defi-attack-patterns

Name: defi-attack-patterns
Author: Prohao42

91stars8forks

How to install defi-attack-patterns?

prohao42/aimy-skill/defi-attack-patterns

$npx -y skills add Prohao42/aimy-skill --skill defi-attack-patterns

Installs into the current project.

Summary

DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilities, and token standard edge cases in decentralized finance protocols.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: DeFi Attack Patterns — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert DeFi exploitation techniques. Covers flash loan mechanics, oracle manipulation (spot vs TWAP), MEV extraction (sandwich, JIT, liquidation), precision loss attacks, governance exploits, bridge vulnerabilities, and token standard pitfalls. Base models often miss the single-transaction atomicity constraint of flash loans and the distinction between spot price and TWAP manipulation.
4
5	## 0. RELATED ROUTING
6
7	- [smart-contract-vulnerabilities](../smart-contract-vulnerabilities/SKILL.md) for underlying Solidity vulnerability patterns (reentrancy, integer overflow, delegatecall)
8	- [deserialization-insecure](../deserialization-insecure/SKILL.md) when targeting off-chain bridge relayer or indexer infrastructure
9
10	---
11
12	## 1. FLASH LOAN ATTACKS
13
14	### 1.1 Mechanism
15
16	Flash loans provide uncollateralized borrowing within a single transaction. The entire borrow → use → repay cycle must complete atomically; if repayment fails, the transaction reverts as if nothing happened.
17
18	\| Provider \| Max Amount \| Fee \|
19	\|---\|---\|---\|
20	\| Aave V3 \| Pool liquidity per asset \| 0.05% (can be 0 for approved borrowers) \|
21	\| dYdX \| Pool liquidity \| 0 (uses internal balance manipulation) \|
22	\| Uniswap V3 \| Pool liquidity per pair \| 0.3% (swap fee tier) \|
23	\| Balancer \| Pool liquidity \| Protocol-configurable \|
24
25	### 1.2 Price Oracle Manipulation
26
27	```
28	1. Flash borrow 100,000 WETH
29	2. Swap 100,000 WETH → TOKEN on AMM_A
30	→ TOKEN spot price on AMM_A skyrockets
31	3. On Lending_Protocol (reads AMM_A spot price as oracle):
32	→ Deposit small TOKEN collateral (valued at inflated price)
33	→ Borrow large amount of WETH against it
34	4. Swap TOKEN back → WETH on AMM_A (restore price)
35	5. Repay flash loan (100,000 WETH + fee)
36	6. Keep borrowed WETH from Lending_Protocol minus collateral cost
37	```
38
39	Key insight: protocols using AMM spot reserves (`getReserves()`) as price oracles are vulnerable. Must use TWAP or external oracle (Chainlink).
40
41	### 1.3 Liquidity Pool Drain via Reentrancy
42
43	Flash borrow → deposit into pool → trigger reentrancy during callback → withdraw more than deposited → repay loan.
44
