gatekeeper"}],"status":"documented","version":"1.0.0"},{"caseStudies":[],"category":"Proposal-priceability failure","description":"A proposer submits before material proposal-specific uncertainty resolves, so passage selects for favorable-information worlds and the pass price can exceed the fail price even when unconditional approval has negative expected value. The mechanism depends on an unsettled conditional-versus-causal argument and records that causal assumption rather than claiming proof.","evidenceRequirements":["A pre-window inventory of material unresolved proposal facts and their disclosure timestamps","The venue's decision, cancellation, and settlement rule, including any independent randomization","A sourced ex ante value model with favorable and unfavorable proposal-specific branches kept separate","Trade and decision timestamps sufficient to test whether information arrival and passage were coupled"],"id":"proposal-convexity-selection","indicators":[{"id":"material-unresolved-detail","label":"A material proposal-specific fact remains unresolved when the decision window opens","role":"Causal assumption"},{"id":"information-resolves-in-window","label":"The unresolved fact can become known before the market-guided decision executes","role":"Selection timing"},{"id":"favorable-state-passage-coupling","label":"Favorable realizations are mechanically more likely to produce passage","role":"Conditional selection"},{"id":"conditional-unconditional-value-gap","label":"Conditional pass value and ex ante approval value diverge under disclosed assumptions","role":"Value model"}],"name":"Proposal-convexity selection","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"LessWrong — Futarchy is insecure without a trusted gatekeeper","url":"https://www.lesswrong.com/posts/oAKsuX5XpPxFSEoHM/futarchy-is-insecure-without-a-trusted-gatekeeper"},{"label":"LessWrong — Futarchy is Parasitic on What It Tries to Govern","url":"https://www.lesswrong.com/posts/mW4ypzR6cTwKqncvp/futarchy-is-parasitic-on-what-it-tries-to-govern"},{"label":"LessWrong — No, Futarchy Doesn't Have This EDT Flaw","url":"https://www.lesswrong.com/posts/dEoyaWznnKtM5GMnM/no-futarchy-doesn-t-have-this-edt-flaw"}],"status":"documented","version":"1.0.0"},{"caseStudies":[],"category":"Proposal-priceability failure","description":"A proposer withholds value-relevant specification and buys pass exposure, while corrective traders hesitate because the missing terms might conceal either a harmful deal or favorable private information that makes selling costly. The resulting participation gap is a candidate proposal-specification threat, not a classification of every confidential proposal.","evidenceRequirements":["The complete proposal specification and a timestamped history of every material revision or disclosure","Wallet attribution for proposer-linked pass/fail positions and their funding paths","Order-book or execution evidence showing corrective participation before and after disclosure","A sourced scenario analysis of losses to corrective sellers under hidden-good and hidden-bad terms"],"id":"countertrade-adverse-selection-deterrence","indicators":[{"id":"withheld-value-terms","label":"Counterparty, scope, fees, milestones, or performance commitments are withheld","role":"Proposal specification"},{"id":"proposer-pass-accumulation","label":"Proposer-linked wallets accumulate pass exposure while material terms remain hidden","role":"Market execution"},{"id":"hidden-good-loss-dominates","label":"Corrective sellers face larger losses in a plausible hidden-good state than gains in the visible bad state","role":"Adverse selection"},{"id":"late-specification-release","label":"Value-relevant terms arrive only after corrective participation has been deterred","role":"Disclosure timing"}],"name":"Countertrade adverse-selection deterrence","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"LessWrong — Futarchy is insecure without a trusted gatekeeper","url":"https://www.lesswrong.com/posts/oAKsuX5XpPxFSEoHM/futarchy-is-insecure-without-a-trusted-gatekeeper"}],"status":"documented","version":"1.0.0"},{"caseStudies":[],"category":"Proposal-priceability failure","description":"A proposer credibly commits to withdrawing support, liquidity, or another dependency if rejected, making the fail branch worse until accepting an otherwise harmful proposal becomes the locally higher-priced outcome. The candidate mechanism concerns branch independence and commitment, not proof that an observed fail discount was retaliation.","evidenceRequirements":["The proposal, communications, and contracts establishing any rejection-contingent action","Evidence that the proposer controls the threatened dependency and can execute the harm","Timestamped conditional-market prices around the threat's disclosure and credibility changes","Sourced estimates of proposer cost, organization loss, legal recourse, and repeated-game penalties"],"id":"fail-branch-sabotage","indicators":[{"id":"rejection-contingent-threat","label":"A proposer-controlled harm is explicitly or implicitly contingent on rejection","role":"Branch independence"},{"id":"credible-sabotage-capability","label":"The proposer controls a dependency capable of imposing the threatened harm","role":"Capability"},{"id":"fail-discount-tracks-threat","label":"The fail-branch discount appears with or strengthens after the threat","role":"Market response"},{"id":"off-path-private-cost-gap","label":"The proposer's off-path cost of carrying out the threat is smaller than the organization's loss","role":"Incentive"}],"name":"Fail-branch sabotage","scopeNote":"This vector is documented, not monitored: its detector has not shipped, so it never produces a classification. The definition records the mechanism and the evidence a detector would need first.","sources":[{"label":"LessWrong — Futarchy is insecure without a trusted gatekeeper","url":"https://www.lesswrong.com/posts/oAKsuX5XpPxFSEoHM/futarchy-is-insecure-without-a-trusted-gatekeeper"}],"status":"documented","version":"1.0.0"}]}