hunting-defi-economic-and-oracle-flaws SKILL.md skillA
hunting-defi-economic-and-oracle-flaws from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/hunting-defi-economic-and-oracle-flaws@git:20260823.e797ed0Pins git:20260823.e797ed0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/hunting-defi-economic-and-oracle-flaws/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260823.e797ed0, committed Aug 23, 2026
- Size
- 9,259 bytes
- Repository stars
- 26
- License
- MIT
Hunt a decentralized-finance protocol for a way to profit by moving a price or breaking an economic invariant, rather than by defeating an access check or re-entering. Covers a price read from a spot source an attacker can move within a transaction, a manipulable oracle or a single-source feed with no sanity bound, a swap or liquidation that trusts a pool ratio a flash loan can skew, rounding or fee-accounting that a repeated interaction drains, share or collateral math that lets a first or…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hunting DeFi economic and oracle flaws: profiting by moving a price nobody bounded Some of the most valuable protocol bugs break no access check and re-enter nothing: they move a price or exploit accounting math to extract value through actions the protocol permits. A contract reads a spot price a flash loan can swing inside one transaction, trusts a pool ratio an attacker sets, or rounds a fee in a direction a repeated call drains. This hunt is about the economic layer, the values a protocol trusts and the invariants it assumes hold. It is distinct from access control (nothing here requires a missing gate) and from reentrancy (nothing here requires re-entry); if the fix is a manipulation-resistant oracle, a sanity bound, or corrected math, it is an economic flaw and belongs here. The discipline in a crowded field is proving the manipulation is profitable after costs, not just that a price can move. ## When to use - A protocol reads a price, a pool ratio, or a share value to make a swap, loan, or liquidation decision. - Fee, rounding, or share math runs on values an attacker can influence within a transaction. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/hunting-defi-economic-and-oracle-flaws@sha256:6fb615661a27cb95The line at the top of this page pins the label git:20260823.e797ed0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_u43qwx2ovchntp3o)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 23, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9259 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_u43qwx2ovchntp3o GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/hunting-defi-economic-and-oracle-flaws GET https://markdownregistry.com/api/v1/blob/6fb615661a27cb951797fe82f4c3fc1c614d6735201b9c6e360881215ffe7586
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.