Smart Contract Exploiter

Smart Contract Exploiter

Overview

Smart contract bug bounty hunting pays $10k-$10M per critical finding. This skill covers the complete exploit development lifecycle: automated scanning with Slither/Mythril, manual code review, exploit prototyping with Foundry, flash loan attack patterns, MEV strategies, cross-chain bridge exploits, NFT vulnerabilities, DAO governance attacks, and submission to platforms like Arkham Intelligence, Immunefi, Code4rena, and Sherlock.

When to Use

Trigger phrases:

• "smart contract exploiter"

• "Hunting on Arkham Intelligence bug bounty programs"

• "Auditing smart contracts for Immunefi, Code4rena, Sherlock submissions"

• "Building PoC exploits for discovered vulnerabilities"

• Hunting on Arkham Intelligence bug bounty programs

• Auditing smart contracts for Immunefi, Code4rena, Sherlock submissions

• Building PoC exploits for discovered vulnerabilities

• Analyzing DeFi protocol economic attack vectors

• Reviewing token contracts for rug pull indicators

• Testing upgrade mechanisms and proxy patterns

• Developing automated exploit chains

• Analyzing cross-chain bridge vulnerabilities

• Auditing NFT contracts (ERC721/ERC1155)

• Testing DAO governance mechanisms

• Analyzing L2-specific vulnerabilities (Optimism, Arbitrum, zkSync)

When NOT to Use

• Target has no bug bounty program or written authorization
• Simple token transfer testing (use block explorers)
• Real-time price monitoring (use DeFi dashboards)
• Gas optimization (use dedicated tools)

Prerequisites

• Python 3.10+ with pip
• Node.js 18+ (for Hardhat projects)
• Foundry (forge, cast, anvil)
• Slither (pip install slither-analyzer)
• Mythril (pip install mythril)
• Echidna (optional, for fuzzing)
• solc-select for compiler management
• RPC endpoints (Alchemy, Infura, or local node)

Installation

# Install Foundry (forge, cast, anvil)
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Install Slither
pip install slither-analyzer

# Install Mythril
pip install mythril

# Install Echidna (optional)
# See: https://github.com/crytic/echidna

# Install solc-select for compiler management
pip install solc-select
solc-select install 0.8.19
solc-select use 0.8.19

# Install Aderyn (Rust-based Solidity analyzer)
curl -L https://raw.githubusercontent.com/Cyfrin/aderyn/dev/cyfrinup/install | bash
cyfrinup
aderyn .

The Process

1. Scope the task — define objectives, boundaries, and success criteria
2. Gather information — collect all necessary data and context before proceeding
3. Execute the core workflow — follow the domain-specific steps methodically
4. Validate results — verify outputs against expected outcomes or baselines
5. Document findings — record results, anomalies, and recommendations

Step 1: Target Reconnaissance

Before diving into code analysis:

1. Contract discovery — Etherscan, Blockscout, deployment transaction
2. Source verification — Is source code verified? Compiler version?
3. Proxy detection — Is it a proxy? What's the implementation?
4. Dependency mapping — What does it import? OpenZeppelin version?
5. TVL assessment — How much value is locked? Higher TVL = higher bounty
6. Admin controls — What can the owner/admin do? Multisig?
7. Attack surface — External calls, state variables, access control
8. Token standards — ERC20, ERC721, ERC1155, ERC4626?
9. DeFi protocol type — AMM, lending, vault, bridge, DAO?

# Check contract on Etherscan
cast code 0xCONTRACT_ADDRESS --rpc-url ethers

# Verify proxy detection
cast storage 0xCONTRACT_ADDRESS 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc

# Get contract ABI
cast abi 0xCONTRACT_ADDRESS --rpc-url ethers

# Get contract creation tx
cast creation 0xCONTRACT_ADDRESS --rpc-url ethers

# Check implementation (if proxy)
cast implementation 0xCONTRACT_ADDRESS --rpc-url ethers

# Get all storage slots
cast storage 0xCONTRACT_ADDRESS --rpc-url ethers

Step 2: Automated Analysis

Run multiple tools in parallel for comprehensive coverage:

