web3-methodology-research

Name: web3-methodology-research
Author: shuvonsec

110stars29forks

How to install web3-methodology-research?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-methodology-research

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-methodology-research

Installs into the current project.

Summary

External research synthesis from Trail of Bits, SlowMist, ConsenSys, Immunefi, and Cyfrin. Use this for advanced audit methodology, Echidna/Medusa fuzzing setup, Slither custom detector writing, attack pattern deep dives, or the 4-phase learning roadmap.

Files · 1

View on GitHub

SKILL.md

1	# METHODOLOGY & RESEARCH SYNTHESIS
2
3	Sources: Trail of Bits, SlowMist, ConsenSys, Immunefi Web3 Security Library, Cyfrin Audit Course, Lido Audits Library, Nethermind PublicAuditReports.
4
5	---
6
7	## TRAIL OF BITS
8
9	### Their Toolset
10
11	\| Tool \| What It Does \| When to Use \|
12	\|------\|-------------\|-------------\|
13	\| Slither \| Static analysis for Solidity/Vyper \| Always — run first \|
14	\| Echidna \| Property-based fuzzer (write invariants, it breaks them) \| Write 3-5 invariants before reading code \|
15	\| Medusa \| Next-gen fuzzer, multi-core, parallel corpus \| Deeper campaigns after Echidna \|
16	\| Manticore \| Symbolic execution — confirms if a path is truly reachable \| Specific PoC confirmation \|
17	\| Halmos \| Symbolic unit testing — proves for ALL inputs \| Math-heavy functions \|
18
19	---
20
21	### Slither Commands
22
23	```bash
24	# Install
25	pip3 install slither-analyzer
26
27	# First pass — protocol overview
28	slither . --print human-summary
29	slither . --print contract-summary
30
31	# Targeted detectors
32	slither . --detect reentrancy-eth,reentrancy-no-eth,unchecked-lowlevel
33	slither . --detect arbitrary-send-erc20,controlled-delegatecall
34	slither . --detect uninitialized-state,uninitialized-storage
35	slither . --detect suicidal,controlled-array-length
36
37	# Visualization
38	slither . --print inheritance-graph
39	slither . --print function-summary
40	slither . --print call-graph
41
42	# Filtered run (skip tests and libs)
43	slither . --exclude-low --filter-paths "test\|lib"
44	```
45
46	---
47
48	### Echidna Quick Start
49
50	```solidity
51	// Write invariants BEFORE fully reading the code
52	contract VaultInvariants {
53	Vault vault;
54
55	// Protocol should never owe more than it holds
56	function echidna_solvency() public view returns (bool) {
57	return vault.totalAssets() >= vault.totalDebt();
58	}
59
60	// Share math must be consistent
61	function echidna_share_math() public view returns (bool) {
62	return vault.balanceOf(address(this)) <= vault.totalSupply();
63	}
64
65	// cumulativeRewardPerShare only ever increases
66	function echidna_reward_monotonic() public view returns (bool) {
67	return vault.cumulativeRewardPerShare() >= lastRewardPerShare;
