Which chains fail the same way
Twenty-eight of the 118 techniques we have reproduced appear on more than one chain. The registry could always report that number. It could not show you its shape, because a coverage matrix has cells and not adjacency: it tells you that Ethereum and Solana each have a mark against a given technique, but it never draws the line between them. This week we published the line.
The chain graph at nrdax.com/graph joins two networks when the same technique has been reproduced against both. Ethereum, Solana and Sui each share four techniques with one another. Bitcoin and Zcash share three. Read as a map of where to look next, it is genuinely useful: if you operate one of these networks, an incident on the network at the other end of a thick line is probably worth reading.
The chain graph at nrdax.com/graph. Nodes are chain deployments, edges are techniques reproduced against both ends.
Most of the connections are an artefact
The full projection has 149 chain pairs, and that number flatters itself badly. Only 20 of them carry more than one technique. The rest are single findings, and a single finding is not a relationship between two chains so much as a consequence of arithmetic: a technique reproduced on N chains draws a line between every possible pair of them, which is N*(N-1)/2 lines from one piece of evidence. Two techniques in our registry touch nine chains each. Between them they manufacture 72 of the 149 edges on screen.
So the page opens on the filtered view, showing only pairs backed by at least two independent techniques. The unfiltered version is one click away and says plainly in its caption why it looks more connected than it is. A dense web is what you get when a couple of broad techniques fan out, and presenting that as structure would be the visual equivalent of counting the same result twice.
A chain is a deployment, not an implementation
The harder problem is one a graph makes worse before it makes it better. An edge between two networks invites the reading that a weakness has been shown against two independent systems. Often it has not, because the two networks are running the same code under different names.
NRDAX-T0100 is the case that taught us this. Nine chain deployments carry it, which reads as broad, independent confirmation. Curating the lineage collapses those nine into four handshake stacks: three of them are go-ethereum derivatives sharing an unmodified RLPx handshake, four embed go-libp2p and share its Noise handshake, one is a Rust reimplementation written independently of the others, and one is Solana's TPU QUIC transport. Nine deployments, four implementations. The recurrence claim was still real, and it was less than half as strong as the count implied.
We have curated that lineage for exactly one technique out of 426. That is the honest state of it. Every other edge on the graph is a statement about deployments, which is an upper bound on independence and never a measurement of it, and the page says so under the diagram rather than leaving the picture to imply otherwise.
What we chose to publish
There is a third view on the page that draws one line per reproduction we actually ran, 95 of them, with nothing inferred and nothing derived. It is the least striking of the three and the only one that makes no claim beyond what was measured. We kept it because the discipline that produced the registry is the same discipline that has to survive its visualisation. Every edge in the projection is computed from the same published instances the API serves; nothing is stored, nothing is smoothed, and the layout is seeded so the same registry draws the same picture on every build.
The gap the graph exposes is the useful output. Three hundred and eight of our 426 published techniques have no reproduction on any chain at all, and lineage is curated for one. Those are not embarrassments to be hidden behind a nicer diagram. They are the next quarter of work, and now they are visible to anyone who looks.
Related Posts
NRDAX: browsable by chain and family, readable by machines
NRDAX now holds 623 techniques across 64 chains, 162 reproduced with bundles. New per-chain and per-family landing pages, a pretty Atom feed, JSON and STIX 2.1 and knowledge-pack distributions surfaced for machines, and a fix for the first_seen date bug.
NRDAX now includes known-but-not-reproduced techniques
NRDAX v0.1-import now contains 368 techniques across 21 chains: 140 with reproduced instances and bundles, and 228 known from public disclosures (CVEs, GHSAs, vendor advisories) but not yet reproduced in the lab. A CVE maps to its technique even when no bundle exists yet.
NRDAX: the canonical technique registry for decentralized infrastructure attacks
We have published NRDAX, the NullRabbit Decentralised Attack indeX, at nrdax.com. It is the reference registry for attack techniques against decentralized infrastructure: 135 chain-agnostic techniques, grouped into mechanism families, with a coverage matrix across 21 chains.