Slither Static Analysis

# Basic analysis
slither . --print human-summary

# Specific vulnerability detectors
slither . --detect reentrancy-eth,reentrancy-no-eth
slither . --detect unchecked-transfer
slither . --detect arbitrary-send-eth
slither . --detect weak-prng
slither . --detect uninitialized-state
slither . --detect uninitialized-storage
slither . --detect controlled-delegatecall
slither . --detect delegatecall-loop
slither . --detect tx-origin
slither . --detect assembly
slither . --detect low-level-calls
slither . --detect constable-states
slither . --detect external-function

# All detectors
slither . --detect all

# JSON output for parsing
slither . --json results.json

# Print contract summary
slither . --print contract-summary

# Print function summaries
slither . --print function-summary

# Print inheritance graph
slither . --print inheritance-graph

Mythril Symbolic Execution

# Analyze single contract
mythril analyze contract.sol --execution-timeout 90

# Analyze with specific solc version
mythril analyze contract.sol --solv 0.8.19

# JSON output
mythril analyze contract.sol --json --execution-timeout 90

# Deep analysis (longer timeout)
mythril analyze contract.sol --execution-timeout 300 --max-depth 22

# Analyze deployed contract
mythril analyze 0xCONTRACT_ADDRESS --rpc infura-mainnet

# Custom loop bound
mythril analyze contract.sol --max-depth 30 --loop-bound 50

Aderyn (Cyfrin)

# Run Aderyn analyzer
aderyn .

# Output JSON
aderyn . --json

# Custom output path
aderyn . --output results.json

Echidna Fuzzing

# Create echidna config
cat > echidna.yaml << EOF
testMode: "assertion"
testLimit: 50000
shrinkLimit: 5000
seqLen: 100
deployer: "0x10000"
sender: ["0x10000", "0x20000", "0x30000"]
EOF

# Run fuzzer
echidna-test . --contract TestContract --config echidna.yaml

# Property-based testing
echidna-test . --contract TestContract --testMode property

Foundry Fuzzing

# Run fuzz tests
forge test --match-test testFuzz -vvvv

# Increase fuzz runs
forge test --match-test testFuzz --fuzz-runs 10000

Step 3: Vulnerability Classes (Ranked by Payout)

2025-2026 UPDATE: Rounding/precision errors have surpassed reentrancy as the #1 attack vector. The three largest exploits of 2025 (Balancer $128M, Cetus $223M, yETH $9M) all used rounding errors. Test batch operations and state reset patterns first.

Critical ($100k-$10M)

Rounding/Precision Errors (2025 #1 Vector)

// VULNERABLE: Precision loss in _upscale function (Balancer-style)
function _upscale(uint amount, uint scalingFactor) internal pure returns (uint) {
    return FixedPoint.mulDown(amount, scalingFactor);
    // When amount is small (8-9 wei) and scalingFactor is large,
    // mulDown truncates to 0 due to integer division
}

// ATTACK: Micro-swaps compound rounding errors
// 1. Push pool balance to critical 8-9 wei threshold
// 2. Execute 65+ micro-swaps (amount=17 vs balance=18)
// 3. Each swap loses ~10% precision via rounding
// 4. Accumulated error suppresses BPT price
// 5. Buy BPT at suppressed price, redeem at full value

// FIX: Use mulUp for critical operations, validate invariant after batch
function _upscale(uint amount, uint scalingFactor) internal pure returns (uint) {
    return FixedPoint.mulUp(amount, scalingFactor);
}

// FIX: Add invariant check after batch operations
function batchSwap(...) external {
    // ... swap logic ...
    require(_verifyInvariant(), "Invariant violated");
}

State Reset Vulnerability (yETH-style)

// VULNERABLE: Cached state not cleared when pool emptied
mapping(uint => uint) packed_vbs; // Cached virtual balances

function remove_liquidity(uint amount) external {
    // Burns LP tokens, decrements packed_vbs
    // BUT: When supply hits 0, packed_vbs retains residual values!
}

function add_liquidity(uint amount) external {
    if (supply == 0) {
        // "First-ever deposit" logic reads stale cached values
        // Instead of calculating from actual deposit, reads packed_vbs
        // Result: Mints septillions of LP tokens from dust deposit
    }
}