68	}
69	}
70	```
71
72	```bash
73	echidna contracts/VaultInvariants.sol --contract VaultInvariants --test-mode assertion
74
75	# With config
76	echidna Test.sol --contract EchidnaTest --config echidna.yaml
77	```
78
79	```yaml
80	# echidna.yaml
81	testLimit: 50000
82	seqLen: 100
83	workers: 4
84	corpusDir: corpus/
85	```
86
87	---
88
89	### Medusa Setup
90
91	```bash
92	# Install
93	# github.com/crytic/medusa
94	go install github.com/crytic/medusa@latest
95
96	# Run (coverage-guided, multi-core)
97	medusa fuzz --config medusa.json
98
99	# medusa.json
100	{
101	"fuzzing": {
102	"workers": 4,
103	"testLimit": 500000,
104	"corpusDirectory": "corpus"
105	}
106	}
107	```
108
109	Medusa vs Echidna: Medusa is faster on large contracts due to coverage-guided exploration. Use Echidna for first pass, Medusa for extended campaigns.
110
111	---
112
113	### Trail of Bits Audit Methodology
114
115	```
116	1. THREAT MODEL FIRST
117	- What are the assets? (tokens, governance power, user funds)
118	- What are the trust boundaries? (who can call what?)
119	- What are the attack surfaces? (entry points, external calls)
120
121	2. STATIC ANALYSIS
122	- Run Slither with all detectors
123	- Examine SlithIR output for complex functions
124	- Map ALL state variables and who can write them
125
126	3. WRITE INVARIANTS BEFORE READING EVERYTHING
127	- "totalAssets >= totalDebt always"
128	- "shares * pricePerShare == underlying always"
129	- "user can always withdraw their full deposit"
130	- Run Echidna. Watch it break them.
131
132	4. SYMBOLIC EXECUTION ON HIGH-VALUE PATHS
133	- Use Manticore/Halmos for precise reachability confirmation
134	- Confirms "can an attacker actually reach state X?"
135
136	5. MANUAL REVIEW — FOCUS ON
137	- Business logic (not syntax — Slither caught that)
138	- Economic invariants (is the math right under adversarial conditions?)
139	- Access control (who can call what, when, with what params?)
140
141	6. DIFFERENTIAL TESTING
142	- Compare against reference implementation
143	- "Function A does X. Function B does the same thing differently. Why?"
144	- The inconsistency IS the bug.
145	```
146
147	---
148
149	### Key Bug Classes From Real ToB Audits
150
151	EVM / Solidity:
152	```
153	REENTRANCY VARIANTS (still common)
154	- Cross-function: lock in depositA, reenter via depositB before state update
155	- Cross-contract: callback to attacker contract via safeTransfer
156	- Read-only: view function reads stale state during reentrant call
157	(Curve $70M — most underestimated variant)
158
159	ROUNDING ERRORS
160	- Division before multiplication: (a / b) * c vs (a * c) / b
161	- Wrong rounding direction (should round up for safety, rounds down)
162	- Precision loss in sequential operations
163
164	WEAK FIAT-SHAMIR (ZK SYSTEMS — ToB IEEE S&P 2023)
165	- ZK proof prover can forg

