web3-poc-foundry

Name: web3-poc-foundry
Author: shuvonsec

110stars29forks

How to install web3-poc-foundry?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-poc-foundry

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-poc-foundry

Installs into the current project.

Summary

Complete Foundry PoC writing guide + all cheatcodes + DeFiHackLabs reproduction patterns. Use this when building a proof of concept exploit, setting up a fork test, using Foundry cheatcodes, or reproducing a known DeFi hack for learning.

Files · 1

View on GitHub

SKILL.md

1	# PoC WRITING + FOUNDRY COMPLETE REFERENCE
2
3	Immunefi requires RUNNABLE code. Not pseudocode. Not steps. Running Foundry tests with before/after logs and a passing assert.
4
5	---
6
7	## QUICK START
8
9	```bash
10	# Immunefi official templates (preferred for submissions)
11	forge init my-poc --template immunefi-team/forge-poc-templates --branch default
12	forge init my-poc --template immunefi-team/forge-poc-templates --branch reentrancy
13	forge init my-poc --template immunefi-team/forge-poc-templates --branch flash_loan
14	forge init my-poc --template immunefi-team/forge-poc-templates --branch price_manipulation
15
16	# Or blank Foundry project
17	forge init my-poc
18	cd my-poc
19
20	# Setup .env
21	echo "MAINNET_RPC_URL=https://eth.llamarpc.com" > .env
22	echo "BASE_RPC_URL=https://base.llamarpc.com" >> .env
23	echo "ARB_RPC_URL=https://arb1.arbitrum.io/rpc" >> .env
24
25	# Run exploit
26	source .env
27	forge test --match-test testExploit -vvvv --fork-url $MAINNET_RPC_URL
28	```
29
30	---
31
32	## STANDARD PoC TEMPLATE (Production Quality for Immunefi)
33
34	```solidity
35	// SPDX-License-Identifier: UNLICENSED
36	pragma solidity ^0.8.10;
37
38	import "forge-std/Test.sol";
39	import "forge-std/console.sol";
40
41	/**
42	* @title [Protocol Name] - [Bug Description]
43	* @notice PoC for Immunefi submission
44	* @dev Demonstrates [impact] by exploiting [root cause]
45	*
46	* Vulnerable contract: [address] ([name])
47	* Vulnerable function: [functionName]
48	* Immunefi program: [URL]
49	* Severity: [Critical/High/Medium/Low]
50	*/
51
52	// Minimal interfaces — only what you need
53	interface IVulnProtocol {
54	function deposit(uint256 amount) external;
55	function withdraw(uint256 amount) external;
56	function balanceOf(address) external view returns (uint256);
57	}
58
59	interface IERC20 {
60	function approve(address, uint256) external returns (bool);
61	function balanceOf(address) external view returns (uint256);
62	function transfer(address, uint256) external returns (bool);
63	function transferFrom(address, address, uint256) external returns (bool);
64	}
65
66	contract ExploitPoC is Test {
67	// ============================================================
68	// CONFIGURATION
69	// ============================================================
70	uint256 constant ATTACK_BLOCK = 18_000_000; // pin block for reproducibility
71
72	address constant VULN_CONTRACT = 0x...;
73	address constant TOKEN = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; // USDC
74
75	IVulnProtocol vuln = IVulnProtocol(VULN_CONTRACT);
76	IERC20 token = IERC20(TOKEN);
77
78	// ============================================================
79	// SETUP
80	// ============================================================
81	function setUp() public {
82	vm.createSelectFork(vm.envString("MAINNET_RPC_URL"), ATTACK_BLOCK);
83	vm.label(VULN_CONTRACT, "VulnerableProtocol");
84	vm.label(TOKEN, "USDC");
85	vm.label(address(this), "Attacker");
86	}
87
88	// ============================================================
89	// EXPLOIT
90	// ============================================================
91	function testExploit() public {
92	uint256 attackerBefore = token.balanceOf(address(this));
93	uint256 protocolBefore = token.balanceOf(VULN_CONTRACT);
94
95	console.log("=== INITIAL STATE ===");
96	console.log("Attacker USDC: ", attackerBefore);
97	console.log("Protocol USDC: ", protocolBefore);
98	console.log("--------------------");
99
100	// Step 1: [description]
101	deal(TOKEN, address(this), 1e6); // 1 USDC starting capital
102
103	// Step 2: [description]
104	token.approve(VULN_CONTRACT, type(uint256).max);
105	vuln.deposit(1e6);
106
107	// Step 3: [the exploit]
108	// ... exploit logic ...
109
110	uint256 attackerAfter = token.balanceOf(address(this));
111	uint256 protocolAfter = token.balanceOf(VULN_CONTRACT);
112
113	console.log("=== FINAL STATE ===");
114	console.log("Attacker USDC: ", attackerAfter);
115	console.log("Protocol USDC: ", protocolAfter);
116	console.log("Profit: ", attackerAfter - attackerBefore);
117	console.log("Protocol loss: ", protocolBefore - protocolAfter);
118
119	assertGt(attackerAfter, attackerBefore, "Exploit failed: no profit");
120	}
121	}
122	```
123
124	### What a Passing PoC Output Looks Like
125
126	```
127	Running 1 test for test/Exploit.t.sol:ExploitPoC
128	[PASS] testExploit() (gas: 1234567)
129	Logs:
130	=== INITIAL STATE ===
131	Attacker USDC: 100000
132	Protocol USDC: 5000000
133	--------------------
134	=== FINAL STATE ===
135	Attacker USDC: 600000
136	Protocol USDC: 4500000
137	Profit: 500000
138	Protocol loss: 500000
139
140	Test result: ok. 1 passed; 0 failed
141	```
142
143	The before/after numbers ARE your proof. Paste this output directly into the Immunefi report.
144
145	---
146
147	## ESSENTIAL CHEATCODES — FUL

