FN - Tornado cash

[Ivan1905]

Hi @Vxatz:

I wanted to ask about this FN of tornado cash funding.

• Exploit transaction: https://bscscan.com/tx/0xde59f5bd65e8f48e5b6137a3b4251afbb9b6240d1036fa6f030e21ab6d950aac
• Attacker was funded by TC in several opportunities: https://bscscan.com/address/0x65bba34c11add305cb2a1f8a68cecbd6e75089cd#internaltx
• For some reason I ain't see any TC alert: https://app.forta.network/alerts?agents=0xa91a31df513afff32b9d85a2c2b7e786fdd681b3cdd8d93d6074943ba31ae400&limit=15&sort=desc&text=0x65bBA34C11aDd305cB2A1f8A68ceCbd6E75089Cd

[Ivan1905]

Same here:

• Exploit transaction: https://bscscan.com/tx/0x86262260db802b391d61d1034f7fbd3571c06208a22dc6b914cacae7165003ed
• Attacker was funded by tx a while ago: https://bscscan.com/address/0xb60bc196e0e62b090ff67aa0ab77d159bd707e57#internaltx

[Vxatz]

@Ivan1905, in both cases I'm getting an alert locally, which makes me think it's a network issue (often happens with BSC nodes I'd say)

One note is that after an account initiates one transaction, it's not considered "new" anymore, so there would be no alert for future funding txs

[Ivan1905]

"One note is that after an account initiates one transaction, it's not considered "new" anymore, so there would be no alert for future funding txs"

What happens when the funding transaction from TC is not new? does it receive a lower score? or it does not fire?

I see that for first case the address received native tokens from an EOA, then was funded by TC. Finally deployed the contract and invoke it.

What would happen for such case?