10 bug classes. Pre-dive kill signals. Foundry PoC template. Real paid examples.
\n\n\nZKsync lesson: $322M TVL + OZ audit + 750K LOC + 5 sessions = 0 findings. Large well-audited bridges are extremely hard.
\n
max_realistic_payout = min(10% × TVL, program_cap) — if < $10K, skipSoft kill: OZ/ToB/Cyfrin audit on current version + codebase > 500K LOC → expect 40+ hours for maybe 1 finding. Only proceed if bounty floor > $50K AND you have protocol-specific expertise.
\nTarget scoring (go if >= 6/10):
\n\n\n\"Read ALL sibling functions. If
\nvote()has a modifier, checkpoke(),reset(),harvest(). The missing modifier on the sibling IS the bug.\"
This single rule explains 19% of all Critical findings.
\n\n\n#1 Critical bug class — 28% of all Criticals on Immunefi.
\n
Two state variables supposed to stay in sync. One code path updates A but forgets B. Later code reads both and makes decisions based on stale B.
\nReal Value = A - B\nIf A updated but B isn't → Real Value appears larger → phantom value\nVariant 1: Phantom Yield (Yeet protocol — 35 duplicate reports)
\nfunction startUnstake(uint256 amount) external {\n totalSupply -= amount; // decremented BEFORE transfer\n // aToken.balanceOf(this) still reflects old value\n // yieldAmount = aToken.balanceOf - totalSupply = phantom yield\n}\nVariant 2: Fast Path Skips State Update (Alchemix V3)
\nfunction claimRedemption(uint256 tokenId) external {\n if (transmuter.balance >= amount) {\n transmuter.transfer(user, amount);\n _burn(tokenId);\n return; // EARLY RETURN — cumulativeEarmarked, _redemptionWeight, totalDebt never updated\n }\n // Slow path: updates all state vars correctly\n alchemist.redeem(...);\n}\nVariant 3: Update Happens in Wrong Order (Alchemix)
\nfunction deposit(uint256 amount) external {\n _shares = (amount * totalShares) / totalAssets; // calculated BEFORE deposit\n totalAssets += amount; // assets added AFTER shares calculated → wrong rate\n}\n# Find all accounting variables\ngrep -rn \"totalSupply\\|totalShares\\|totalAssets\\|totalDebt\\|cumulativeReward\\|rewardPerShare\" contracts/\n\n# Find all early returns in claim/redeem functions\ngrep -rn \"\\breturn\\b\" contracts/ -B3 | grep -B3 \"if\\b\"\n\n# For each early return: which state updates in normal path are skipped?\n\n\n#2 Critical — 19% of Criticals. $953M lost in 2024 alone.
\n
function vote(uint256 tokenId) external onlyNewEpoch(tokenId) { // guarded\nfunction reset(uint256 tokenId) external onlyNewEpoch(tokenId) { // guarded\nfunction poke(uint256 tokenId) external { // NO GUARD → infinite FLUX inflation\n}\nfunction split(uint256 tokenId, uint256 amount) external {\n _requireOwned(tokenId); // checks if token EXISTS, not if caller OWNS it\n _burn(tokenId);\n _mint(msg.sender, amount); // attacker steals tokens they don't own\n}\n// VULNERABLE — non-admin silently gets through:\nmodifier onlyAdmin() {\n if (msg.sender == admin) {\n _; // body only executes for admin, but non-admin doesn't revert\n }\n}\n// CORRECT: require(msg.sender == admin, \"Not admin\"); _;\nfunction initialize(address _owner) public { // MISSING: initializer modifier\n owner = _owner; // anyone can call → become owner\n}\n// Fix: constructor() { _disableInitializers(); }\n# Find sibling function families — do ALL have the same modifier set?\ngrep -rn \"function vote\\|function poke\\|function reset\\|function update\\|function claim\\|function harvest\" contracts/ -A2\n\n# Ownership check: existence vs ownership?\ngrep -rn \"_requireOwned\\|ownerOf\\|_isApprovedOrOwner\\|_checkAuthorized\" contracts/ -B5\n\n# Silent modifiers\ngrep -rn \"modifier\\b\" contracts/ -A8 | grep -B3 \"if (\" | grep -v \"require\\|revert\"\n\n# Uninitialized initializer\ngrep -rn \"function initialize\\b\" contracts/ -A3\ngrep -rn \"_disableInitializers()\" contracts/\n| Protocol | \nPayout | \nBug | \n
|---|---|---|
| Wormhole | \n$10M | \nUninitialized UUPS proxy → anyone calls initialize() | \n
| ZeroLend | \nn/a | \nsplit() uses existence check, not ownership check | \n
| Alchemix | \nn/a | \npoke() missing onlyNewEpoch → infinite FLUX inflation | \n
| Parity | \n$150M frozen | \nNo access control on initWallet() in library | \n
\n\n#3 Critical — 17% of Criticals.