45	Exploits the combination of flash loan capital with reentrancy in pool accounting logic.
46
47	### 1.4 Governance Flash Borrow
48
49	```
50	1. Flash borrow governance tokens
51	2. Create/vote on malicious proposal (if no snapshot or timelock)
52	3. Proposal passes instantly
53	4. Execute proposal (drain treasury, change admin, etc.)
54	5. Return governance tokens
55	```
56
57	Defense: snapshot-based voting (Compound Governor Bravo), timelocks, minimum proposal period.
58
59	---
60
61	## 2. PRICE ORACLE MANIPULATION
62
63	### 2.1 Spot Price vs TWAP
64
65	\| Oracle Type \| Manipulation Cost \| Time Window \|
66	\|---\|---\|---\|
67	\| Spot price (`getReserves()`) \| Single large swap (flash loanable) \| Same transaction \|
68	\| TWAP (Time-Weighted Average) \| Sustained multi-block manipulation \| Multiple blocks (expensive) \|
69	\| Chainlink aggregator \| Compromise ≥ majority of oracle nodes \| Practically infeasible \|
70
71	### 2.2 AMM Manipulation Flow
72
73	```
74	Normal state: Pool has 1000 ETH + 1,000,000 USDC → price = 1000 USDC/ETH
75
76	Attack:
77	├── Swap 9000 ETH into pool
78	│ Pool now: 10000 ETH + 100,000 USDC (constant product)
79	│ Spot price: 10 USDC/ETH (crashed 100x)
80	├── Dependent contract reads this price
81	│ → Liquidates positions at wrong price
82	│ → Or allows cheap borrowing against ETH collateral
83	├── Swap back: buy ETH with USDC
84	│ Price restores to ~1000 USDC/ETH
85	└── Net profit = value extracted from dependent contract - swap slippage - fees
86	```
87
88	### 2.3 Chainlink Oracle Staleness
89
90	```solidity
91	(, int price, , uint updatedAt, ) = priceFeed.latestRoundData();
92	// Missing checks:
93	// 1. price > 0
94	// 2. updatedAt != 0
95	// 3. block.timestamp - updatedAt < HEARTBEAT
96	// 4. answeredInRound >= roundId
97	```
98
99	If oracle is stale (network congestion, L2 sequencer down), price can be hours old → arbitrage against stale price.
100
101	L2 Sequencer Risk: If Arbitrum/Optimism sequencer is down, Chainlink prices freeze. When it comes back, prices jump → mass liquidations at wrong prices.
102
103	---
104
105	## 3. MEV (MAXIMAL EXTRACTABLE VALUE)
106
107	### 3.1 Sandwich Attack
108
109	```
110	Mempool observation: victim submits swap TOKEN_A → TOKEN_B with slippage 1%
111
112	Front-run: Buy TOKEN_B (increase price)
113	Victim tx: Swap executes at worse price (within slippage tolerance)
114	Back-run: Sell TOKEN_B (profit from price impact)
115
116	Profit = victim's price impact - gas costs × 2
117	```
118
119	### 3.2 JIT (Just-In-Time) Liquidity
120
121	```
122	1. Observe large pending swap in mempool
123	2. Provide concentrated liquidity in the exact price range (Uniswap V3 tick)
124	3. Victim's swap executes → JIT LP earns majority of fees
125	4. Remove liquidity immediately after swap
126	5. Profit = fe

