exploit-live

/exploit-live — exploit a deployed contract on a fork

For when the user has a finding from /audit-live and wants to verify it works on the real deployment.

Procedure

Step 1 — Fork the chain

mcp__anvil__fork(chain=<chain>, block=latest)

Capture the RPC URL.

Step 2 — Pull source if needed

If we don't already have the source from /audit-live, pull it via block-explorer.

Step 3 — Write the PoC against the fork

Same template as /exploit but using vm.createFork and vm.activeFork to target the live deployment:

function setUp() public {
    forkId = vm.createFork(ANVIL_FORK_URL);
    vm.selectFork(forkId);
    target = Vault(payable(LIVE_ADDRESS));
}

function test_Exploit_Live() public {
    // attempt against the *actual deployed state*
}

Step 4 — Run

Use forge-runner MCP with --fork-url pointed at the anvil instance.

Step 5 — Output

If the test passes:

✗ EXPLOITABLE on live deployment

  Chain:     berachain
  Block:     12345678
  Contract:  0xabc...
  Finding:   REENT-001
  Value extractable: ~$420K (at current price)

  PoC: test/live-exploits/ExploitLive-REENT-001.t.sol

If the test fails (i.e. the exploit doesn't work in practice):

✓ Finding REENT-001 does NOT exploit the live deployment as written.
  Possible reasons: live state differs from setUp assumption, finding requires
  preconditions not met by current state, or finding is a false positive.

This is a valuable output — false positives caught.

Responsible disclosure

If the exploit works against a contract not owned by the user, the output should include a prominent disclosure reminder:

⚠ RESPONSIBLE DISCLOSURE
This exploit works against a live deployment that you may not own.
DO NOT execute on mainnet. Coordinate disclosure via:
  - Immunefi:           https://immunefi.com
  - Protocol's bounty:  (check the protocol's docs)
  - SEAL 911:           https://seal-911.com  (emergency)

Notes

• Always fork at a recent block to reflect current state.
• Don't share the PoC publicly until the protocol has patched. Use /bounty to generate a disclosure-ready report and /bounty-submit to package it for Immunefi.