Threat catalogue
Every threat we defend against carries a stable ID, a cost tier, an explicit defense layer, and a residual-risk note. The ones we don't defend against are named just as plainly. The matrix view lives on the threat model page.
Tier 1 — Software-only attacks
Bots, throwaway cloud servers, software chip emulators. Stopped outright: the proof simply doesn't check out. This is the tier that carries almost all real-world abuse volume, which is why displacing it changes your economics.
T-101VM-spawn-and-discard account farming$0.01–$0.10 · Infinite
MechanismRent cloud VMs, run signup with each as a fresh identity. Cost ~$0.005/hr per instance.
Defense layersL2, L3, L9
ResidualNone at the cryptographic layer. Attacker must escalate.
Real-worldLayerZero's 803K excluded wallets were largely cloud-VM clusters.
T-102Cloud-vTPM account farming (NitroTPM / Azure / GCP)$0.01–$0.50 · Infinite
MechanismCloud VM has a real virtual-TPM 2.0 producing a structurally valid attestation. Bypasses naive 'did they have a TPM' checks.
Defense layersL2, L3, L4, L9
ResidualNone under strict-hardware. Under cloud-permissive policy, IID cross-validation closes it.
T-103swtpm emulator account farming~$0 · Infinite
MechanismUserspace swtpm emulator produces TPM 2.0 commands and certs chaining to swtpm-localca.
Defense layersL2, L3, L9
ResidualNone.
Real-worldSUSE virt guide documents emulated TPM reports manufacturer 49424d00 regardless of host.
T-104CAPTCHA solver-farm bot signup$0.001–$0.005 · Infinite
MechanismSolver farms defeat CAPTCHA at $1–$3 / 1000 solves.
Defense layersOut-of-scope at the cryptographic layer. See residual note.
ResidualOut-of-scope for Root Herald directly — but composes: solver-farm wins CAPTCHA, fails attestation.
T-105Anti-detect browser + residential proxy$0.20–$1 · Infinite
MechanismRotated browser fingerprints + residential IP egress. Defeats FingerprintJS / Castle / DataDome.
Defense layersL8 (partial), L10
ResidualNone when paired with attestation.
T-106Email/phone churn signup$0.05–$0.50 · Infinite
MechanismThrowaway emails, SIM farms, virtual-number services.
Defense layersOut-of-scope at the cryptographic layer. See residual note.
ResidualOut-of-scope alone; composes with attestation.
Tier 2 — Firmware-vulnerability attacks
Exploiting a known flaw in a chip's firmware, limited to the shrinking pool of un-patched machines. We ship no blocklist of vulnerable firmware; we flag a device whose boot fingerprint drifts from your known-good baseline, and we honour revoked bootloaders.
T-201TPM-Fail timing side-channel~$0 · Bounded
MechanismTiming side-channel against Intel fTPM ECDSA. Recovers private keys in minutes locally.
Defense layersL8 (partial), L9
ResidualRoot Herald ships no known-bad firmware deny-list. The compensating controls are change-detection against a customer's known-good PCR reference values (a device whose measured boot no longer matches its allow-listed reference is flagged) plus dbx bootloader revocation.
Real-worldtpm.fail PoC; CVE-2019-11090.
T-202ROCA on Infineon RSAcompute only · Bounded
MechanismCoppersmith's attack on Infineon RSA generation flaw. ~760K still-vulnerable May 2025.
Defense layersL3 (partial), L8 (partial), L9
ResidualEstonian national ID recall (2017) — 750K cards re-keyed.
Real-worldCVE-2017-15361; weaponized PoCs exist.
T-203faulTPM voltage glitching$200 rig + hours · Bounded
MechanismVoltage-glitching against AMD fTPM on Zen 2/3. ~$200 hardware, hours per chip.
Defense layersL8 (partial), L9
ResidualRequires physical access; bounds to ≈ Tier 3.
Real-worldUSENIX / Black Hat USA 2023.
T-204CVE-2025-2884 OOB read (Pluton/fTPM)~$0 · Bounded
MechanismOOB read in TCG TPM 2.0 reference. Patched in AGESA 1.2.0.3e.
Defense layersL9
ResidualLarge unpatched OEM tail through 2026. There is no CVE/firmware-rev deny-list; the policy-layer control is change-detection against known-good PCR reference values plus dbx revocation.
T-205TPM-Genie hardware interposer$30 + skill · Bounded
MechanismHardware interposer on LPC bus intercepts and modifies commands.
Defense layersL7, L8
ResidualBounds to Tier 3 + labor; uneconomic for most use cases.