\n
1. List all state changes in function A (deposit/place/create)\n2. List all state changes in function B (withdraw/update/cancel)\n3. For each state change in A: does B have the corresponding reverse?\n4. For each token transfer in A: does B have the corresponding refund?\nIf A does X but B doesn't do the reverse of X → BUG.\nfunction place_order(OrderInput calldata order) external {\n token.safeTransferFrom(msg.sender, address(this), order.price); // takes tokens\n orders[orderId] = order;\n}\nfunction update_order(OrderInput calldata updatedOrder) external {\n // BUG: NO REFUND for sell orders when price decreases → tokens permanently stuck\n orders[orderId] = updatedOrder;\n}\nfunction swapForETH(uint256 amountIn) external {\n token.safeTransferFrom(msg.sender, address(this), amountIn);\n uint256 filled = dex.swap(amountIn); // partial fill possible\n _refundExcessEth(amountIn - filled); // BUG: refunds ETH only, not ERC20\n}\nfunction deposit(uint256 assets, address receiver) public override {\n shares = _deposit(assets, receiver); // includes receipt validation\n}\nfunction mint(uint256 shares, address receiver) public override {\n assets = convertToAssets(shares);\n _mint(receiver, shares); // MISSING: _deposit() validation → mints without receiving assets\n}\ngrep -rn \"function place_\\|function create_\\|function add_\\|function open_\" contracts/ -A5\ngrep -rn \"function update_\\|function modify_\\|function cancel_\" contracts/ -A5\ngrep -rn \"safeApprove\\b\" contracts/ # safeApprove without zero-reset before\ngrep -rn \"delete\\b\" contracts/ -B5 -A5 # delete before operation completes\ngrep -rn \"function deposit\\|function mint\\|function withdraw\\|function redeem\" contracts/ -A10\n\n\n#4 High — 22% of Highs. Single character change. Massive impact.
\n
// VeChain Stargate — post-exit reward drain:\nfunction _claimableDelegationPeriods(address delegator) internal view returns (uint256) {\n if (endPeriod > nextClaimablePeriod) { // BUG: should be >=\n return 0; // exited users get nothing\n }\n return nextClaimablePeriod - lastClaimedPeriod; // rewards for period AFTER exit\n}\n\n\nFor every
\nif (A > B): \"What happens when A == B?\" Is that correct?
> vs >= at period endblock.timestamp == deadline lock or unlock?break with > vs >=i <= array.length (should be i < array.length)>= amount allows exact full withdrawal?# Boundaries in comparisons\ngrep -rn \"Period\\|Epoch\\|Round\\|Deadline\\|period\\|epoch\\|deadline\" contracts/ -A3 | grep \"[<>][^=]\"\n\n# Loop breaks\ngrep -rn \"\\bbreak\\b\" contracts/ -B10\n\n# Off-by-one in array access\ngrep -rn \"\\.length\\s*-\\s*1\\|i\\s*<=\\s*.*\\.length\\b\" contracts/\n\n\n12% of all reports. Largest individual payouts. $117M Mango, $70M Curve.
