Summary
The expanded adversarial smoke test (111-script corpus, 2026-04-28) surfaced a coherent new attack class spanning 8 distinct b-scripts where the bytes are valid but the durable on-chain object they bind to is attacker-controlled.
Class members
| Script |
Durable object |
Attack |
| b040 |
Solana validator vote pubkey |
100%-commission / superminority validator |
| b044 |
TRON Super Representative |
Brand-name spoof / base58 swap |
| b053 |
Compound v3 Comet |
Wrong-Comet routing for borrowed asset |
| b055 |
Morpho Blue marketId |
Permissionless market with adversarial oracle/IRM/LLTV |
| b059, b060 |
MarginFi bank pubkey, dest ATA |
Lookalike bank, hijacked destination ATA |
| b063 |
Uniswap V3 LP tokenId |
Attacker-owned position injected into enumeration |
| b098 |
BTC multisig xpub |
Attacker xpub embedded as "co-signer" |
| a086, b118 |
Token-allowance row (which spender to revoke) |
Reverse-revoke distraction |
Why existing invariants miss it
Bytes-level Invariants #1, #2, #6, #11 all pass — the prepared transaction is structurally valid. The fraud is in which durable object the bytes reference. Inv #13 (proposed in #450) addresses the approval-set special case, but doesn't generalize to validators, SRs, markets, LP tokenIds, xpubs, etc.
Proposed Invariant #14
For any operation that binds funds to a durable on-chain object selected from a multi-candidate set, the agent MUST:
-
Source the candidate identifier from an authority outside the MCP's enumeration. Examples: validators.app for Solana validators, app.morpho.org for Morpho marketIds, on-chain ownerOf(tokenId) for LP NFTs, user's own paste of xpub from device backup.
-
Surface the candidate verbatim with provenance to the user before the prepare call. CHECKS PERFORMED block must include the source authority and the full identifier (no truncation).
-
Re-decode and byte-equality-check the identifier in the prepared bytes against the user-confirmed candidate. Refuse on any mismatch.
Generalizes Inv #13. Complements #1, #11, #12. The op classes covered should be added to Invariant #12.5's hard-trigger ops list (file #455 / tracker #456).
Source
Adversarial smoke-test (crypto-security-smoke-test skill), 2026-04-28. 111-script corpus. Findings at /Users/s/dev/test_mcp/smoketest-adversarial/findings_adversarial_full.md.
🤖 Generated with Claude Code
Summary
The expanded adversarial smoke test (111-script corpus, 2026-04-28) surfaced a coherent new attack class spanning 8 distinct b-scripts where the bytes are valid but the durable on-chain object they bind to is attacker-controlled.
Class members
Why existing invariants miss it
Bytes-level Invariants #1, #2, #6, #11 all pass — the prepared transaction is structurally valid. The fraud is in which durable object the bytes reference. Inv #13 (proposed in #450) addresses the approval-set special case, but doesn't generalize to validators, SRs, markets, LP tokenIds, xpubs, etc.
Proposed Invariant #14
For any operation that binds funds to a durable on-chain object selected from a multi-candidate set, the agent MUST:
Source the candidate identifier from an authority outside the MCP's enumeration. Examples: validators.app for Solana validators, app.morpho.org for Morpho marketIds, on-chain
ownerOf(tokenId)for LP NFTs, user's own paste of xpub from device backup.Surface the candidate verbatim with provenance to the user before the prepare call. CHECKS PERFORMED block must include the source authority and the full identifier (no truncation).
Re-decode and byte-equality-check the identifier in the prepared bytes against the user-confirmed candidate. Refuse on any mismatch.
Generalizes Inv #13. Complements #1, #11, #12. The op classes covered should be added to Invariant #12.5's hard-trigger ops list (file #455 / tracker #456).
Source
Adversarial smoke-test (crypto-security-smoke-test skill), 2026-04-28. 111-script corpus. Findings at
/Users/s/dev/test_mcp/smoketest-adversarial/findings_adversarial_full.md.🤖 Generated with Claude Code