People who liked this also viewed

6 picks

Type

web3-poc-foundry

110stars29forks

View on GitHub

How to install web3-poc-foundry?

shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-poc-foundry

$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-poc-foundry

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# PoC WRITING + FOUNDRY COMPLETE REFERENCE
2
3	Immunefi requires RUNNABLE code. Not pseudocode. Not steps. Running Foundry tests with before/after logs and a passing assert.
4
5	---
6
7	## QUICK START
8
9	```bash
10	# Immunefi official templates (preferred for submissions)
11	forge init my-poc --template immunefi-team/forge-poc-templates --branch default
12	forge init my-poc --template immunefi-team/forge-poc-templates --branch reentrancy
13	forge init my-poc --template immunefi-team/forge-poc-templates --branch flash_loan
14	forge init my-poc --template immunefi-team/forge-poc-templates --branch price_manipulation
15
16	# Or blank Foundry project
17	forge init my-poc
18	cd my-poc
19
20	# Setup .env
21	echo "MAINNET_RPC_URL=https://eth.llamarpc.com" > .env
22	echo "BASE_RPC_URL=https://base.llamarpc.com" >> .env
23	echo "ARB_RPC_URL=https://arb1.arbitrum.io/rpc" >> .env
24
25	# Run exploit
26	source .env
27	forge test --match-test testExploit -vvvv --fork-url $MAINNET_RPC_URL
28	```
29
30	---
31
32	## STANDARD PoC TEMPLATE (Production Quality for Immunefi)
33
34	```solidity
35	// SPDX-License-Identifier: UNLICENSED
36	pragma solidity ^0.8.10;
37
38	import "forge-std/Test.sol";
39	import "forge-std/console.sol";
40
41	/**
42	* @title [Protocol Name] - [Bug Description]
43	* @notice PoC for Immunefi submission
44	* @dev Demonstrates [impact] by exploiting [root cause]
45	*
46	* Vulnerable contract: [address] ([name])
47	* Vulnerable function: [functionName]
48	* Immunefi program: [URL]
49	* Severity: [Critical/High/Medium/Low]
50	*/
51
52	// Minimal interfaces — only what you need
53	interface IVulnProtocol {
54	function deposit(uint256 amount) external;
55	function withdraw(uint256 amount) external;
56	function balanceOf(address) external view returns (uint256);
57	}
58
59	interface IERC20 {
60	function approve(address, uint256) external returns (bool);
61	function balanceOf(address) external view returns (uint256);
62	function transfer(address, uint256) external returns (bool);
63	function transferFrom(address, address, uint256) external returns (bool);
64	}
65
66	contract ExploitPoC is Test {
67	// ============================================================
68	// CONFIGURATION
69	// ============================================================
70	uint256 constant ATTACK_BLOCK = 18_000_000; // pin block for reproducibility
71
72	address constant VULN_CONTRACT = 0x...;
73	address constant TOKEN = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; // USDC
74
75	IVulnProtocol vuln = IVulnProtocol(VULN_CONTRACT);
76	IERC20 token = IERC20(TOKEN);
77
78	// ============================================================
79	// SETUP
80	// ============================================================
81	function setUp() public {
82	vm.createSelectFork(vm.envString("MAINNET_RPC_URL"), ATTACK_BLOCK);
83	vm.label(VULN_CONTRACT, "VulnerableProtocol");
84	vm.label(TOKEN, "USDC");
85	vm.label(address(this), "Attacker");
86	}
87
88	// ============================================================
89	// EXPLOIT
90	// ============================================================
91	function testExploit() public {
92	uint256 attackerBefore = token.balanceOf(address(this));
93	uint256 protocolBefore = token.balanceOf(VULN_CONTRACT);
94
95	console.log("=== INITIAL STATE ===");
96	console.log("Attacker USDC: ", attackerBefore);
97	console.log("Protocol USDC: ", protocolBefore);
98	console.log("--------------------");
99
100	// Step 1: [description]
101	deal(TOKEN, address(this), 1e6); // 1 USDC starting capital
102
103	// Step 2: [description]
104	token.approve(VULN_CONTRACT, type(uint256).max);
105	vuln.deposit(1e6);
106
107	// Step 3: [the exploit]
108	// ... exploit logic ...
109
110	uint256 attackerAfter = token.balanceOf(address(this));
111	uint256 protocolAfter = token.balanceOf(VULN_CONTRACT);
112
113	console.log("=== FINAL STATE ===");
114	console.log("Attacker USDC: ", attackerAfter);
115	console.log("Protocol USDC: ", protocolAfter);
116	console.log("Profit: ", attackerAfter - attackerBefore);
117	console.log("Protocol loss: ", protocolBefore - protocolAfter);
118
119	assertGt(attackerAfter, attackerBefore, "Exploit failed: no profit");
120	}
121	}
122	```
123
124	### What a Passing PoC Output Looks Like
125
126	```
127	Running 1 test for test/Exploit.t.sol:ExploitPoC
128	[PASS] testExploit() (gas: 1234567)
129	Logs:
130	=== INITIAL STATE ===
131	Attacker USDC: 100000
132	Protocol USDC: 5000000
133	--------------------
134	=== FINAL STATE ===
135	Attacker USDC: 600000
136	Protocol USDC: 4500000
137	Profit: 500000
138	Protocol loss: 500000
139
140	Test result: ok. 1 passed; 0 failed
141	```
142
143	The before/after numbers ARE your proof. Paste this output directly into the Immunefi report.
144
145	---
146
147	## ESSENTIAL CHEATCODES — FUL

People who liked this also viewed

6 picks

Type