web3-grep-arsenal

Name: web3-grep-arsenal
Author: shuvonsec

110stars29forks

How to install web3-grep-arsenal?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-grep-arsenal

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-grep-arsenal

Installs into the current project.

Summary

Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes.

Files · 1

View on GitHub

SKILL.md

1	# GREP ARSENAL — MASTER REFERENCE
2	> All grep commands in one place. Run in the first 30 minutes of any new target.
3	> Replaces: 03-grep-surface-map, 14-grep-master-patterns + grep sections from 04-13
4
5	---
6
7	## HOW TO USE THE SURFACE MAP
8
9	Process:
10	1. Run ALL 10 blocks below (takes ~5 min)
11	2. Collect all results in a notes file
12	3. Tier-rank the hits (see Tier System below)
13	4. In pass 1: READ everything, DON'T investigate yet
14	5. In pass 2: Deep-dive on Tier 1 + 2 items
15
16	Tier System:
17	- Tier 1 — Near privileged code, external calls, or state changes with no guards → Investigate first
18	- Tier 2 — Interesting patterns that need context before judging → Investigate after Tier 1
19	- Tier 3 — Informational only (documentation, test files, comments) → Skip unless Tier 1+2 exhausted
20
21	---
22
23	## THE 10 GREP BLOCKS (Copy-Paste Each)
24
25	### Block 1 — Access Control
26
27	```bash
28	echo "=== ACCESS CONTROL ===" && \
29	grep -rn "tx\.origin" src/ --include="*.sol" && \
30	grep -rn "msg\.sender == owner\b" src/ --include="*.sol" && \
31	grep -rn "modifier only" src/ --include="*.sol" -A5 && \
32	grep -rn "onlyOwner\\|onlyAdmin\\|onlyRole" src/ --include="*.sol" \| wc -l && \
33	grep -rn "def admin_\\|router\..admin\\|function.[Aa]dmin" src/ --include="*.sol"
34	```
35
36	Red flags:
37	- `tx.origin` used for auth → Tier 1 (phishing vector)
38	- Modifier uses `if (condition) { _; }` without else → Tier 1 (silent bypass — function still executes for unauthorized callers)
39	- `onlyOwner` count << total external function count → likely missing guards on siblings
40
41	### Block 2 — Reentrancy
42
43	```bash
44	echo "=== REENTRANCY ===" && \
45	grep -rn "\.call{value\\|\.call(" src/ --include="*.sol" && \
46	grep -rn "\.transfer(\\|\.send(" src/ --include="*.sol" && \
47	grep -rn "safeTransfer\\|safeTransferFrom" src/ --include="*.sol" && \
48	grep -rn "onERC721Received\\|onERC1155Received\\|tokensReceived" src/ --include="*.sol" && \
49	grep -rn "nonReentrant\\|ReentrancyGuard" src/ --include="*.sol"
50	```
51
52	Red flags:
53	- `.call{value:}` or `safeTransfer` BEFORE state updates in same function → Tier 1 (CEI violation)
54	- `onERC721Received`/`onERC1155Received` hooks present → check for reentrancy path
55	- External calls present but `nonReentrant` missing → verify CEI is followed
56
57	### Block 3 — Oracle / Price
58
59	```bash
60	echo "=== ORACLE / PRICE ===" && \
61	grep -rn "slot0\b" src/ --include="*.sol" && \
62	grep -rn "getReserves()" src/ --include="*.sol" && \
63	grep -rn "latestRoundData\\|latestAnswer" src/ --include="*.sol" && \
64	grep -rn "updatedAt" src/ --include="*.sol" && \
65	grep -rn "block\.timestamp" src/ --include="*.sol" \| grep -v "//\\|test\\|Test" \| head -20
66	```
67
68	Red flags:
69	- `slot0()` used for price → Tier 1 (Uniswap V3 spot, flash-loan manipulable)
70	- `getReserves()` used for price → Tier 1 (Uniswap V2 spot, flash-loan manipulable)
71	- `latestRoundData` without `updatedAt` check → Tier 1 (stale Chainlink price)
72	- `latestAnswer` → Tier 1 (deprecated, no round validation)
73
74	### Block 4 — Arithmetic / Math
75
76	```bash
77	echo "=== ARITHMETIC ===" && \
78	grep -rn "unchecked {" src/ --include="*.sol" && \
79	grep -rn "/ \\|/=" src/ --include="*.sol" \| grep -v "//\\|test\\|Test" \| head -30 && \
80	grep -rn "mulDiv\\|FullMath\\|PRBMath" src/ --include="*.sol" && \
81	grep -rn "\* 10\\\\|* 1e18\\|* WAD\\|* RAY" src/ --include="*.sol"
82	```
83
84	Red flags:
85	- `unchecked {}` blocks → manually verify each (Solidity 0.8+ unwraps here)
86	- Division before multiplication (`a / b * c`) → precision loss
87	- `/ 1e18` in contract that handles 6-decimal tokens → decimal mismatch
88
89	### Block 5 — Input Validation
90
91	```bash
92	echo "=== INPUT VALIDATION ===" && \
93	grep -rn "address(0)\b" src/ --include="*.sol" && \
94	grep -rn "require.length\\|\.length ==" src/ --include=".sol" && \
95	grep -rn "delegatecall" src/ --include="*.sol" && \
96	grep -rn "abi\.decode\\|abi\.encodePacked" src/ --include="*.sol" \| head -20
97	```
98
99	Red flags:
100	- `delegatecall` with user-controlled target → Tier 1 (arbitrary code execution)
101	- `abi.decode` on user-supplied calldata without length validation → Tier 1
102	- Array params in batch functions without dedup check → Tier 1 (double-count attack)
103
104	### Block 6 — Token Handling
105
106	```bash
107	echo "=== TOKEN HANDLING ===" && \
108	grep -rn "IERC20\.\\|ERC20\." src/ --include="*.sol" \| grep "transfer\b\\|transferFrom\b" && \
109	grep -rn "SafeERC20\\|safeTransfer\b" src/ --include="*.sol" \| head -10 && \
110	grep -rn "balanceOf(address(this))" src/ --include="*.sol" && \
111	grep -rn "permit(" src/ --include="*.sol" \| grep -v "//\\|IERC20Permit" && \
112	grep -rn "try.permit\\|catch.permit" src/ --include="*.sol"
113	```
114
115	Red flags:
116	- `token.transfer()` without `SafeERC20.safeTransfer()` → Tier 1 (return value uncheck

