Offchain Bugs, Onchain Losses: The Dependencies Two Hops Away

This week PHP shipped urgent fixes for two critical, unauthenticated remote code execution flaws rated 9.2 on CVSS v4.0, which researchers named "PHP2Shell" (PHP advisory). The same day, LiteLLM pulled 1.107.0, a malicious release on PyPI and Docker that stole credentials, its second compromise this year after 1.82.7 and 1.82.8 in March (LiteLLM incident report). Both are off-chain bugs, and both sit where crypto teams run code every day. A flaw like PHP2Shell gives an attacker code execution on any server running PHP, such as a protocol's website or API: enough to change what visitors see or read the keys stored there. A credential-stealing release like LiteLLM 1.107.0, installed on a developer laptop or a CI runner, hands over the keys and tokens on that machine, including any deployer or admin keys kept there. Either can end in an onchain loss.

Your position depends on what its dependencies depend on

A position depends on its contracts and oracle, and on what those depend on: the feed's operators, the multisig that can repoint it, the bridge behind a wrapped asset, the issuer behind the collateral. Each hop adds off-chain systems, and a code execution bug in any of them is a foothold, often two or three hops away, where few teams look.

Attackers already work this way, and they pick their targets carefully.

"Supply-chain attacks can be very precise. With ASUS, attackers took over the company's own Live Update servers and pushed signed, trojanized updates to tens of thousands of PCs, but the payload only activated on about 600 machines whose MAC addresses were on a hardcoded list. An attack like that could result in admin key compromise if there's enough money on the line."
Dogus, Forta Security Lead

The ASUS attack, uncovered by Kaspersky, aimed at a few hundred PCs. In crypto, the same pattern, a trusted vendor's code that reaches everyone but fires for one target, has already emptied a wallet, with a doctored web interface doing the work that malware did at ASUS. In February 2025, attackers who had compromised a Safe{Wallet} developer's machine changed the wallet's web front end so it misbehaved only for Bybit's cold wallet, and Bybit's signers approved a transaction that handed over about $1.5 billion (Sygnia, FBI). The attackers got in through the interface the signers used every day, a dependency one hop from the keys.

One position, drawn as a tree

To see where those hops sit in practice, take WETH collateral on Aave v3 on Ethereum, read onchain on October 23. The WETH contract is immutable with no admin key, the one safe leaf; every other branch belongs to the market around it.

The payoff: blast radius

At block 26,254,578, about 2.20 million WETH ($5.3B) and 778,000 wstETH ($2.3B) were supplied to Aave v3 on Ethereum, both priced through the same ETH / USD feed. If that feed lies, roughly $7.6B in these two reserves alone is mispriced, plus every market that reads it. If five Lido oracle keys leak, only the wstETH leg moves: the cap keeps a forged rise within about 4% of today's rate, while a forged fall passes straight through. Four emergency signers can pause the market; price changes go through governance.

Each break, its hop, and what Forta sees there

Forta Risk keeps that tree for every position it watches. Our indexer builds it as a live graph from onchain events: which feeds each market reads, where each vault allocates, what backs each wrapped or bridged asset, and who holds admin rights over each contract. As those events land, the graph moves with them, and for any node it adds up the value that depends on it, the blast radius above. We covered how we measure that spread in Quantifying Contagion Risk in Real Time.

Supply-chain or CI compromise → the admin node. A poisoned pipeline, or a package like LiteLLM 1.107.0 reading a CI runner's secrets, can become a privileged call, and on Aave that call sits onchain for a day before it can run: the window an alert needs. Forta Risk shows who can change what, and customers can switch on alerts for ownership and admin changes, role grants and revokes, signer changes and proxy upgrades, and Forta flags drains from compromised keys.

Data-provider compromise → the feed node. Forta Risk maps which markets read which feed, and alerts when a feed goes twice its declared heartbeat without an update, or stays further from an independent market price than its own deviation threshold for three consecutive 30-minute checks.

Bridge relayer compromise → the wrapped-asset node. Large-mint and large-burn alerts flag outsized supply changes, and role alerts flag minting permissions moving.

A short checklist

• Map your dependencies, two hops deep: feeds and their owners, admins and timelocks, bridges and issuers.
• Put a number on each: how much value moves if that feed lies or that key leaks.
• Watch the hops that can change: alerts on admin and role changes, feed staleness and drift, and large mints, each with someone who acts on it.

Your risk reaches as far as your dependencies do. Request a demo to see Forta Risk map what your positions depend on and alert you when it changes.

‍