venglov / funding-laundering-detector Goto Github PK

While Doing the Thoreum Attack analysis i discovered that this bot didn't detect a deposit in tornado cash for laundering purpose in BSC,

Check this transaction:

https://bscscan.com/tx/0xb3b11704cf158dd5bc1f2a331872e9b8bf3cafa1cd686f4c212405b4ec225a5c

Also did a quick scroll over 1000 alerts and no one is from BSC, is working for that chain?

Another problem i saw is that there are some errors from the API to get the price in USD of the tokens, maybe is that?

10 - 0x067c8B676e306A6bfB6085E5203D594f29162CD0 - 2023-02-02T19:23:00Z
----------------------------------------------------------------------
2023-02-02T19:12:01.254239800Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:12:10.654197338Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:12:25.871843073Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:12:38.775090005Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:12:57.953129533Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:13:17.198844253Z Error trying to get the tokens using Gecko API: string indices must be integers
....
2023-02-02T19:22:24.194177609Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:22:25.289008071Z Error trying to get the tokens using Gecko API: string indices must be integers
2023-02-02T19:23:30.256715641Z Error trying to get the tokens using Gecko API: string indices must be integers

https://alerts.forta.network/logs/agents/0x186f424224eac9f0dc178e32d1af7be39506333783eec9463edd247dc8df8058

https://explorer.forta.network/alert/0xeaa5e2806d708176aaccd172bb427aa6937238d80a85bd1a7cebe7f67c56f481

Description claims the account used a DEX (pointing to the attacker EOA)
Should state funds laundered via a bridge

Because of the issue funding stage of the Rubic Exploit wasn't detected
https://etherscan.io/tx/0x6fae68bae0b74547a0f585712c29922ed5ae397bbe9abfea2f57ae294c7b47d1

Also, the laundering stage was missed

https://etherscan.io/tx/0x1adb569f1c4538a7f715876a18e560891cfb4e59577be7c9b719dddb335f6da8 - Money Laundering Tx

https://etherscan.io/tx/0x00966dafe1dd77e4599481988ddb9e1ea76c60e49c79c6e94381e95c98ba74ec - Funding Tx

Hi venglov,

I have been watching the performance for this bot for the month of April and it looks like it has a high number "tx_drops" for BSC chain, this issue might be also extending to the rest of the chains. I would appreciate if you can check it out, and consider sharding as a potential solution to mitigate this.

The bot did not trigger on an attack in which two accounts were funded by Railgun mixer.

Accounts:
https://etherscan.io/address/0x71FcbB262A622B9EC964Cc8787EB026E533f424b
https://etherscan.io/address/0xd4e10ce89c944771fb1ff173bf3b6557c692ef0d

Hi Venchyslav,

The scam detector feed alerted an address that have executed social engineering phishing. Here the alerts: https://explorer.forta.network/alert/0x3038990b2ab454db55acf27415eab787fe5185739caba1d6787fd3e7c58ad359
This address laundered funds through secret bridge, however this bot did not trigger any alert. I was wondering if you could take a closer look and mitigate this FN.

Thanks!

Bot didn't detect 10 ETH deposit in tornado cash in mainnet

https://etherscan.io/tx/0x2057cd5dee98b18423e07399fd9deb61d12c177f8fc6c2d4c98f8ae71fe16f9b