People who liked this also viewed

6 picks

Type

web3-grep-arsenal

110stars29forks

View on GitHub

How to install web3-grep-arsenal?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-grep-arsenal

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-grep-arsenal

Installs into the current project.

Summary

Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes.

Files · 1

View on GitHub

SKILL.md

1	# GREP ARSENAL — MASTER REFERENCE
2	> All grep commands in one place. Run in the first 30 minutes of any new target.
3	> Replaces: 03-grep-surface-map, 14-grep-master-patterns + grep sections from 04-13
4
5	---
6
7	## HOW TO USE THE SURFACE MAP
8
9	Process:
10	1. Run ALL 10 blocks below (takes ~5 min)
11	2. Collect all results in a notes file
12	3. Tier-rank the hits (see Tier System below)
13	4. In pass 1: READ everything, DON'T investigate yet
14	5. In pass 2: Deep-dive on Tier 1 + 2 items
15
16	Tier System:
17	- Tier 1 — Near privileged code, external calls, or state changes with no guards → Investigate first
18	- Tier 2 — Interesting patterns that need context before judging → Investigate after Tier 1
19	- Tier 3 — Informational only (documentation, test files, comments) → Skip unless Tier 1+2 exhausted
20
21	---
22
23	## THE 10 GREP BLOCKS (Copy-Paste Each)
24
25	### Block 1 — Access Control
26
27	```bash
28	echo "=== ACCESS CONTROL ===" && \
29	grep -rn "tx\.origin" src/ --include="*.sol" && \
30	grep -rn "msg\.sender == owner\b" src/ --include="*.sol" && \
31	grep -rn "modifier only" src/ --include="*.sol" -A5 && \
32	grep -rn "onlyOwner\\|onlyAdmin\\|onlyRole" src/ --include="*.sol" \| wc -l && \
33	grep -rn "def admin_\\|router\..admin\\|function.[Aa]dmin" src/ --include="*.sol"
34	```
35
36	Red flags:
37	- `tx.origin` used for auth → Tier 1 (phishing vector)
38	- Modifier uses `if (condition) { _; }` without else → Tier 1 (silent bypass — function still executes for unauthorized callers)
39	- `onlyOwner` count << total external function count → likely missing guards on siblings
40
41	### Block 2 — Reentrancy
42
43	```bash
44	echo "=== REENTRANCY ===" && \
45	grep -rn "\.call{value\\|\.call(" src/ --include="*.sol" && \
46	grep -rn "\.transfer(\\|\.send(" src/ --include="*.sol" && \
47	grep -rn "safeTransfer\\|safeTransferFrom" src/ --include="*.sol" && \
48	grep -rn "onERC721Received\\|onERC1155Received\\|tokensReceived" src/ --include="*.sol" && \
49	grep -rn "nonReentrant\\|ReentrancyGuard" src/ --include="*.sol"
50	```
51
52	Red flags:
53	- `.call{value:}` or `safeTransfer` BEFORE state updates in same function → Tier 1 (CEI violation)
54	- `onERC721Received`/`onERC1155Received` hooks present → check for reentrancy path
