web3-bug-classes SKILL.md skillA

web3-bug-classes from olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

mdr add olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills/web3-bug-classes@git:20260314.d68913a

Pins git:20260314.d68913a in mdr.lock. Pin the fingerprint instead.

Audit grade

A, 17 of 17 checks passed

Kind

SKILL.md skill

Repository

olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills

Path

web3-bug-classes/SKILL.md

Versions recorded

1

Latest version

git:20260314.d68913a, committed Mar 14, 2026

Size

41,045 bytes

Repository stars

3

License

MIT

Complete reference for all 10 DeFi smart contract bug classes. Use this when hunting for specific vulnerability types, need attack patterns for accounting desync, access control, incomplete path, off-by-one, oracle manipulation, ERC4626 vaults, reentrancy, flash loans, signature replay, or proxy/upgrade bugs.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# BUG CLASSES — DeFi Smart Contract Vulnerabilities

10 bug classes. Each one with root cause, vulnerable code, fix, grep patterns, and real paid examples.

---

## 1. ACCOUNTING STATE DESYNCHRONIZATION
> #1 Critical bug class — 28% of all Criticals on Immunefi.
> Real protocols: Yeet, Alchemix V3, Folks Finance, ResupplyFi, MetaPool

### What It Is

Two state variables are supposed to stay in sync. One code path updates variable A but forgets variable B. Later code reads both and makes decisions based on the stale B.

```
Real Value = A - B
If A is updated but B isn't → Real Value appears larger than it is → phantom value
```

### Root Cause Pattern

```solidity
// BEFORE (correct state):
// aToken.balanceOf(this) = 1000  (principal + yield)
// totalSupply = 1000              (only principal)
// yield = 1000 - 1000 = 0        ✓ correct

// Attacker triggers startUnstake:
totalSupply -= amount;  // decremented BEFORE transfer
// totalSupply = 900 now
// aToken.balanceOf still = 1000
// yield appears = 1000 - 900 = 100 (PHANTOM)

// Now harvest():
yieldAmount = aToken.balanceOf(this) - totalSupply;
// = 1000 - 900 = 100 (phantom yield — no real yield was earned)
…

Read the whole file at its exact version.

How to install

mdr add olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills/web3-bug-classes@sha256:03cd842c5cba2b70

[![mdr](https://markdownregistry.com/badge/art_fapkzb54u64tqg2g.svg)](https://markdownregistry.com/a/art_fapkzb54u64tqg2g)

Versions

The registry has recorded 1 version of this file, committed on Mar 14, 2026.

Audit of the latest version

Source

API

GET https://markdownregistry.com/api/v1/artifacts/art_fapkzb54u64tqg2g
GET https://markdownregistry.com/api/v1/resolve?ref=olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills/web3-bug-classes
GET https://markdownregistry.com/api/v1/blob/03cd842c5cba2b70a36b27dad3de28b3ba750b9a71c8b998fbb39c8f5121b9c2

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills

Every file in olaradiallysymmetrical491/web3-bug-bounty-hunting-ai-skills

Browse by kind, by grade A, or by owner.