// FIX: Explicitly clear ALL cached state when supply hits zero
function remove_liquidity(uint amount) external {
    // ... burn logic ...
    if (supply == 0) {
        packed_vbs = new uint[](0); // CLEAR CACHE
    }
}

// FIX: Add domain checks for "first deposit" scenario
function add_liquidity(uint amount) external {
    if (supply == 0) {
        require(amount > MIN_DEPOSIT, "Dust deposit blocked");
        // Verify no stale cached state exists
        require(packed_vbs.length == 0, "Stale cache detected");
    }
}

Library Bug Propagation (Cetus-style)

// VULNERABLE: Bug in third-party library becomes protocol bug
// integer-mate library's checked_shlw had wrong mask
// Left-shift overflow wrapped silently in Move language
// Result: $223M exploit on Sui blockchain

// FIX: Audit ALL dependencies, not just protocol code
// FIX: Add runtime assertions for critical math operations
function checked_shlw(value: u128, shift: u8): (u128, u8) {
    let mask = (1u128 << shift) - 1; // Correct mask
    let overflow = value & mask;
    let result = value >> shift;
    (result, if (overflow > 0) { 1 } else { 0 })
}

Reentrancy

// VULNERABLE: state update after external call
function withdraw() external {
    uint balance = balances[msg.sender];
    (bool success, ) = msg.sender.call{value: balance}("");
    require(success);
    balances[msg.sender] = 0; // TOO LATE
}

// FIX: checks-effects-interactions
function withdraw() external {
    uint balance = balances[msg.sender];
    balances[msg.sender] = 0; // State first
    (bool success, ) = msg.sender.call{value: balance}("");
    require(success);
}

// VULNERABLE: cross-function reentrancy
function transfer(address to, uint amount) external {
    require(balances[msg.sender] >= amount);
    balances[msg.sender] -= amount;
    balances[to] += amount;
}

function withdraw() external {
    uint balance = balances[msg.sender];
    (bool success, ) = msg.sender.call{value: balance}("");
    require(success);
    balances[msg.sender] = 0;
}
// Attacker: receive() calls transfer() before balances[msg.sender] = 0

Flash Loan Attacks

// Flash loan exploit pattern
contract FlashLoanExploit {
    function attack() external {
        // Step 1: Flash loan from Aave/dYdX
        uint amount = 1000000 ether;
        IFlashLender(lender).flashLoan(amount);
    }
    
    function executeOperation(
        address asset,
        uint amount,
        uint premium,
        address initiator,
        bytes calldata params
    ) external returns (bool) {
        // Step 2: Manipulate price oracle
        manipulatePrice();
        
        // Step 3: Exploit vulnerable protocol
        exploitProtocol();
        
        // Step 4: Repay flash loan + premium
        IERC20(asset).transfer(lender, amount + premium);
        
        // Step 5: Keep profit
        return true;
    }
    
    function manipulatePrice() internal {
        // Swap large amount to skew price
        uint reserve0 = pair.reserve0();
        uint reserve1 = pair.reserve1();
        // Flash loan drains one side → price manipulation
    }
}

Access Control

// VULNERABLE: missing access control
function setOwner(address newOwner) external {
    owner = newOwner; // Anyone can call!
}

// VULNERABLE: wrong visibility
function _authorizeUpgrade(address impl) public {
    // Should be internal
}

// VULNERABLE: missing modifier
function mint(address to, uint amount) external {
    _mint(to, amount); // Missing onlyOwner
}

// FIX: Proper access control
function setOwner(address newOwner) external onlyOwner {
    owner = newOwner;
}

Integer Overflow/Underflow

// Pre-0.8.0: silent overflow
uint8 x = 255;
x += 1; // Becomes 0, no revert

// Post-0.8.0: reverts by default
// But unchecked blocks still vulnerable
unchecked {
    uint8 x = 255;
    x += 1; // Becomes 0
}

// VULNERABLE: unchecked in critical math
function calculateReward(uint amount) internal pure returns (uint) {
    unchecked {
        return amount * rewardRate / 1e18; // Overflow possible
    }
}

