web3-start-here
starsforks
How to install web3-start-here?
shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-start-here
$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-start-hereMaster index for the web3 smart contract security knowledge base. Use this to navigate the skill chain. Read files in order — each ends with NEXT.
SKILL.md
| 1 | # WEB3 SKILLS — MASTER INDEX |
| 2 | |
| 3 | > Built from: 2,749 Immunefi reports + 100+ paid writeups + DeFiHackLabs (681 hacks) + ConsenSys + SlowMist + Trail of Bits + Foundry + Nethermind + Lido + AI agent research + live hunt experience |
| 4 | |
| 5 | --- |
| 6 | |
| 7 | ## THE CHAIN (read in this exact order) |
| 8 | |
| 9 | ``` |
| 10 | 00-START-HERE.md ← YOU ARE HERE |
| 11 | 01-foundation.md ← Mindset, target selection, recon setup |
| 12 | 02-bug-classes.md ← All 10 bug classes with patterns + real examples |
| 13 | 03-grep-arsenal.md ← Master grep patterns for every class |
| 14 | 04-poc-and-foundry.md ← Foundry PoC writing, cheatcodes, 18 exploit templates |
| 15 | 05-triage-report-examples.md ← 7-Question Gate, report format, 20 real paid examples |
| 16 | 06-methodology-research.md ← ToB, SlowMist, ConsenSys, Immunefi, Cyfrin, Lido, Nethermind |
| 17 | 07-live-hunt-ern.md ← Completed hunt: Ern protocol (2 findings) |
| 18 | 09-live-hunt-zksync.md ← Completed hunt: ZKsync Era (0 findings — defense study) |
| 19 | 08-ai-tools.md ← Shannon, LuaN1ao, SmartGuard, CAI Framework, AI code hunting |
| 20 | 36-solidity-audit-mcp.md ← MCP server: Slither+Aderyn+SWC in Claude Code |
| 21 | ``` |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | ## HOW TO USE THIS |
| 26 | |
| 27 | 1. Read one file fully — every section |
| 28 | 2. At the bottom: follow → NEXT |
| 29 | 3. **After file 05**: you can hunt independently |
| 30 | 4. **Files 06-08**: advanced tools + active work |
| 31 | 5. **File 36**: MCP integration for live scanning |
| 32 | |
| 33 | --- |
| 34 | |
| 35 | ## QUICK STATS |
| 36 | |
| 37 | | Metric | Number | |
| 38 | |--------|--------| |
| 39 | | Immunefi reports analyzed | 2,749 | |
| 40 | | Protocols covered | 51 | |
| 41 | | Critical reports | 406 | |
| 42 | | High reports | 616 | |
| 43 | | Total paid by Immunefi | $100M+ | |
| 44 | | Avg critical payout | $50K–$2M | |
| 45 | | Nethermind reports analyzed | 166 | |
| 46 | | DeFiHackLabs hacks reproduced | 681 | |
| 47 | |
| 48 | --- |
| 49 | |
| 50 | ## THE ONE RULE |
| 51 | |
| 52 | > "Read ALL sibling functions. If `vote()` has a modifier, check `poke()`, `reset()`, `harvest()`. The missing modifier on the sibling IS the bug." |
| 53 | |
| 54 | This single rule explains 19% of all Critical findings. |
| 55 | |
| 56 | --- |
| 57 | |
| 58 | → NEXT: [01-foundation.md](01-foundation.md) |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
