Wave 1 — State & Time
Leverage the in-memory history window. Stateless rules fail here.
WASH_TRADE — same user BUY+SELL, same market/price, ≤3s window
VELOCITY_SPAM — ≥15 orders/user in 1.0s
GEO_JUMP — country change <10s apart
Wave 2 — Payload Exploits
Inspect properties for math anomalies & signature forgery.
FLOAT_EXPLOIT — price/qty exceeds 4 decimal places
OVERFLOW_ATTACK — value > MAX_SAFE_INTEGER
INVALID_SIGNATURE — SHA256 mismatch
Wave 3 — Coordinated Sybils
Correlate across accounts. Final stretch — leaderboard goes to top-3 spotlight.
SYBIL_PUMP — ≥4 users, same market/price/qty, same ms
CHRONO_BOT — deterministic 30.00s ± 5ms interval
FRONT_RUN — block buy ≥5000 qty, 5ms after micro-deposits