forta-network / starter-kits

MIT License
64 stars 38 forks source link

Flashloan Detection - FP #612

Open Olugbenga2000 opened 5 months ago

Olugbenga2000 commented 5 months ago

Attacker - 0x3a469906ae33b0d738be5751fc3094cc60d755dd
AD alert - https://app.forta.network/alerts/0xd39fb39a15b28f4803dc8b4c289be938740ca04b027f250a8df3a69cd01e67dd Base bots - Ice Phishing Bot and Flashloan Detection Bot Potential cause - Alerts for arbitrage txs Flashloan alerts - https://app.forta.network/alerts/0xdb5e08fcc3ceedee24d142693adf20179df961ec68c407a1962268a1b114f4ae https://app.forta.network/alerts/0xc2b34fff7284019e8537749322813c9884bbf26145a160ffd2205ad6dfab507f

Vxatz commented 5 months ago

Fixed by adding a profit threshold check even for the standard alert. Copying the reasoning from the PR description:

Notes: 1) Attack Detector is subscribed to both Flashloan detector alerts (FLASHLOAN-ATTACKand FLASHLOAN-ATTACK-HIGH-PROFIT) without making any distinction between them 2) The profits in the flashloan alerts of the issue were very low ($20 and $32)

Instead of trying to exclude arbitrage transactions (which would be quite an elaborate change), I suggest integrating a profit threshold check even for the "standard" FLASHLOAN-ATTACK alert (set at $1000) to reduce the number of standard alerts (thereby also reducing AD FPs).

If the issue persists, we might then consider unsubscribing from the standard alert (and perhaps lower the threshold of the "high profit" flashloan alert at the same time)