\n
// VULNERABLE:\n(, int256 price,,,) = priceFeed.latestRoundData();\nreturn uint256(price); // If Chainlink node goes down, stale price returned indefinitely\n\n// CORRECT:\n(, int256 price,, uint256 updatedAt,) = priceFeed.latestRoundData();\nrequire(block.timestamp - updatedAt <= MAX_PRICE_AGE, \"Stale price\");\nrequire(price > 0, \"Invalid price\");\n// VULNERABLE:\nPythStructs.Price memory p = pyth.getPriceUnsafe(priceFeed);\nreturn p.price; // ignores p.conf (confidence interval)\n\n// CORRECT:\nrequire(p.conf * 10 <= uint64(p.price), \"Price too uncertain\");\n// conf > 10% of price = untrustworthy\n// VULNERABLE: 60-second TWAP\nuint32[] memory secondsAgos = new uint32[](2);\nsecondsAgos[0] = 60; secondsAgos[1] = 0;\n// Flash loan can shift price for entire 60s window\n\n// CORRECT: 1800s minimum TWAP (30 min)\n// VULNERABLE: only Uniswap spot price\nuint price = getUniswapSpotPrice(token); // flash loan manipulatable\n\n// CORRECT: Chainlink primary, Uniswap TWAP as fallback, require close agreement\n# Missing staleness check\ngrep -rn \"latestRoundData\" contracts/ -A5 | grep -v \"updatedAt\\|timestamp\"\n\n# Pyth price usage — confidence interval checked?\ngrep -rn \"getPriceUnsafe\\|getPrice\\b\" contracts/ -A8 | grep -v \"conf\\|confidence\"\n\n# TWAP windows — short TWAP flag\ngrep -rn \"secondsAgo\\|TWAP\\|cardinality\" contracts/ -A5\n// VULNERABLE — first depositor attack:\n// 1. Attacker deposits 1 wei → gets 1 share\n// 2. Attacker donates large amount directly (transfer, not deposit)\n// 3. Exchange rate: 1 share = (1 + donation) assets\n// 4. Victim deposits → rounds down to 0 shares → free donation to attacker\n\n// CORRECT: virtual shares (OpenZeppelin v4.9+)\nfunction _decimalsOffset() internal view virtual override returns (uint8) {\n return 9; // add 1e9 virtual shares + assets to prevent manipulation\n}\n// VULNERABLE: shares transferred, but lock records stay with original owner\n// → shares stuck, can't redeem → permanent freeze (Belong pattern)\nfunction transfer(address to, uint256 amount) external override {\n _transfer(msg.sender, to, amount); // moves shares\n // MISSING: transfer lock record from msg.sender to `to`\n}\ngrep -rn \"function transfer\\|function transferFrom\" contracts/ -A15\ngrep -rn \"function deposit\\|function mint\\|function withdraw\\|function redeem\" contracts/ -A10\n\n\n2016–present. CEI pattern prevents it. Still found in DeFi.
\n
// VULNERABLE (effects after interaction):\nfunction withdraw(uint256 amount) external {\n require(balances[msg.sender] >= amount);\n (bool success,) = msg.sender.call{value: amount}(\"\"); // INTERACTION first\n require(success);\n balances[msg.sender] -= amount; // EFFECT after → reentrancy window\n}\n\n// CORRECT (CEI — Checks, Effects, Interactions):\nfunction withdraw(uint256 amount) external {\n require(balances[msg.sender] >= amount); // CHECK\n balances[msg.sender] -= amount; // EFFECT\n (bool success,) = msg.sender.call{value: amount}(\"\"); // INTERACTION last\n require(success);\n}\n# External calls before state updates\ngrep -rn \"\\.call{value\\|safeTransfer\\|transfer(\" contracts/ -B10 | grep -v \"require\\|revert\"\n\n# Missing nonReentrant modifier on critical functions\ngrep -rn \"function withdraw\\|function redeem\\|function claim\" contracts/ -A2 | grep -v \"nonReentrant\"\n\n# Storage slot for reentrancy guard\ngrep -rn \"nonReentrant\\|ReentrancyGuard\\|_notEntered\" contracts/\n// Attack flow:\n// 1. Borrow $100M from Aave flash loan\n// 2. Dump token in Uniswap pool → crash spot price\n// 3. Protocol reads Uniswap spot → undercollateralized loans accepted\n// 4. Borrow max against cheap collateral\n// 5. Repay flash loan, keep profits\ngrep -rn \"getReserves\\|getAmountsOut\\|slot0\\b\" contracts/ -A5\n# spot price from reserves = manipulatable with flash loan\n# slot0 = Uniswap V3 spot price = manipulatable\n// VULNERABLE:\nfunction permit(address owner, address spender, uint256 value,\n uint256 deadline, uint8 v, bytes32 r, bytes32 s) external {\n bytes32 hash = keccak256(abi.encodePacked(owner, spender, value, deadline));\n // MISSING: nonce not included → same signature usable multiple times\n require(ecrecover(hash, v, r, s) == owner);\n}\n// VULNERABLE: signature valid on mainnet AND testnet AND all forks\nbytes32 hash = keccak256(abi.encodePacked(params));\n// MISSING: block.chainid not in hash → works on any chain\ngrep -rn \"ecrecover\\|ECDSA\\.recover\" contracts/ -B20\n# Check: does the signed hash include nonce + chainId + contract address?