Tier 3 — Physical device farm
The honest cost floor. The chips are real, so the attacker buys real hardware at roughly $30–$200 a device. Each chip is unique, and bulk purchases show up as a detectable cluster.
T-301Refurb device farm$30–$200 · Bounded
MechanismBuy hundreds of cheap real devices, each a unique valid attestable identity. Logistics-bound.
Defense layersL8, L10
ResidualThe honest cost floor: capital-bound and detectable, not impossible. Six-figure airdrops still clear this bar.
Real-worldSoutheast Asia click-farm operations photographed publicly.
T-302Burner-phone-service farm$40–$100 · Bounded
MechanismMany 'fresh' phones used briefly, then retired.
Defense layersL8, L10
ResidualSame as T-301.
Tier 4 — Physically swapping the chip
Only possible on machines with a removable TPM. Around 70% of modern Windows PCs bake the chip into the CPU, where there is nothing to swap.
T-401TPM chip swap (discrete TPM only)$40–$200 · Bounded
MechanismDesolder existing discrete TPM, solder in a new $5 Infineon SLB 9672, mint fresh EKpub.
Defense layersL8, L10
ResidualOnly applies to discrete TPMs — ~70% of modern Windows uses in-CPU Pluton/PTT/fTPM.
T-402Header-pin TPM module replacement$20–$40 · Bounded
MechanismEnthusiast motherboards with TPM header pins allow swap without soldering.
Defense layersL8, L10
ResidualSame shape as T-401.
Tier 5 — Extracting a key from the silicon
Nation-state-grade lab work: one device at a time, six figures each. Off the table for any commercial abuse case.
T-501Decapping / electron microscopy$50K–$200K · Singular
MechanismPhysical attacks against the TPM die.
Defense layersL8 (partial), L10
ResidualNot on the cost ladder for any commercial abuse case.
Relay attacks — reusing a real device's proof elsewhere
Capture a genuine proof and reuse it from somewhere else. Cloud relays are caught by binding the proof to one specific instance; physical relays gain nothing, because each proof is tied to one unique chip.
T-601Cloud-cuckoo relay~$0 · Infinite if it works
MechanismHarvest a real NitroTPM attestation from one EC2, replay from a different cloud instance.
Defense layersL4
ResidualNone when RequireCloudCrossValidation = true. Default for cloud-permissive policy.
T-602Physical-cuckoo relay~$0 · Infinite attempts, 1 identity
MechanismScript N fresh signup sessions, pipe each nonce to one real TPM, collect N quotes.
Defense layersL8
ResidualAttacker is pushed back to Tier 3 (acquire more real chips). The 'cheap relay shortcut' doesn't exist.
T-603Token replay$0 · Singular
MechanismCapture a valid attestation JWT, re-submit later.
Defense layersL5
ResidualNone within the quote-freshness window.
T-604Session-binding bypass$0 · Singular
MechanismUse a valid token in a context other than the one for which it was issued.
Defense layersL5, L9
ResidualDepends on RP integrating correctly; libraries get this right by default.
Out of scope for hardware alone
Hardware attestation alone cannot stop a real person paid to sign up, a stolen account, a stolen device, a compromised manufacturer, or a rogue insider. Layered defences apply.
T-701Compensated real users ('device mercenaries')$1–$50 · Bounded
MechanismPay N real users $X each to perform a real attestation from their real devices.
Defense layersL10
ResidualHonest disclosure. Hardware attestation alone cannot stop this. Layered defense (hardware floor + behavioral) is the strategy.
Real-worldDocumented in LayerZero's airdrop retrospective.
T-702Account-takeover post-enrollmentvariable · Bounded
MechanismCompromise a legitimate user's session post-enrollment.
Defense layersOut-of-scope at the cryptographic layer. See residual note.
ResidualOut-of-scope; step-up MFA / CAEP / session-management is the customer's stack.
T-703Device theft / borrowed devicevaries · Singular
MechanismLegitimate hardware under attacker's physical control.
Defense layersOut-of-scope at the cryptographic layer. See residual note.
ResidualA user can mark a device stolen; the per-tenant ban list then rejects further attestations from it.
T-704Supply-chain compromise of manufacturer CAnation-state · Singular
MechanismAttacker compromises an Infineon/ST/Nuvoton/Intel/AMD/Microsoft CA and mints arbitrary EK certs.
Defense layersOut-of-scope at the cryptographic layer. See residual note.
ResidualDetection + response only.
T-705Insider threat (Root Herald operator)n/a · Singular
MechanismRoot Herald employee exfiltrates EKpub data or forges tokens.
Defense layersOut-of-scope at the cryptographic layer. See residual note.
ResidualSOC 2 controls (in progress, not yet certified); not protocol-level.