High ($10k-$100k)

Oracle Manipulation

// VULNERABLE: spot price from single DEX
function getPrice() returns (uint) {
    return token.balanceOf(address(pair)) * 1e18 / 
           otherToken.balanceOf(address(pair));
}
// Flash loan drains one side → price manipulation

// VULNERABLE: single oracle source
function getPrice() returns (uint) {
    return IChainlinkOracle(oracle).latestAnswer();
}
// Oracle can be manipulated if single source

// FIX: Use TWAP oracle (Chainlink, Uniswap TWAP)
function getPrice() returns (uint) {
    (uint price0Cumulative, uint price1Cumulative, uint32 blockTimestamp) = 
        IUniswapV2Pair(pair).getReserves();
    
    uint timeElapsed = blockTimestamp - blockTimestampLast;
    uint amount0 = (price0Cumulative - price0CumulativeLast) / timeElapsed;
    uint amount1 = (price1Cumulative - price1CumulativeLast) / timeElapsed;
    
    return (amount0 * 1e18) / amount1;
}

Accounting Desync

// VULNERABLE: rounding error in shares
function deposit(uint amount) external returns (uint shares) {
    shares = amount * totalShares / totalAssets;
    // If totalAssets is small, shares rounds to 0
    _mint(msg.sender, shares);
    totalAssets += amount;
}

function withdraw(uint shares) external returns (uint amount) {
    amount = shares * totalAssets / totalShares;
    // Attacker deposits 1 wei, gets 0 shares, deposits more
    _burn(msg.sender, shares);
    totalAssets -= amount;
}

// FIX: Round shares up, amount down
function deposit(uint amount) external returns (uint shares) {
    shares = (amount * totalShares + totalAssets - 1) / totalAssets;
    _mint(msg.sender, shares);
    totalAssets += amount;
}

Signature Replay

// VULNERABLE: no nonce, no chain ID check
function execute(address to, uint value, bytes memory data, bytes memory sig) {
    bytes32 hash = keccak256(abi.encodePacked(to, value, data));
    address signer = ECDSA.recover(hash, sig);
    require(signer == owner);
    // Same signature can be reused!
}

// VULNERABLE: missing nonce
function execute(address to, uint value, bytes memory data, bytes memory sig) {
    bytes32 hash = keccak256(abi.encodePacked(to, value, data, block.chainid));
    address signer = ECDSA.recover(hash, sig);
    require(signer == owner);
    // Replay within same block!
}

// FIX: Include nonce and chain ID
bytes32 hash = keccak256(abi.encodePacked(to, value, data, nonce, block.chainid));

Proxy/Upgrade Vulnerabilities

// VULNERABLE: storage collision
contract Proxy {
    address implementation; // Slot 0
    address owner; // Slot 1
}

contract Implementation {
    address owner; // Slot 0 - COLLISION!
    uint256 value; // Slot 1
}

// VULNERABLE: uninitialized implementation
contract Implementation {
    bool initialized;
    
    function initialize(address _owner) external {
        require(!initialized);
        owner = _owner;
        initialized = true;
    }
    // Missing: disableInitializers() in constructor
}

// FIX: EIP-1967 storage slots
bytes32 private constant IMPLEMENTATION_SLOT = 
    0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc;

// FIX: disableInitializers()
constructor() {
    _disableInitializers();
}

Medium ($1k-$10k)

Denial of Service

// VULNERABLE: iterating over all users
function distributeRewards() external {
    for (uint i = 0; i < users.length; i++) {
        // If array grows too large, gas limit blocks execution
        users[i].transfer(reward);
    }
}

// VULNERABLE: griefing with small deposits
function claimReward() external {
    require(rewards[msg.sender] > 0);
    // Attacker deposits dust → rewards calculation fails
}

// FIX: Pull pattern
mapping(address => uint) public pendingRewards;

function claimReward() external {
    uint amount = pendingRewards[msg.sender];
    pendingRewards[msg.sender] = 0;
    payable(msg.sender).transfer(amount);
}

Front-Running / MEV

// VULNERABLE: transaction ordering dependence
function buyToken() external payable {
    uint price = tokenPrice;
    // Price changes after this tx
    token.transfer(msg.sender, msg.value / price);
}