People who liked this also viewed

6 picks

Type

defi-attack-patterns

91stars8forks

View on GitHub

How to install defi-attack-patterns?

prohao42/aimy-skill/defi-attack-patterns

$npx -y skills add Prohao42/aimy-skill --skill defi-attack-patterns

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: DeFi Attack Patterns — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert DeFi exploitation techniques. Covers flash loan mechanics, oracle manipulation (spot vs TWAP), MEV extraction (sandwich, JIT, liquidation), precision loss attacks, governance exploits, bridge vulnerabilities, and token standard pitfalls. Base models often miss the single-transaction atomicity constraint of flash loans and the distinction between spot price and TWAP manipulation.
4
5	## 0. RELATED ROUTING
6
7	- [smart-contract-vulnerabilities](../smart-contract-vulnerabilities/SKILL.md) for underlying Solidity vulnerability patterns (reentrancy, integer overflow, delegatecall)
8	- [deserialization-insecure](../deserialization-insecure/SKILL.md) when targeting off-chain bridge relayer or indexer infrastructure
9
10	---
11
12	## 1. FLASH LOAN ATTACKS
13
14	### 1.1 Mechanism
15
16	Flash loans provide uncollateralized borrowing within a single transaction. The entire borrow → use → repay cycle must complete atomically; if repayment fails, the transaction reverts as if nothing happened.
17
18	\| Provider \| Max Amount \| Fee \|
19	\|---\|---\|---\|
20	\| Aave V3 \| Pool liquidity per asset \| 0.05% (can be 0 for approved borrowers) \|
21	\| dYdX \| Pool liquidity \| 0 (uses internal balance manipulation) \|
22	\| Uniswap V3 \| Pool liquidity per pair \| 0.3% (swap fee tier) \|
23	\| Balancer \| Pool liquidity \| Protocol-configurable \|
24
25	### 1.2 Price Oracle Manipulation
26
27	```
28	1. Flash borrow 100,000 WETH
29	2. Swap 100,000 WETH → TOKEN on AMM_A
30	→ TOKEN spot price on AMM_A skyrockets
31	3. On Lending_Protocol (reads AMM_A spot price as oracle):
32	→ Deposit small TOKEN collateral (valued at inflated price)
33	→ Borrow large amount of WETH against it
34	4. Swap TOKEN back → WETH on AMM_A (restore price)
35	5. Repay flash loan (100,000 WETH + fee)
36	6. Keep borrowed WETH from Lending_Protocol minus collateral cost
37	```
38
39	Key insight: protocols using AMM spot reserves (`getReserves()`) as price oracles are vulnerable. Must use TWAP or external oracle (Chainlink).
40
41	### 1.3 Liquidity Pool Drain via Reentrancy
42
43	Flash borrow → deposit into pool → trigger reentrancy during callback → withdraw more than deposited → repay loan.
44
45	Exploits the combination of flash loan capital with reentrancy in pool accounting logic.
46
47	### 1.4 Governance Flash Borrow
48
49	```
50	1. Flash borrow governance tokens
51	2. Create/vote on malicious proposal (if no snapshot or timelock)
52	3. Proposal passes instantly
53	4. Execute proposal (drain treasury, change admin, etc.)
54	5. Return governance tokens
55	```
56
57	Defense: snapshot-based voting (Compound Governor Bravo), timelocks, minimum proposal period.
58
59	---
60
61	## 2. PRICE ORACLE MANIPULATION
62
63	### 2.1 Spot Price vs TWAP
64
65	\| Oracle Type \| Manipulation Cost \| Time Window \|
66	\|---\|---\|---\|
67	\| Spot price (`getReserves()`) \| Single large swap (flash loanable) \| Same transaction \|
68	\| TWAP (Time-Weighted Average) \| Sustained multi-block manipulation \| Multiple blocks (expensive) \|
69	\| Chainlink aggregator \| Compromise ≥ majority of oracle nodes \| Practically infeasible \|
70
71	### 2.2 AMM Manipulation Flow
72
73	```
74	Normal state: Pool has 1000 ETH + 1,000,000 USDC → price = 1000 USDC/ETH
75
76	Attack:
77	├── Swap 9000 ETH into pool
78	│ Pool now: 10000 ETH + 100,000 USDC (constant product)
79	│ Spot price: 10 USDC/ETH (crashed 100x)
80	├── Dependent contract reads this price
81	│ → Liquidates positions at wrong price
82	│ → Or allows cheap borrowing against ETH collateral
83	├── Swap back: buy ETH with USDC
84	│ Price restores to ~1000 USDC/ETH
85	└── Net profit = value extracted from dependent contract - swap slippage - fees
86	```
87
88	### 2.3 Chainlink Oracle Staleness
89
90	```solidity
91	(, int price, , uint updatedAt, ) = priceFeed.latestRoundData();
92	// Missing checks:
93	// 1. price > 0
94	// 2. updatedAt != 0
95	// 3. block.timestamp - updatedAt < HEARTBEAT
96	// 4. answeredInRound >= roundId
97	```
98
99	If oracle is stale (network congestion, L2 sequencer down), price can be hours old → arbitrage against stale price.
100
101	L2 Sequencer Risk: If Arbitrum/Optimism sequencer is down, Chainlink prices freeze. When it comes back, prices jump → mass liquidations at wrong prices.
102
103	---
104
105	## 3. MEV (MAXIMAL EXTRACTABLE VALUE)
106
107	### 3.1 Sandwich Attack
108
109	```
110	Mempool observation: victim submits swap TOKEN_A → TOKEN_B with slippage 1%
111
112	Front-run: Buy TOKEN_B (increase price)
113	Victim tx: Swap executes at worse price (within slippage tolerance)
114	Back-run: Sell TOKEN_B (profit from price impact)
115
116	Profit = victim's price impact - gas costs × 2
117	```
118
119	### 3.2 JIT (Just-In-Time) Liquidity
120
121	```
122	1. Observe large pending swap in mempool
123	2. Provide concentrated liquidity in the exact price range (Uniswap V3 tick)
124	3. Victim's swap executes → JIT LP earns majority of fees
125	4. Remove liquidity immediately after swap
126	5. Profit = fe

People who liked this also viewed

6 picks

Type