tf0rs/forta-address-poisoning-agent

Detecting address poisoning transactions on EVM chains

forta-address-poisoning-agent's Issues

High number of drops for April

Hi tf0rs,

I have been watching the performance for this bot for the month of April and it looks like it has a high number "tx_drops" for BSC chain, this issue might be also extending to the rest of the chains. I would appreciate if you can check it out, and consider sharding as a potential solution to mitigate this.

FN: spam token address poisoning

Pls see https://etherscan.io/tx/0x4e23ab22ae7dbe87e5d2b36e66845908e8e88700ec8ee1a782717efa352cbcfe

Trevor, can we pull this into scope?

FP issues - Address poisoner

Hi trevor,

I am still seeing issues for this bot. Let me describe you what I have observed:

• It seems that the "Address poisoner" is flagging addresses which have minted a specific collection of NFTs called lawless: https://etherscan.io/token/0xb119ec7ee48928a94789ed0842309faf34f0c790
• For instance, these three alerts correspond to three different addresses which have minted the collection I have mentioned above:
  https://explorer.forta.network/alert/0x58e90f35813f190668009f5e7b909ac4202a2f985f663a9e76310de13811ea33
  https://explorer.forta.network/alert/0xeb26f3b4ed4387d615366ddfd129b37d767009edf33efb7050f894ea1431da82
  https://explorer.forta.network/alert/0x0d533ebf8f6d212e8be9157a6020971ab9e93d1d36b8361b4d4332e90a535ba3
  Note: these alerts fired after you fixed the bot.

FN on tx 0x6a4652daf2fea023e7bcecd42d3485f4da0321bbc22a0c93670e8416292860bd

Tested locally and got no alerts as well.

FP issue - Address poisoning

Hi Trevor,

The address poisoner label seems to be flagging addresses that indeed are executing a revoke scam.

e.g:
https://explorer.forta.network/alert/0x0cb5ed9bb3ba81b877ed01c5cce54563b251adba0af9342dcda166c0f40be2e5
https://bscscan.com/txs?a=0x1b162ce9a63eb81ee1ebae82ed1497092c50208a

e.g2:
https://explorer.forta.network/alert/0x18c5f777b4ec3fc58d244a2acc427ed2b347acdb4158a4a482093a57020553da
https://bscscan.com/address/0xe8e0960da069c336852246a5bedf18ad05ea25e7

It would be great if the bot could be tweaked so when these types of activities happen, the address could be categorized with another label.

True positive issues

I have reviewed some alerts for the month of April and saw a bunch of alerts that from my assessment they shouldn't be considered as TP.
It seems that the bot is firing every time there's a bulk transaction.
E.g: 0xdead5755e7c08d537834933498b2841e071fe349 was flagged as an address poisoner address.
Forta alert: https://explorer.forta.network/alert/0x8154ff181646eee2769faf9108c2c456a7fc2763f903a245867871c861592b6c
Scan link: https://etherscan.io/address/0xdead5755e7c08d537834933498b2841e071fe349

e.g2: 0xa3096ecc4ae1ab833e3f54fbf371873211822b41 was flagged as an address poisoner address.
Forta alert: https://explorer.forta.network/alert/0x52a3bc412ca246c3ff780c3ae48b470525a5d7771b19d77b13909ae1b3d45b80
Scan link: https://etherscan.io/address/0xa3096ecc4ae1ab833e3f54fbf371873211822b41

Both cases alerts seem to trigger right after the "bulk transfer"

FN issue

Hi Trevor,

Opening an issue in order to tackle the following FN. This transaction was not picked up by the address poisoning bot https://etherscan.io/tx/0xd65b7f9b1497a5e2afaf65b36d3d6f111de8c888b6db4be94b5eace359e2d491

Wondering if something should be tweaked in order to have caught it.

FP: incorrect attacker identification

https://explorer.forta.network/alert/0xf213a1f913e5de30902020c8bda4192d7b16069e4fa82c2b5db083a4070ff359

0x5f1a7b7e5d899e0379d0e536e3de825b73676a9c isnt the attacker address. Seems like neither the sender nor recipient is the actual attacker, but rather just the contract?

FP issues - Address poisoning

Hi there,

For some reason there were a bunch of FPs for the week that has passed.
Attaching some examples:

1. Alert here
2. Alert here
3. Alert here

Seems that it is coming from the fake token which is labeling addresses that are receiving transfers from coinbase.

Thanks!