// VULNERABLE: sandwich attack vector
function swap(uint amountIn, uint amountOutMin) external {
    uint amountOut = getAmountOut(amountIn);
    require(amountOut >= amountOutMin);
    // MEV bot can sandwich this
}

// FIX: Use commit-reveal or private mempool
function buyToken() external payable {
    // Commit phase
    commitments[msg.sender] = keccak256(abi.encodePacked(amount, nonce));
}

function revealBuy(uint amount, uint nonce) external {
    // Reveal phase
    require(commitments[msg.sender] == keccak256(abi.encodePacked(amount, nonce)));
}

Centralization Risks

// VULNERABLE: owner can drain
function withdrawFunds() external onlyOwner {
    payable(owner).transfer(address(this).balance);
}

// VULNERABLE: no timelock
function setFee(uint newFee) external onlyOwner {
    fee = newFee; // Can change instantly
}

// FIX: Timelock + multisig
TimelockController timelock;

function setFee(uint newFee) external {
    // Must go through timelock
    bytes memory data = abi.encodeCall(this.setFee, (newFee));
    timelock.schedule(address(this), 0, data, bytes32(0), bytes32(0), delay);
}

Step 4: DeFi Protocol Attack Patterns

AMM (Uniswap-style)

// Manipulate reserves for profit
function manipulateAMM() external {
    // Step 1: Flash loan large amount
    uint amount = flashLoan(1000000 ether);
    
    // Step 2: Swap to skew reserves
    router.swapExactTokensForTokens(amount, 0, path, address(this), deadline);
    
    // Step 3: Exploit protocol using manipulated price
    protocol.deposit(manipulatedAmount);
    
    // Step 4: Swap back
    router.swapExactTokensForTokens(balance, 0, reversePath, address(this), deadline);
    
    // Step 5: Repay flash loan
    repayFlashLoan();
}

Lending Protocol (Aave-style)

// Liquidation manipulation
function manipulateLiquidation() external {
    // Step 1: Flash loan to crash collateral price
    crashCollateralPrice();
    
    // Step 2: Liquidate position at discount
    lending.liquidate(borrower, collateral, repayAmount);
    
    // Step 3: Restore price
    restorePrice();
    
    // Step 4: Profit from liquidation bonus
}

Vault (ERC4626)

// Share price manipulation
function manipulateVault() external {
    // Step 1: Donate to vault to inflate share price
    token.transfer(address(vault), donationAmount);
    
    // Step 2: Deposit at inflated price
    vault.deposit(depositAmount, address(this));
    
    // Step 3: Withdraw at even higher price
    vault.withdraw(withdrawAmount, address(this), address(this));
    
    // Profit from rounding error
}

Cross-Chain Bridge

// Bridge message manipulation
function exploitBridge() external {
    // Step 1: Send message to source chain
    bridge.sendMessage(destinationChain, payload);
    
    // Step 2: Replay message on destination
    // If bridge doesn't track used messages
    bridge.executeMessage(message, signature);
    
    // Step 3: Repeat for double-spend
}

DAO Governance

// Flash loan governance attack
function attackGovernance() external {
    // Step 1: Flash loan governance tokens
    uint tokens = flashLoan(governanceToken, 1000000 ether);
    
    // Step 2: Vote on proposal
    governance.castVote(proposalId, support);
    
    // Step 3: Repay flash loan
    repayFlashLoan(governanceToken, tokens);
    
    // Governance decision made without holding tokens
}

Step 5: Real-World Exploit Case Studies (2025)

Case Study 1: Balancer V2 ($128M) — Rounding Error

Date: November 3, 2025 Chains: Ethereum, Arbitrum, Optimism, Base, Polygon, Sonic Root Cause: Precision loss in _upscaleArray function

Attack Flow:

1. Deploy exploit contract (constructor executes attack)
2. Push pool balances to critical 8-9 wei threshold
3. Execute 65+ micro-swaps (amount=17 vs balance=18)
4. Each swap loses ~10% precision via mulDown truncation
5. Accumulated error suppresses BPT price artificially
6. Buy BPT at suppressed price, redeem at full value
7. Withdraw via manageUserBalance()

Key Insight: Traditional testing focuses on individual operations, not cumulative effects of adversarial batch operations. The _scalingFactors override (added after OpenZeppelin audit) introduced non-unitary values that made rounding exploitable.