\n\ngrep -rn \"nonce\\|_nonces\\|nonces\\[\" contracts/\n// Implementation and proxy share storage layout\n// Proxy slot 0: _owner\n// Implementation slot 0: _initialized\n// → writing to _initialized overwrites _owner\n// If implementation can be initialized directly → anyone becomes owner of implementation\n// Attack: call initialize() on implementation contract → call upgradeTo() → replace logic\nfunction execute(address target, bytes calldata data) external onlyOwner {\n target.delegatecall(data); // target is validated, but what if owner is compromised?\n}\n# UUPS initialization protection\ngrep -rn \"function initialize\\b\\|_disableInitializers\\|initializer\" contracts/\n\n# Delegate call\ngrep -rn \"delegatecall\\b\" contracts/ -B3 -A5\n\n# Storage layout — proxy uses EIP-1967 slots?\ngrep -rn \"0x360894\\|EIP1967\\|_IMPLEMENTATION_SLOT\" contracts/\n// SPDX-License-Identifier: MIT\npragma solidity ^0.8.0;\n\nimport \"forge-std/Test.sol\";\nimport \"../src/VulnerableContract.sol\";\n\ncontract ExploitTest is Test {\n VulnerableContract target;\n address attacker = makeAddr(\"attacker\");\n address victim = makeAddr(\"victim\");\n\n function setUp() public {\n // Fork mainnet at specific block\n vm.createSelectFork(\"mainnet\", BLOCK_NUMBER);\n\n // Deploy or load target\n target = VulnerableContract(TARGET_ADDRESS);\n\n // Fund accounts\n deal(address(token), attacker, INITIAL_BALANCE);\n deal(address(token), victim, VICTIM_BALANCE);\n }\n\n function test_exploit() public {\n console.log(\"Attacker balance before:\", token.balanceOf(attacker));\n\n vm.startPrank(attacker);\n\n // Step 1: Setup conditions\n // Step 2: Execute exploit\n // Step 3: Verify impact\n\n vm.stopPrank();\n\n console.log(\"Attacker balance after:\", token.balanceOf(attacker));\n assertGt(token.balanceOf(attacker), INITIAL_BALANCE, \"Exploit failed\");\n }\n}\nvm.prank(address) // next call from address\nvm.startPrank(address) // all calls from address until stopPrank()\nvm.deal(address, amount) // set ETH balance\ndeal(token, address, amount) // set ERC20 balance\nvm.warp(timestamp) // set block.timestamp\nvm.roll(blockNumber) // set block.number\nvm.createSelectFork(\"mainnet\", blockNumber) // fork mainnet\nvm.expectRevert(bytes) // next call should revert\nvm.label(address, \"name\") // label for trace output\nvm.assume(condition) // fuzz: discard inputs where false\n# Run specific test\nforge test --match-test test_exploit -vvvv\n\n# Run with fork\nforge test --match-test test_exploit -vvvv --fork-url $MAINNET_RPC\n\n# Gas report\nforge test --gas-report\n\n# Coverage\nforge coverage --report summary\nmeme-coin-audit — When the target is a meme coin / SPL token rather than a DeFi protocol. Workflow primitive: pre-dive kill signals diverge — this skill's \"TVL < $500K skip\" doesn't apply to meme coins where the rug check (mint authority, freeze authority, LP lock) is the entire audit; route to meme-coin-audit instead.triage-validation — When a contract finding is ready to be filed on Immunefi. Workflow primitive: Immunefi has its own report format, but the impact-validated, chain-end-to-end discipline of triage-validation still applies; run the 7Q gate against the Foundry PoC before submitting.report-writing — When writing the Immunefi report body. Workflow primitive: report-writing's Immunefi template (with Foundry PoC, root cause code snippet, quantified economic impact) is the body skeleton this skill's findings feed into.offensive-osint — When auditing a protocol's off-chain attack surface (frontend, admin API, RPC gateways). Workflow primitive: on-chain audit is this skill's job; any web2 component of the protocol (web-frontend, admin panel, indexer API) routes to offensive-osint for recon.bb-methodology — When deciding whether to dive at all. Workflow primitive: PART 0 of bb-methodology confirms engagement (web3 bug bounty / private audit / smart-contract review); this skill's pre-dive kill signals replace the standard scoring rubric for that engagement type.\n\nEngagement-derived + 2026-specific additions to the vendored foundation.\nWisdom from real authorized engagements + Phase 2 verification across\nthis repo's 31+ skill-area live tests. The upstream content covers the WHAT;\nthis layer covers the WHEN-IT-WORKS-vs-WHEN-IT-DOESN'T.
