Matrix
Every OAK Tactic with the Techniques filed under it — 154 Techniques across 17 Tactics.
OAK-T1 Token Genesis
- OAK-T1 — Tactic overview — Pre-launch / Launch
- OAK-T1.001 Modifiable Tax Function
- OAK-T1.002 Token-2022 Permanent Delegate Authority
- OAK-T1.003 Renounced-But-Not-Really (Proxy-Upgrade Backdoor)
- OAK-T1.004 Blacklist / Pausable Transfer Weaponization
- OAK-T1.005 Hidden Fee-on-Transfer
- OAK-T1.006 Honeypot-by-Design
- OAK-T1.007 Token-2022 Transfer-Hook Abuse
OAK-T10 Bridge and Cross-Chain
- OAK-T10 — Tactic overview — Targeted compromise
- OAK-T10.001 Validator / Signer Key Compromise
- OAK-T10.002 Message-Verification Bypass
- OAK-T10.002.001 Off-chain Observer Source-Event Forgery
- OAK-T10.003 Cross-Chain Replay
- OAK-T10.004 Optimistic-Bridge Fraud-Proof Gap
- OAK-T10.005 Light-Client Verification Bypass
- OAK-T10.006 Cross-Chain Governance Relay Attack
- OAK-T10.007 Bridge Validator Economic-Incentive Misalignment
- OAK-T10.008 Bridge Observer Signature Scope Truncation
- OAK-T10.009 Cross-Chain Token Configuration-Role Capture
OAK-T11 Custody and Signing Infrastructure
- OAK-T11 — Tactic overview — Targeted compromise
- OAK-T11.001 Third-Party Signing-Vendor UI / Signing-Flow Compromise
- OAK-T11.002 Wallet-Software Distribution Compromise
- OAK-T11.003 In-Use Multisig Smart-Contract Manipulation
- OAK-T11.004 Insufficient-Entropy Key Generation
- OAK-T11.005 Operator-side Fake-Platform Fraud
- OAK-T11.005.001 Fake-CEX / Pig-Butchering Platform
- OAK-T11.005.002 Fake-Custodian / Fake-Asset-Manager Fraud
- OAK-T11.005.003 Compound-Operated Investment-Fraud Platforms
- OAK-T11.006 Cold-storage Seed-phrase Exfiltration at Rest
- OAK-T11.006.001 User-Initiated Plaintext-Equivalent Seed Storage
- OAK-T11.006.002 Implicit Cloud-Custody via Default-On Cloud-Backup
- OAK-T11.007 Hardware-wallet Supply-chain / Physical-access Compromise
- OAK-T11.007.001 Counterfeit-Hardware Substitution
- OAK-T11.007.002 Physical-Access Hardware-Side Seed Extraction
- OAK-T11.007.003 Brand-Trust-Leveraged Active Phishing for Seed-Phrase Exfiltration
- OAK-T11.008 Embedded-Wallet Identity-Provider Compromise
- OAK-T11.009 Trader-Tooling Supply-Chain Compromise targeting `.env` Private Keys
- OAK-T11.010 Off-chain Counterparty-Risk Insolvency
- OAK-T11.011 Multi-chain Key-store Co-location
- OAK-T11.012 Server-side Raw Private-Key Storage (Custodial Trading-Bot Anti-pattern)
- OAK-T11.013 Legacy-Version Maintenance Attack Surface
OAK-T12 NFT-Specific Patterns
- OAK-T12 — Tactic overview — Realization
- OAK-T12.001 NFT Wash-Trade Volume Inflation
- OAK-T12.002 Fake-Mint / Counterfeit Collection
- OAK-T12.003 Royalty Bypass / Marketplace Manipulation
- OAK-T12.004 Timelock-Free Protocol Upgrade Execution (DEPRECATED)
- OAK-T12.005 Flash-Loan Governance Vote Manipulation (DEPRECATED)
- OAK-T12.006 NFT-Collateral Lending Manipulation
- OAK-T12.007 Mint-Outcome Reroll (Revert-Until-Rare)
- OAK-T12.008 Hybrid Fungible / Non-Fungible Standard Accounting Divergence
OAK-T13 Account Abstraction Attacks