Case Study 2: Yearn yETH ($9M) — State Reset Failure

Date: December 1, 2025 Chain: Ethereum Root Cause: Cached packed_vbs[] values never cleared when pool emptied

Attack Flow:

1. Flash loan LST assets (wstETH, rETH, WETH, etc.)
2. 10+ deposit/withdrawal cycles to poison packed_vbs[] storage
3. Withdraw all liquidity (supply=0, but cached values remain)
4. Deposit 16 wei → triggers "first-ever deposit" logic
5. Protocol reads stale cached values from storage
6. Mints 235 septillion yETH (2.35 × 10^56) from dust deposit
7. Swap minted tokens for real assets, repay flash loan

Key Insight: "supply == 0" does NOT mean "pristine state". Complex DeFi systems need explicit handling of ALL state transitions.

Case Study 3: Cetus ($223M) — Library Bug

Date: May 22, 2025 Chain: Sui Root Cause: Bug in checked_shlw helper in integer-mate library

Attack Flow:

1. Spoofed tokens into tick range 300,000-300,200
2. Flash-loan-funded cycle
3. Contract misprices deposits due to silent overflow
4. Withdraw far more than deposited
5. Validators froze $162M via governance vote (91% stake)

Key Insight: Third-party libraries are an attack surface. Move language's memory safety didn't catch logical error in mask calculation.

Step 6: Manual Code Review Checklist

Focus on high-value areas (updated 2025-2026):

PRIORITY 1 - ROUNDING/PRECISION (2025 #1 Vector):
- [ ] Batch operations: Test cumulative effects, not just individual ops
- [ ] Rounding direction: mulDown vs mulUp in critical paths
- [ ] Scaling factors: Non-unitary values enable precision attacks
- [ ] Small value handling: 8-9 wei range maximizes truncation
- [ ] State reset: All cached values cleared when supply hits zero?
- [ ] Re-initialization: Can bootstrap paths be re-entered adversarially?

PRIORITY 2 - ACCESS CONTROL & LOGIC:
- [ ] External calls: Every .call, .transfer, .send is potential reentrancy
- [ ] State changes: Are they before or after external calls?
- [ ] Access control: Who can call what? Are modifiers correct?
- [ ] Math: Division before multiplication? Rounding? Precision?
- [ ] Upgrades: Storage layout compatible? Initializers protected?

PRIORITY 3 - ECONOMIC ATTACKS:
- [ ] Economic invariants: Can flash loans break assumptions?
- [ ] Oracle dependencies: Single source? Manipulable? TWAP?
- [ ] Token approvals: Unlimited approvals? Race conditions?
- [ ] Callback patterns: Reentrancy via callback tokens (ERC777)?

PRIORITY 4 - IMPLEMENTATION DETAILS:
- [ ] Assembly blocks: Without comments? Unchecked operations?
- [ ] tx.origin usage: Phishing attack vector?
- [ ] Floating pragma: Not pinned to specific version?
- [ ] selfdestruct: Callable by anyone?
- [ ] Block timestamp: Dependence (miners can manipulate ±15s)?
- [ ] Gas limits: DoS via unbounded loops?
- [ ] Integer math: Overflow/underflow in unchecked blocks?
- [ ] Token standards: ERC20 return values checked?
- [ ] Proxy patterns: Storage collision? Uninitialized?
- [ ] Cross-chain: Message validation? Replay protection?
- [ ] Flash loan: Can flash loan break protocol assumptions?
- [ ] Dependencies: All third-party libraries audited?

