LLMSkillHub
mirroredCopied from dragonked2/alphacode under MIT. dragonked2 has not claimed this page, and is not affiliated with LLM SkillHub.

dragonked2 / exploit-chaining

Multi-transaction exploit chains and cross-contract composition — call graphs, state tracking, primitive composition. Load when single-function analysis stalls or primitives need combining.

0
SKILL.md
1.4 KB

EXPLOIT CHAINING

Method

  1. Build the call graph (A→B→C, A→D→E) across contracts, including
    callbacks, hooks, and bridge/oracle inputs.

  2. Combine permissions + state + transfers + external calls + accounting

    • oracle data at each edge. Bugs that only emerge through composition

    live here.

  3. Plan TX1→TX2→TX3→TX4, tracking balances, allowances, shares, debt,
    collateral, prices, roles, nonces, supply, reserves, and protocol
    state after every step.

  4. Ask at each link: can vulnerability A enable vulnerability B?

Composition patterns

  • Oracle manipulation + collateral valuation → undercollateralized borrow
  • Accounting bug + redemption → unbacked extraction
  • Privilege escalation + mint authority → synthetic creation
  • Bridge validation + mint authority → cross-chain drain
  • Callback + stale accounting → repeated extraction

Grep anchors

grep -rn "call(\|delegatecall(\|staticcall(\|onERC.*Received\|onFlashLoan\|executeOperation\|handle(" contracts/

Rule

Each link needs its own mini state-transition (before → action → after).
A chain is only as reportable as its weakest link — mark unproven links
as inferred or hypothetical, never as reproduced.