- OAK-T13 — Tactic overview — Targeted compromise
- OAK-T13.001 Paymaster Compromise
- OAK-T13.001.001 Paymaster Accounting Drain
- OAK-T13.001.002 Paymaster Policy Bypass
- OAK-T13.001.003 Paymaster Reentrancy
- OAK-T13.001.004 Paymaster Griefing
- OAK-T13.002 Bundler MEV
- OAK-T13.003 Session-Key Hijacking
- OAK-T13.004 EIP-7702 Delegation Abuse
OAK-T14 Validator / Staking / Restaking Attacks
- OAK-T14 — Tactic overview — Targeted compromise
- OAK-T14.001 Slashing-Condition Exploit
- OAK-T14.002 MEV-Boost Relay Attack
- OAK-T14.003 Restaking Cascading Risk
- OAK-T14.003.001 LST/LRT Depeg-Cascade as Constrained-Primitive Sub-class
- OAK-T14.004 Liquid Restaking Token Pricing Manipulation
- OAK-T14.005 Builder Censorship MEV Extraction
- OAK-T14.006 Validator/Proposer Liveness-Fault Griefing
OAK-T15 Off-chain Entry-Vector / Pre-Positioning
- OAK-T15 — Tactic overview — Pre-positioning
- OAK-T15.001 Social Engineering of Operator Personnel
- OAK-T15.002 Supply-Chain / Vendor-Pipeline Compromise
- OAK-T15.003 Operator-Endpoint Compromise (Developer Workstation / Signing Machine)
- OAK-T15.004 Operator-Side Credential Compromise (SSO / Cloud / Registrar / DNS / Package Registry)
- OAK-T15.005 Operator-Communication-Channel Takeover (Discord / X / Telegram)
- OAK-T15.006 Impersonation via Verified Social-Account Compromise
OAK-T16 Governance / Voting Manipulation
- OAK-T16 — Tactic overview — Realization
- OAK-T16.001 Vote Takeover via Flash-Loan
- OAK-T16.002 Hostile-Vote Treasury Drain
- OAK-T16.003 Delegation-Cluster Vote Takeover
- OAK-T16.004 Snapshot / Off-chain Voting Exploitation
- OAK-T16.005 Malicious Proposal Snowballing
- OAK-T16.006 Timelock-Free Governance Execution
OAK-T17 Market Manipulation
- OAK-T17 — Tactic overview — Realization
- OAK-T17.001 Cross-Venue Arbitrage-Driven Price-Discovery Distortion
- OAK-T17.002 Liquidation-Cascade Engineering
- OAK-T17.003 Spoofing / Cancel-Flood Order-Book Manipulation
- OAK-T17.004 TWAP / Time-Window Manipulation Against DAO Treasury / Vesting Math
- OAK-T17.005 TWAP Oracle Manipulation via Multi-Block MEV
OAK-T2 Liquidity Establishment
OAK-T3 Holder Capture
- OAK-T3 — Tactic overview — Pre-launch / Launch
- OAK-T3.001 Sybil-Bundled Launch
- OAK-T3.002 Wash-Trade Volume Inflation
- OAK-T3.003 Coordinated Pump-and-Dump
- OAK-T3.004 Influencer-Amplified Promotion-and-Dump
- OAK-T3.005 Fake-Validator Staking-Frontend Phishing
- OAK-T3.006 Insider Multi-Vector Supply Extraction
OAK-T4 Access Acquisition
- OAK-T4 — Tactic overview — Targeted compromise
- OAK-T4.001 Permit2 Signature-Based Authority Misuse
- OAK-T4.002 Compromised Front-End Permit Solicitation
- OAK-T4.003 Address Poisoning
- OAK-T4.004 Allowance / Approve-Pattern Drainer
- OAK-T4.005 `setApprovalForAll` NFT Drainer
- OAK-T4.006 WalletConnect Session Hijack
- OAK-T4.007 Native-app Social Phishing on Engagement-Weighted Platforms
- OAK-T4.008 Fake-DEX Clone-Frontend Phishing
- OAK-T4.009 Pre-token Brand-Anticipation Phishing
- OAK-T4.010 Fake Security-Tool / Browser-Extension Phishing
