web3-hunt-foundation

Name: web3-hunt-foundation
Author: shuvonsec

110stars29forks

How to install web3-hunt-foundation?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-hunt-foundation

Installs into the current project.

Summary

Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environment, understanding architecture.

Files · 1

View on GitHub

SKILL.md

1	# WEB3 HUNT FOUNDATION
2	> Mindset + Recon + Setup. Read this before touching any new target's code.
3	> Replaces: 01-mindset, 02-recon-setup, 20-chain-complete
4
5	---
6
7	## PART 1: THE HUNTER MINDSET
8
9	### The Core Mental Shift
10
11	You are NOT looking for "vulnerabilities" in the abstract.
12	You are looking for specific actions an attacker can take TODAY that result in profit.
13
14	Everything flows from one question: "What can I STEAL, FREEZE, or DESTROY — and what do I END UP WITH?"
15
16	### The Bug Validation Template
17
18	Apply to every finding before writing a single line:
19
20	```
21	I am an attacker. I will:
22	1. SETUP: What do I need? (wallet, capital, any whitelisted permissions?)
23	2. CALL: Exact transactions, exact order, exact function names
24	3. RESULT: What do I end up with that I didn't start with?
25	4. COST: Gas + capital + flash loan fee + any other expense
26	5. DETECT: Can anyone stop or reverse this?
27	6. NET ROI: I gained X at cost of Y. Is Y << X?
28	```
29
30	If you can't fill in steps 2 and 3 with specific function calls → it's not a real bug. Stop. Move on.
31
32	### 10 Attacker Questions (Ask For Every External Function)
33
34	1. What if `amount = 0`? Does anything revert or silently pass?
35	2. What if I call this function twice in the same block?
36	3. What if I call this before `initialize()` is called?
37	4. What if I front-run this transaction?
38	5. What if the external call fails? Does state get half-updated?
39	6. What if the token has fee-on-transfer? Does `amount received ≠ amount sent`?
40	7. What if I pass `address(0)` or a malicious contract as an address param?
41	8. What if I pass `type(uint256).max` as a numeric param?
42	9. Can I combine this with a flash loan? (zero-cost capital changes the math)
43	10. Does a sibling function lack the same modifier this function has?
44
45	> Question #10 explains 19% of all Critical findings. If `vote()` has `onlyRole(VOTER)`, check `poke()`, `reset()`, `harvest()` — the missing modifier on the sibling IS the bug.
46
47	### 6 Triager Counter-Questions (Disprove Your Own Finding)
48
49	Before spending time on a PoC, try to KILL the finding:
50
51	1. Is there an upstream check I missed that actually prevents this?
52	2. Is this documented intended behavior (whitepaper, NatSpec, design decision)?
53	3. Does exploitation require admin/privileged access? (Usually invalid if yes)
54	4. Is the economic cost to exploit greater than the gain? (Not viable if yes)
55	5. Was this flagged in a prior audit as "acknowledged" or "risk accepted"?
56	6. Is the "sensitive" data already publicly visible to anyone in the web UI?
57
58	One YES = KILL. Move on.
59
60	### 5-Minute Rule
61
62	If you've been on the same function for 5 minutes with no clear attack path → STOP.
63	Add it to a low-priority list. Move to the next function.
64	Top hunters: 95% fast-reject + 5% deep dives on confirmed leads.
65
66	### Depth Over Breadth
67
68	Don't review 10 protocols in one week. Pick ONE. Spend 3-5 days becoming the expert.
69	Protocol-specific knowledge compounds. The Curve expert found 5 bugs. The 10-protocol tourist found 0.
70
71	### Inconsistency Is Proof
72
73	If `functionA()` has a security check, and `functionB()` doesn't — that IS the report.
74	You don't need to fully understand why. The inconsistency proves the developer intended the check.
75
76	---
77
78	## PART 2: TARGET SCORING — GO / NO-GO
79
80	Before touching any code: score the target. Score < 6 → skip.
81
82	### Target Scorecard
83
84	\| Criterion \| Points \| How to Check \|
85	\|-----------\|--------\|-------------\|
86	\| Max bounty ≥ $50K \| +2 \| Immunefi program page \|
87	\| TVL > $1M \| +2 \| DeFiLlama \|
88	\| Program launched < 30 days ago \| +2 \| Immunefi "new" filter \|
89	\| Custom math (AMM/vault/lending) \| +1 \| Read scope contracts \|
90	\| Recent code changes \| +1 \| `git log --oneline -20` \|
91	\| Prior audits available \| +1 \| Program page / GitHub \|
92	\| In-scope includes smart contracts \| +1 \| Scope section \|
93	\| Protocol type you know well \| +1 \| Your specialization \|
94	\| Source code public/readable \| +1 \| GitHub / Etherscan verified \|
95
96	< 4: Skip — too small, too audited, wrong fit
97	4-5: Only if nothing better available
98	6-8: Good — spend 1-3 days
99	≥ 9: Excellent — spend up to 1 week
100
101	---
102
103	## PART 3: RECON METHODOLOGY (30-Minute Protocol)
104
105	### Step 1 — Read Immunefi Page (5 min)
106
107	```
108	Note:
109	- All in-scope contract addresses + GitHub links
110	- Out-of-scope list (DO NOT report these)
111	- Primacy of Impact: YES/NO (YES = more forgiving on novel impacts)
112	- Max bounty amounts by severity
113	- Time on Immunefi (newer = fewer duplicates)
114	```
115
116	### Step 2 — Clone + Setup (5 min)
117
118	```bash
119	git clone <target-repo>
120	cd <target-repo>
121	git log --oneline -20 # Recent changes = freshest bugs here
122	forge build

People who liked this also viewed

6 picks

Type

web3-hunt-foundation

110stars29forks

View on GitHub

How to install web3-hunt-foundation?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-hunt-foundation

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-hunt-foundation

Installs into the current project.

