metasploit-cursor-harness: Skill for Cursor

Blockchain Pentest

Prerequisites

• Target contract addresses and chains are in scope (scope/scope-master.txt, engagement ROE).
• Use testnet forks or local Anvil/Hardhat before mainnet interaction.
• Flash loan and reentrancy tests may require ROE authorization for live DeFi pools.

Workflow

Task Progress:
- [ ] Map protocol architecture (contracts, oracles, admin keys)
- [ ] Static analysis (Slither, Mythril) and manual review
- [ ] Test reentrancy, access control, and arithmetic edge cases
- [ ] Run mutation testing to validate test coverage
- [ ] Document findings with transaction hashes and PoC scripts

Phase 1: Architecture mapping

Information gathering

MSF: No direct module. Use block explorers and on-chain queries.

CLI fallback:

# Etherscan/Sourcify contract source verification
# Proxy pattern detection (EIP-1967, EIP-1822, beacon proxies)
# cast call, cast storage for on-chain state reads
cast code 0xContractAddress --rpc-url $RPC_URL
cast storage 0xContractAddress 0 --rpc-url $RPC_URL

Key concepts

Term	Relevance
Smart contract	On-chain logic with immutable/deployed code
DeFi	Financial primitives (lending, AMM, staking)
Flash loan	Uncollateralized loan within single transaction
MEV	Miner/validator extractable value from tx ordering
Proxy	Upgradeable contract pattern via delegatecall

Phase 2: Vulnerability classes

Reentrancy

MSF: No direct module. Use Foundry/Slither for testing.

CLI fallback:

// Vulnerable pattern: external call before state update
function withdraw() external {
    uint amount = balances[msg.sender];
    (bool ok,) = msg.sender.call{value: amount}("");
    balances[msg.sender] = 0;
}

Test: single-function, cross-function, read-only (ERC-777 hooks), cross-contract.

Access control

MSF: No direct module. Use Slither detectors.

CLI fallback:

function setOwner(address _new) external { owner = _new; }
require(tx.origin == owner);