Step 6: Exploit Development with Foundry

Setup Exploit Project

# Create new Foundry project
forge init exploit-poc
cd exploit-poc

# Install dependencies
forge install openzeppelin/openzeppelin-contracts
forge install foundry-rs/forge-std
forge install aave/aave-v3-core
forge install uniswap/v3-core

Write Exploit Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import "forge-std/Test.sol";
import "../src/VulnerableContract.sol";

contract ExploitTest is Test {
    VulnerableContract target;
    address attacker = address(0x1337);
    
    function setUp() public {
        // Fork mainnet at specific block
        vm.createSelectFork("mainnet", 18000000);
        
        // Deploy or connect to target
        target = VulnerableContract(0xTARGET_ADDRESS);
        
        // Fund attacker
        vm.deal(attacker, 100 ether);
    }
    
    function testExploit() public {
        vm.startPrank(attacker);
        
        // Step 1: Flash loan
        // Step 2: Manipulate price
        // Step 3: Exploit vulnerability
        // Step 4: Repay loan + profit
        
        vm.stopPrank();
        
        // Verify profit
        uint profit = address(this).balance;
        assertGt(profit, 0, "No profit extracted");
        emit log_named_uint("Profit (ETH)", profit);
    }
}

Flash Loan Exploit Template

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import "forge-std/Test.sol";
import "../src/VulnerableProtocol.sol";

interface IFlashLoanPool {
    function flashLoan(
        address receiver,
        address token,
        uint256 amount,
        bytes calldata params
    ) external;
}

contract FlashLoanExploit is Test {
    VulnerableProtocol target;
    IFlashLoanPool pool;
    IERC20 token;
    address attacker = address(0x1337);
    
    function setUp() public {
        vm.createSelectFork("mainnet", 18000000);
        
        target = VulnerableProtocol(0xTARGET);
        pool = IFlashLoanPool(0xPOOL);
        token = IERC20(0xTOKEN);
        
        vm.deal(attacker, 10 ether);
    }
    
    function testFlashLoanExploit() public {
        vm.startPrank(attacker);
        
        // Initiate flash loan
        pool.flashLoan(
            address(this),
            address(token),
            1000000 ether,
            abi.encode("attack")
        );
        
        vm.stopPrank();
        
        // Verify profit
        uint profit = token.balanceOf(address(this));
        assertGt(profit, 0, "No profit");
        emit log_named_uint("Profit", profit);
    }
    
    function executeOperation(
        address asset,
        uint256 amount,
        uint256 premium,
        address initiator,
        bytes calldata params
    ) external returns (bool) {
        // Attack logic here
        exploitProtocol();
        
        // Repay flash loan
        IERC20(asset).transfer(pool, amount + premium);
        
        return true;
    }
    
    function exploitProtocol() internal {
        // Manipulate price
        // Exploit vulnerability
        // Extract profit
    }
}

Run Exploit

# Run test
forge test --match-test testExploit -vvvv

# Fork from specific block
forge test --fork-url https://eth-mainnet.alchemyapi.io/v2/YOUR_KEY --fork-block-number 18000000

# Gas snapshot
forge snapshot

# Debug with traces
forge test --match-test testDebug -vvvv --debug

Step 7: Arkham Intelligence Specifics

Arkham Intelligence focuses on on-chain intelligence and attribution:

1. Target Selection — Focus on protocols with high TVL and complex tokenomics
2. Attribution Analysis — Map wallet addresses to entities
3. Transaction Pattern Analysis — Identify suspicious flows
4. Smart Contract Auditing — Full audit of deployed contracts
5. Economic Attack Modeling — Simulate flash loan scenarios
6. L2 Coverage — Optimism, Arbitrum, zkSync, Base

# Query Arkham API for contract intelligence
curl -X GET "https://api.arkhamintelligence.com/v1/contracts/0xADDRESS" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Get transaction history
curl -X GET "https://api.arkhamintelligence.com/v1/transactions/0xADDRESS" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Get entity attribution
curl -X GET "https://api.arkhamintelligence.com/v1/entities/0xADDRESS" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Get fund flows
curl -X GET "https://api.arkhamintelligence.com/v1/flows/0xADDRESS" \
  -H "Authorization: Bearer YOUR_API_KEY"

Step 8: Multi-Language Support

Vyper Contracts

# Slither supports Vyper
slither contract.vy

# Manual review focuses on:
# - Reentrancy (Vyper has no built-in guard)
# - Integer overflow (pre-0.3.0)
# - Access control (no modifiers, use @external)

