OAK — OnChain Attack Knowledge

Document

OAK Backlog — auto-generated

Generated by tools/build_backlog.py on 2026-08-28. Regenerated on every npm run site:data.

Scope: 687 worked examples, 154 Techniques, 19 Threat Actors.

This file is a prioritized contributor backlog. P0 items close hard structural gaps (empty Tactics, placeholder actor cards). P1 items lift per-Tactic coverage below the documented minimum. P2 items anchor candidate sub-Techniques from TAXONOMY-GAPS.md.

Before researching a candidate incident, run python3 tools/check_known.py "<description>" to avoid duplicating an existing entry.

P0 — empty Tactics × active years

Each (Tactic, year) cell below has zero documented incidents despite the Tactic being active in that year. Closing these is the highest leverage for matrix completeness.

  • no empty cells in active years

P0 — actor profiles without attributed incidents

  • all actor cards have at least one attributed example

P0 — sub-Techniques without canonical anchor

  • all non-deprecated sub-Techniques have at least one referencing example

Excluded from this section: 2 deprecated Technique(s) with zero referencing examples (OAK-T12.004, OAK-T12.005). For a deprecated Technique that is the intended end state, not a gap.

P1 — Tactics under per-year minimum coverage

Tactics where the documented incident count for an active year falls below the target threshold (see COVERAGE-TARGETS.md).

  • T1 × 2021 (Token Genesis) — 4 / target ≥5
  • T1 × 2026 (Token Genesis) — 2 / target ≥5
  • T2 × 2026 (Liquidity Establishment) — 1 / target ≥3
  • T13 × 2026 (Account Abstraction) — 2 / target ≥3
  • T14 × 2026 (Validator / Staking) — 2 / target ≥3

P2 — TAXONOMY-GAPS candidates without an example anchor

Sub-Technique IDs proposed in TAXONOMY-GAPS.md but not yet referenced by any worked example. Promoting these to emerging requires at least one anchor case.

  • OAK-T11.011.001 — proposed in TAXONOMY-GAPS, 0 referencing examples
  • OAK-T15.007 — proposed in TAXONOMY-GAPS, 0 referencing examples
  • OAK-T9.011.001 — proposed in TAXONOMY-GAPS, 0 referencing examples
  • OAK-T9.015.001 — proposed in TAXONOMY-GAPS, 0 referencing examples

How to claim an item

  1. Pick a P0 / P1 / P2 line item that matches your research interest.
  2. Run python3 tools/check_known.py "<incident description>" against your candidate to confirm it isn't already documented.
  3. Open a GitHub issue with the line item title (e.g. [backlog] T13 × 2024 — paymaster compromise candidate) so others can see what's claimed.
  4. Submit a PR per CONTRIBUTING.md. The PR template has a Checklist that runs the validators locally.