- OAK-T4.011 Push-Notification Infrastructure Compromise
- OAK-T4.012 Clipboard-Hijacker (Clipper) Address Substitution
- OAK-T4.013 Endpoint Infostealer Wallet-Material and Credential Exfiltration
OAK-T5 Value Extraction
- OAK-T5 — Tactic overview — Realization
- OAK-T5.001 Hard LP Drain
- OAK-T5.002 Slow LP Trickle Removal
- OAK-T5.003 Hidden-Mint Dilution
- OAK-T5.004 Sandwich / MEV Extraction
- OAK-T5.005 Treasury-Management Exit
- OAK-T5.006 Vesting Cliff Dump
- OAK-T5.007 Third-party Brand-impersonation Custodial Soft-rug
- OAK-T5.008 Ransomware Extortion Payment
- OAK-T5.009 Physical-Coercion Extraction (Wrench Attack)
OAK-T6 Defense Evasion
- OAK-T6 — Tactic overview — Cross-cutting
- OAK-T6.001 Source-Verification Mismatch
- OAK-T6.002 Fake Audit-Claim
- OAK-T6.003 Audit-of-Different-Bytecode-Version
- OAK-T6.004 Audit-Pending Marketing Claim
- OAK-T6.005 Proxy-Upgrade Malicious Switching
- OAK-T6.006 Counterfeit Token Impersonation
- OAK-T6.007 Trust-substrate Shift / Vendor-side Promise Revocation
- OAK-T6.008 Verified-but-Malicious Frontend Routing
OAK-T7 Laundering
- OAK-T7 — Tactic overview — Post-extraction
- OAK-T7.001 Mixer-Routed Hop
- OAK-T7.002 CEX Deposit-Address Layering
- OAK-T7.003 Cross-Chain Bridge Laundering
- OAK-T7.004 NFT Wash-Laundering
- OAK-T7.005 Privacy-Chain Hops
- OAK-T7.006 DeFi Yield-Strategy Laundering
- OAK-T7.007 DEX Aggregator Routing Laundering
- OAK-T7.008 Stablecoin Issuer Freeze-Asymmetry Laundering
- OAK-T7.009 Sanctioned-Entity and Illicit-Purpose Financing
- OAK-T7.010 Travel Rule Evasion
OAK-T8 Operator Continuity / Attribution Signals
- OAK-T8 — Tactic overview — Post-extraction
- OAK-T8.001 Common-Funder Cluster Reuse
- OAK-T8.002 Cross-Chain Operator Continuity
- OAK-T8.003 On-Chain Transaction Graph De-Anonymization
- OAK-T8.004 Exchange Account Farming / Sybil Account Creation
- OAK-T8.005 Operational Security Procedural Failure (Non-Technical OpSec)
OAK-T9 Smart-Contract Exploit
- OAK-T9 — Tactic overview — Realization
- OAK-T9.001 Oracle Price Manipulation
- OAK-T9.002 Flash-Loan-Enabled Exploit
- OAK-T9.003 Governance Attack
- OAK-T9.004 Access-Control Misconfiguration
- OAK-T9.005 Reentrancy
- OAK-T9.006 Subjective-Oracle Resolution Manipulation
- OAK-T9.006.001 DVM Vote Capture by Economically-Interested Holder
- OAK-T9.006.002 Resolution-Spec Ambiguity Exploitation
- OAK-T9.006.003 Off-chain Resolution-Source Coercion
- OAK-T9.006.004 Operational-Insider Trading on Subjective-Resolution Prediction Markets
- OAK-T9.006.005 Platform-Override of Oracle Outcome
- OAK-T9.007 Fork-Substrate Vulnerability (Not Mitigated at Fork Time)
- OAK-T9.008 Diamond-Pattern Facet-Audit Incomplete
- OAK-T9.009 Cross-Contract Reinitialization Attack
- OAK-T9.010 Read-Only Reentrancy
- OAK-T9.011 Precision-Loss Rounding Attack
- OAK-T9.012 Initial Liquidity Sandwich Attack
- OAK-T9.013 Slippage-Manipulation Sandwich Attack
- OAK-T9.014 Protocol-Client Consensus Bug
- OAK-T9.015 Degenerate-Input Signature-Verification Bypass