Summary

Hunter mindset, recon setup, and target scoring for Web3 bug bounty. Use at the START of any new protocol hunt - scoring targets, setting up environment, understanding architecture.

Files · 1

View on GitHub

SKILL.md

1	# WEB3 HUNT FOUNDATION
2	> Mindset + Recon + Setup. Read this before touching any new target's code.
3	> Replaces: 01-mindset, 02-recon-setup, 20-chain-complete
4
5	---
6
7	## PART 1: THE HUNTER MINDSET
8
9	### The Core Mental Shift
10
11	You are NOT looking for "vulnerabilities" in the abstract.
12	You are looking for specific actions an attacker can take TODAY that result in profit.
13
14	Everything flows from one question: "What can I STEAL, FREEZE, or DESTROY — and what do I END UP WITH?"
15
16	### The Bug Validation Template
17
18	Apply to every finding before writing a single line:
19
20	```
21	I am an attacker. I will:
22	1. SETUP: What do I need? (wallet, capital, any whitelisted permissions?)
23	2. CALL: Exact transactions, exact order, exact function names
24	3. RESULT: What do I end up with that I didn't start with?
25	4. COST: Gas + capital + flash loan fee + any other expense
26	5. DETECT: Can anyone stop or reverse this?
27	6. NET ROI: I gained X at cost of Y. Is Y << X?
28	```
29
30	If you can't fill in steps 2 and 3 with specific function calls → it's not a real bug. Stop. Move on.
31
32	### 10 Attacker Questions (Ask For Every External Function)
33
34	1. What if `amount = 0`? Does anything revert or silently pass?
35	2. What if I call this function twice in the same block?
36	3. What if I call this before `initialize()` is called?
37	4. What if I front-run this transaction?
38	5. What if the external call fails? Does state get half-updated?
39	6. What if the token has fee-on-transfer? Does `amount received ≠ amount sent`?
40	7. What if I pass `address(0)` or a malicious contract as an address param?
41	8. What if I pass `type(uint256).max` as a numeric param?
42	9. Can I combine this with a flash loan? (zero-cost capital changes the math)
43	10. Does a sibling function lack the same modifier this function has?
44
45	> Question #10 explains 19% of all Critical findings. If `vote()` has `onlyRole(VOTER)`, check `poke()`, `reset()`, `harvest()` — the missing modifier on the sibling IS the bug.
46
47	### 6 Triager Counter-Questions (Disprove Your Own Finding)
48
49	Before spending time on a PoC, try to KILL the finding:
50
51	1. Is there an upstream check I missed that actually prevents this?
52	2. Is this documented intended behavior (whitepaper, NatSpec, design decision)?
53	3. Does exploitation require admin/privileged access? (Usually invalid if yes)
54	4. Is the economic cost to exploit greater than the gain? (Not viable if yes)
55	5. Was this flagged in a prior audit as "acknowledged" or "risk accepted"?
56	6. Is the "sensitive" data already publicly visible to anyone in the web UI?
57
58	One YES = KILL. Move on.
59
60	### 5-Minute Rule
61
62	If you've been on the same function for 5 minutes with no clear attack path → STOP.
63	Add it to a low-priority list. Move to the next function.
64	Top hunters: 95% fast-reject + 5% deep dives on confirmed leads.
65
66	### Depth Over Breadth
67
68	Don't review 10 protocols in one week. Pick ONE. Spend 3-5 days becoming the expert.
69	Protocol-specific knowledge compounds. The Curve expert found 5 bugs. The 10-protocol tourist found 0.
70
71	### Inconsistency Is Proof
72
73	If `functionA()` has a security check, and `functionB()` doesn't — that IS the report.
74	You don't need to fully understand why. The inconsistency proves the developer intended the check.
75
76	---
77
78	## PART 2: TARGET SCORING — GO / NO-GO
79
80	Before touching any code: score the target. Score < 6 → skip.
81
82	### Target Scorecard
83
84	\| Criterion \| Points \| How to Check \|
85	\|-----------\|--------\|-------------\|
86	\| Max bounty ≥ $50K \| +2 \| Immunefi program page \|
87	\| TVL > $1M \| +2 \| DeFiLlama \|
88	\| Program launched < 30 days ago \| +2 \| Immunefi "new" filter \|
89	\| Custom math (AMM/vault/lending) \| +1 \| Read scope contracts \|
90	\| Recent code changes \| +1 \| `git log --oneline -20` \|
91	\| Prior audits available \| +1 \| Program page / GitHub \|
92	\| In-scope includes smart contracts \| +1 \| Scope section \|
93	\| Protocol type you know well \| +1 \| Your specialization \|
94	\| Source code public/readable \| +1 \| GitHub / Etherscan verified \|
95
96	< 4: Skip — too small, too audited, wrong fit
97	4-5: Only if nothing better available
98	6-8: Good — spend 1-3 days
99	≥ 9: Excellent — spend up to 1 week
100
101	---
102
103	## PART 3: RECON METHODOLOGY (30-Minute Protocol)
104
105	### Step 1 — Read Immunefi Page (5 min)
106
107	```
108	Note:
109	- All in-scope contract addresses + GitHub links
110	- Out-of-scope list (DO NOT report these)
111	- Primacy of Impact: YES/NO (YES = more forgiving on novel impacts)
112	- Max bounty amounts by severity
113	- Time on Immunefi (newer = fewer duplicates)
114	```
115
116	### Step 2 — Clone + Setup (5 min)
117
118	```bash
119	git clone <target-repo>
120	cd <target-repo>
121	git log --oneline -20 # Recent changes = freshest bugs here
122	forge build

People who liked this also viewed

6 picks

Type