\n
Flash-loan attacks remain top-paid on Immunefi (top 5 in 2024-2026 by bounty). The economic primitive — borrow $50M, manipulate price oracle, drain pool, repay — keeps reappearing because new protocols keep shipping with composability assumptions that don't hold under flash-loaned imbalance.
\nReentrancy IS still paying because new protocols keep shipping with ERC-777 / hooks / callbacks. Don't assume the class is dead — the 2023-2025 paid corpus contains 40+ reentrancy bugs against post-Checks-Effects-Interactions codebases (cross-function reentrancy, read-only reentrancy via view functions called during state-mid-flight).
\nOracle manipulation: still paid heavily but harder. Most projects use Chainlink price feeds now; the attack target is the SECONDARY oracle most projects also use (TWAP from a low-liquidity Uniswap V2 pair, the protocol's own internal oracle, a stale fallback path). Audit the failover chain, not just the primary feed.
\ntload/tstore usage for read-after-external-call.Foundry remains the test framework. forge test --gas-report --debug for invariant testing; forge fuzz for property-based testing; forge inspect for storage-layout audits. Slither + Echidna for static + fuzz. Mythril for symbolic execution on smaller contracts. tenderly.co for forking + simulation (best UX for replicating attacks against mainnet state).
For Solana: anchor framework, sealevel-attacks corpus (curated PoCs by anchor maintainers), soteria-sec / sec3 scanner. For Move (Aptos, Sui): move-prover, aptos-cli aptos move test.
For cross-chain: hyperlane and LayerZero each have audit-tooling repos; bridge bugs require simulating both endpoints, not just one.
\nTVL under $500K isn't worth the audit time unless the bounty floor is high. Audit firm already covered it = low ROI unless you find what they missed — look at the audit-report scope-exclusion section for what they EXPLICITLY didn't audit (oracles, governance, off-chain components, frontend, the admin path).
\nMultisig signers > 5 + timelock > 48h = low rug-pull risk; if your finding requires team-malicious assumptions, it's low-impact and likely out of scope per Immunefi's \"centralization risk\" exclusion. Read the program brief — most Immunefi programs explicitly downgrade or reject findings that assume admin malice.
\nImmunefi requires Foundry PoC. Submission without PoC is auto-rejected. Submission with a PoC that requires manual setup (\"first deploy this, then call that\") usually gets downgraded — the PoC should be a single forge test invocation that proves the impact, with explicit assertEq on the drained balance / minted token / corrupted state.
Severity claims must use Immunefi's severity matrix exactly; don't invent severities. The matrix gates on direct economic loss percentage of TVL — a critical against a $500K protocol pays differently than a critical against a $500M one. Read the program's specific severity assignment before claiming Critical.
\n","files":[{"path":"SKILL.md","sizeBytes":24000,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-08-25T17:14:53.420714Z","sha256":"E1F746F65E51296B1C0674731D7286CCEEE9D722D3528C54CEE13E5605DD6FFB","sizeBytes":9897},"review":null,"source":{"repositoryUrl":"https://github.com/elementalsouls/Claude-BugHunter","path":"skills/web3-audit","license":"MIT","commit":"4d7b4cdfddb7ec67fba87821e54c768248a544bd","subtreeSha":"D4A0941FB14C4E011B53FB853A7D205F17D6D2799140A2E19A38CEA24D3874A4","lastSyncedAt":"2026-09-24T06:49:51.293025Z"},"reviewedAt":"2026-08-25T17:20:28.56552Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/web3-audit"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install elementalsouls-claude-bughunter@llmmart"},{"target":"git","command":"git clone https://github.com/elementalsouls/Claude-BugHunter.git"}]}