Smart Contract Security and Exploit Labs
Introduction
Every lab is a controlled scientific record: assumption, vulnerable fixture, local exploit test, impact, root cause, patch, regression, and the patch's remaining limits.
Why It Matters
Vulnerability names are easy to memorize and easy to misapply. Reproduction exposes the exact state/control transition that breaks, while regression evidence prevents a superficial patch from becoming folklore.
Mental Model
Attack protocol assumptions, not people or live systems. Hold the environment deterministic, demonstrate one failure mechanism, minimize the patch, then vary tokens, ordering, privileges, pricing, and call context to probe its boundary.
Questions This Branch Answers
- Which precondition or invariant did the exploit invalidate?
- What is the smallest safe reproduction and regression?
- What new failure modes or trust does the patch introduce?
Scope
Reentrancy, access/signature/init flaws, rounding/accounting, oracle/flash-liquidity manipulation, MEV/DoS, delegatecall/storage/upgrades, bridge/governance/business logic, and containment/postmortems.
Out of Scope
Attacking public targets, handling real stolen assets, evasion, exploit weaponization, sensational incident retellings, and presenting educational patches as audited remediation.
Dependencies
testing, state machines, and the specific protocol branch being attacked.
Candidate Note Roadmap
reentrancy-and-external-control— Reproduce callback-driven state and accounting corruption.access-signature-and-initialization-failures— Break authority through missing checks, replay, or takeover.arithmetic-rounding-and-accounting-exploits— Amplify precision, share, debt, and balance inconsistencies.oracle-and-flash-liquidity-manipulation— Move trusted prices or liquidity inside one transaction.mev-frontrunning-and-denial-of-service— Exploit ordering, blocking, refunds, and unbounded work.delegatecall-storage-and-upgrade-hazards— Corrupt context, slots, and implementation authority.bridge-governance-and-business-logic— Attack cross-domain verification, caps, roles, and workflows.incident-containment-patches-and-regressions— Turn an exploit into bounded response and durable tests.
Future Project
A local exploit laboratory where each vulnerable fixture and exploit is paired with a patched variant, regression suite, timeline, containment decision, and explicit residual risk.
Initial Invariants
No lab reaches public infrastructure; demonstrations are deterministic and funded only with fixtures; patches fail the original exploit and retain intended behavior; every conclusion states its tested scope.
Initial Threat Model
Unsafe fork configuration, leaked credentials, accidental broadcast, misleading severity, non-representative mocks, incomplete patches, regression gaps, and operational controls that introduce new centralization or denial of service.
Primary Sources
Solidity security considerations, SWC/incident primary material where maintained, protocol postmortems, and review references indexed in SOURCES.md.
Connects to: governance, oracles, and incident operations.