55	- External calls present but `nonReentrant` missing → verify CEI is followed
56
57	### Block 3 — Oracle / Price
58
59	```bash
60	echo "=== ORACLE / PRICE ===" && \
61	grep -rn "slot0\b" src/ --include="*.sol" && \
62	grep -rn "getReserves()" src/ --include="*.sol" && \
63	grep -rn "latestRoundData\\|latestAnswer" src/ --include="*.sol" && \
64	grep -rn "updatedAt" src/ --include="*.sol" && \
65	grep -rn "block\.timestamp" src/ --include="*.sol" \| grep -v "//\\|test\\|Test" \| head -20
66	```
67
68	Red flags:
69	- `slot0()` used for price → Tier 1 (Uniswap V3 spot, flash-loan manipulable)
70	- `getReserves()` used for price → Tier 1 (Uniswap V2 spot, flash-loan manipulable)
71	- `latestRoundData` without `updatedAt` check → Tier 1 (stale Chainlink price)
72	- `latestAnswer` → Tier 1 (deprecated, no round validation)
73
74	### Block 4 — Arithmetic / Math
75
76	```bash
77	echo "=== ARITHMETIC ===" && \
78	grep -rn "unchecked {" src/ --include="*.sol" && \
79	grep -rn "/ \\|/=" src/ --include="*.sol" \| grep -v "//\\|test\\|Test" \| head -30 && \
80	grep -rn "mulDiv\\|FullMath\\|PRBMath" src/ --include="*.sol" && \
81	grep -rn "\* 10\\\\|* 1e18\\|* WAD\\|* RAY" src/ --include="*.sol"
82	```
83
84	Red flags:
85	- `unchecked {}` blocks → manually verify each (Solidity 0.8+ unwraps here)
86	- Division before multiplication (`a / b * c`) → precision loss
87	- `/ 1e18` in contract that handles 6-decimal tokens → decimal mismatch
88
89	### Block 5 — Input Validation
90
91	```bash
92	echo "=== INPUT VALIDATION ===" && \
93	grep -rn "address(0)\b" src/ --include="*.sol" && \
94	grep -rn "require.length\\|\.length ==" src/ --include=".sol" && \
95	grep -rn "delegatecall" src/ --include="*.sol" && \
96	grep -rn "abi\.decode\\|abi\.encodePacked" src/ --include="*.sol" \| head -20
97	```
98
99	Red flags:
100	- `delegatecall` with user-controlled target → Tier 1 (arbitrary code execution)
101	- `abi.decode` on user-supplied calldata without length validation → Tier 1
102	- Array params in batch functions without dedup check → Tier 1 (double-count attack)
103
104	### Block 6 — Token Handling
105
106	```bash
107	echo "=== TOKEN HANDLING ===" && \
108	grep -rn "IERC20\.\\|ERC20\." src/ --include="*.sol" \| grep "transfer\b\\|transferFrom\b" && \
109	grep -rn "SafeERC20\\|safeTransfer\b" src/ --include="*.sol" \| head -10 && \
110	grep -rn "balanceOf(address(this))" src/ --include="*.sol" && \
111	grep -rn "permit(" src/ --include="*.sol" \| grep -v "//\\|IERC20Permit" && \
112	grep -rn "try.permit\\|catch.permit" src/ --include="*.sol"
113	```
114
115	Red flags:
116	- `token.transfer()` without `SafeERC20.safeTransfer()` → Tier 1 (return value uncheck

People who liked this also viewed

6 picks

Type