Move Contracts (Sui, Aptos)

# Move-specific vulnerabilities:
# - Resource handling errors
# - Reference safety issues
# - Module initialization bugs
# - Event emission issues

# Tools:
# - Move Prover (formal verification)
# - Sui security scanner
# - Aptos CLI audit

Cairo Contracts (StarkNet)

# Cairo-specific vulnerabilities:
# - Felt overflow (252-bit prime field)
# - Storage layout issues
# - syscall handling
# - Reference counting bugs

# Tools:
# - Cairo security scanner
# - StarkNet audit tools

Step 9: Report Format (Immunefi/Arkham)

## Title
[Severity] Brief description of vulnerability

## Target
Contract: 0x...
Chain: Ethereum/Arbitrum/Optimism/Polygon/Base
TVL: $X
Block: X

## Vulnerability Type
Reentrancy / Access Control / Oracle Manipulation / Flash Loan / MEV / etc.

## Impact
- Funds at risk: $X
- Attack complexity: Low/Medium/High
- Prerequisites: Flash loan capital, specific conditions
- Affected users: All / Specific positions

## Root Cause
[Technical explanation of why the vulnerability exists]

## Proof of Concept
[Working Foundry/Hardhat test with detailed comments]

## Attack Flow
1. Step 1: ...
2. Step 2: ...
3. Step 3: ...

## Recommended Fix
[Specific code change with before/after comparison]

## References
- SWC-ID: SWC-XXX
- CWE: CWE-XXX
- Similar exploits: [Link to past incidents]

Revenue Potential

Web3-Specific Red Flags

• tx.origin for authentication (phishing attack vector)
• Floating pragma (pragma solidity ^0.8.0 instead of specific version)
• selfdestruct callable by anyone
• Unchecked return values from .call()
• Block timestamp dependence (miners can manipulate ±15s)
• Assembly blocks without comments
• Missing events for state changes
• No reentrancy guard on external calls with state changes
• Single oracle source without TWAP
• Unlimited token approvals
• Missing pause mechanism for emergencies
• No timelock on admin functions
• Centralized upgrade authority

Tools

Bug Bounty Platforms (Updated 2026)

Top Active Bounties (March 2026)

Immunefi Q1 2026 Statistics

• Total Payouts: $7.87M (+228% QoQ)
• Paid Reports: 1,104
• Average Payout: $7,131 per report (+178% QoQ)
• Notable Criticals: $300K, $125K, $100K
• Cumulative All-Time: $134M+
• Active Programs: 230+
• TVL Protected: $190B+
• Critical Disclosure Share: 92.33%

Payout Statistics

Practice Platforms

• Damn Vulnerable DeFi — DeFi security puzzles
• Ethernaut — Smart contract CTF
• Paradigm CTF — Advanced challenges
• Curta CTF — On-chain puzzles
• Sherlock Practice — Past audit contests
• DeFi Hack Labs — Reproduce DeFi hacks
• DeFi Vulnerability — Vulnerability database
• Smart Contract Hacking — Free courses

Red Flags

• Performing actions without explicit written authorization from the asset owner
• Testing against production systems without a defined scope and rules of engagement
• Exploiting vulnerabilities for personal gain (always report responsibly)
• Sharing exploit code publicly before patches are deployed
• Failing to quantify economic impact accurately
• Not considering second-order effects of exploits
• Ignoring cross-chain implications

Verification

• All findings have working Foundry/Hardhat test cases
• Economic impact is quantified (not just "could lose funds")
• No false positives from automated tools
• Reports follow platform-specific format (Immunefi, Arkham, etc.)
• Findings include specific code fixes
• Exploit is non-destructive (demonstrates vulnerability without draining funds)
• Cross-chain effects considered
• Flash loan requirements documented

References

• Immunefi Bug Bounty Standard
• SWC Registry — Smart Contract Weakness Classification
• Trail of Bits: Not All Bugs Are Created Equal
• Consensys Best Practices
• Solidity by Example
• Foundry Book
• DeFi Hack Labs
• Smart Contract Security Best Practices
• OpenZeppelin Security

Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table