People who liked this also viewed

6 picks

Type

web3-methodology-research

110stars29forks

View on GitHub

How to install web3-methodology-research?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-methodology-research

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-methodology-research

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# METHODOLOGY & RESEARCH SYNTHESIS
2
3	Sources: Trail of Bits, SlowMist, ConsenSys, Immunefi Web3 Security Library, Cyfrin Audit Course, Lido Audits Library, Nethermind PublicAuditReports.
4
5	---
6
7	## TRAIL OF BITS
8
9	### Their Toolset
10
11	\| Tool \| What It Does \| When to Use \|
12	\|------\|-------------\|-------------\|
13	\| Slither \| Static analysis for Solidity/Vyper \| Always — run first \|
14	\| Echidna \| Property-based fuzzer (write invariants, it breaks them) \| Write 3-5 invariants before reading code \|
15	\| Medusa \| Next-gen fuzzer, multi-core, parallel corpus \| Deeper campaigns after Echidna \|
16	\| Manticore \| Symbolic execution — confirms if a path is truly reachable \| Specific PoC confirmation \|
17	\| Halmos \| Symbolic unit testing — proves for ALL inputs \| Math-heavy functions \|
18
19	---
20
21	### Slither Commands
22
23	```bash
24	# Install
25	pip3 install slither-analyzer
26
27	# First pass — protocol overview
28	slither . --print human-summary
29	slither . --print contract-summary
30
31	# Targeted detectors
32	slither . --detect reentrancy-eth,reentrancy-no-eth,unchecked-lowlevel
33	slither . --detect arbitrary-send-erc20,controlled-delegatecall
34	slither . --detect uninitialized-state,uninitialized-storage
35	slither . --detect suicidal,controlled-array-length
36
37	# Visualization
38	slither . --print inheritance-graph
39	slither . --print function-summary
40	slither . --print call-graph
41
42	# Filtered run (skip tests and libs)
43	slither . --exclude-low --filter-paths "test\|lib"
44	```
45
46	---
47
48	### Echidna Quick Start
49
50	```solidity
51	// Write invariants BEFORE fully reading the code
52	contract VaultInvariants {
53	Vault vault;
54
55	// Protocol should never owe more than it holds
56	function echidna_solvency() public view returns (bool) {
57	return vault.totalAssets() >= vault.totalDebt();
58	}
59
60	// Share math must be consistent
61	function echidna_share_math() public view returns (bool) {
62	return vault.balanceOf(address(this)) <= vault.totalSupply();
63	}
64
65	// cumulativeRewardPerShare only ever increases
66	function echidna_reward_monotonic() public view returns (bool) {
67	return vault.cumulativeRewardPerShare() >= lastRewardPerShare;
68	}
69	}
70	```
71
72	```bash
73	echidna contracts/VaultInvariants.sol --contract VaultInvariants --test-mode assertion
74
75	# With config
76	echidna Test.sol --contract EchidnaTest --config echidna.yaml
77	```
78
79	```yaml
80	# echidna.yaml
81	testLimit: 50000
82	seqLen: 100
83	workers: 4
84	corpusDir: corpus/
85	```
86
87	---
88
89	### Medusa Setup
90
91	```bash
92	# Install
93	# github.com/crytic/medusa
94	go install github.com/crytic/medusa@latest
95
96	# Run (coverage-guided, multi-core)
97	medusa fuzz --config medusa.json
98
99	# medusa.json
100	{
101	"fuzzing": {
102	"workers": 4,
103	"testLimit": 500000,
104	"corpusDirectory": "corpus"
105	}
106	}
107	```
108
109	Medusa vs Echidna: Medusa is faster on large contracts due to coverage-guided exploration. Use Echidna for first pass, Medusa for extended campaigns.
110
111	---
112
113	### Trail of Bits Audit Methodology
114
115	```
116	1. THREAT MODEL FIRST
117	- What are the assets? (tokens, governance power, user funds)
118	- What are the trust boundaries? (who can call what?)
119	- What are the attack surfaces? (entry points, external calls)
120
121	2. STATIC ANALYSIS
122	- Run Slither with all detectors
123	- Examine SlithIR output for complex functions
124	- Map ALL state variables and who can write them
125
126	3. WRITE INVARIANTS BEFORE READING EVERYTHING
127	- "totalAssets >= totalDebt always"
128	- "shares * pricePerShare == underlying always"
129	- "user can always withdraw their full deposit"
130	- Run Echidna. Watch it break them.
131
132	4. SYMBOLIC EXECUTION ON HIGH-VALUE PATHS
133	- Use Manticore/Halmos for precise reachability confirmation
134	- Confirms "can an attacker actually reach state X?"
135
136	5. MANUAL REVIEW — FOCUS ON
137	- Business logic (not syntax — Slither caught that)
138	- Economic invariants (is the math right under adversarial conditions?)
139	- Access control (who can call what, when, with what params?)
140
141	6. DIFFERENTIAL TESTING
142	- Compare against reference implementation
143	- "Function A does X. Function B does the same thing differently. Why?"
144	- The inconsistency IS the bug.
145	```
146
147	---
148
149	### Key Bug Classes From Real ToB Audits
150
151	EVM / Solidity:
152	```
153	REENTRANCY VARIANTS (still common)
154	- Cross-function: lock in depositA, reenter via depositB before state update
155	- Cross-contract: callback to attacker contract via safeTransfer
156	- Read-only: view function reads stale state during reentrant call
157	(Curve $70M — most underestimated variant)
158
159	ROUNDING ERRORS
160	- Division before multiplication: (a / b) * c vs (a * c) / b
161	- Wrong rounding direction (should round up for safety, rounds down)
162	- Precision loss in sequential operations
163
164	WEAK FIAT-SHAMIR (ZK SYSTEMS — ToB IEEE S&P 2023)
165	- ZK proof prover can forg

People who liked this also viewed

6 picks

Type