skills.rest
n4igme
n4igmeCOMMUNITY
Explore all skills by this author →
Website𝕏@nevrectlGitHub

vuln-web3-aa

Detect Account Abstraction vulnerabilities in ERC-4337 implementations and append findings to vulnerabilities.md.

Updated Jun 23, 2024
Search Tags:#security-audit#smart-contracts#vulnerability-scanning#bug-bounty#replay-attack#account-abstraction#erc-4337
One-click install
npx skills add https://github.com/n4igme/randscript --skill vuln-web3-aa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-web3-aa
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/scode/vuln-web3-aa
Command: npx skills add https://github.com/n4igme/randscript --skill vuln-web3-aa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security engineers identify vulnerabilities in ERC-4337 implementations, focusing on account abstraction weaknesses such as UserOperation replay, paymaster drain, and smart account flaws.

Core Features & Use Cases

  • Detect common Account Abstraction vulnerabilities (UserOperation replay, paymaster abuse, entryPoint exploitation, and smart account weaknesses) by scanning AA code paths and configuration.
  • Provide targeted grep patterns and scanning rules to locate risky patterns in bundlers, paymasters, and wallets.
  • Use Case: Security audits during bug-bounty workflows or AA deployment reviews to produce structured vulnerability reports appended to vulnerabilities.md.

Quick Start

Scan ERC-4337 components for vulnerabilities and append results to ./assessment/vulnerabilities.md.

Frequently Asked Questions about vuln-web3-aa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan ERC-4337 smart contracts for account abstraction vulnerabilities?▼

To scan ERC-4337 smart contracts for account abstraction vulnerabilities, analyze bundlers, paymasters, and smart accounts using targeted grep patterns to detect replay, paymaster drain, and authorization weaknesses. Findings are appended to ./assessment/vulnerabilities.md.

What common Account Abstraction vulnerabilities should I look for in ERC-4337 implementations?▼

Common Account Abstraction vulnerabilities in ERC-4337 implementations include UserOperation replay attacks, paymaster drain, entryPoint exploitation, and smart account authorization weaknesses. Scanning AA code paths and configuration helps identify these risky patterns.

How do I detect UserOperation replay and paymaster abuse during an ERC-4337 security audit?▼

Detect UserOperation replay and paymaster abuse by scanning ERC-4337 bundlers and paymasters with targeted grep patterns. This identifies risky code patterns and appends structured vulnerability findings to your assessment report.

Can I use this skill for bug bounty workflows targeting Account Abstraction code?▼

Yes, you can use this skill for bug bounty workflows targeting Account Abstraction code. It performs security audits on AA deployments, scanning bundlers, paymasters, and wallets to produce structured vulnerability reports.

Do I need to provide threat-model and recon inputs to audit ERC-4337 smart accounts?▼

Yes, auditing ERC-4337 smart accounts requires threat-model.md and recon.md as inputs. The skill analyzes these files alongside AA code paths to document vulnerabilities and append results to vulnerabilities.md.

Related Skills

Explore More Software Engineering Skills→
tobihagemanntobihagemann
399

create-threat-model

Analyze a codebase and generate a structured threat model document.

Community
Advanced
josecontijoseconti
12

accessibility-audit

Audit web accessibility against WCAG 2.2 AA, EAA, ADA, and EN 301 549.

Community
Advanced
WieedzeWieedze
1

mms-smart-accounts-kit

Create and manage ERC-4337 smart accounts with gasless transactions and ERC-7715 permissions.

Community
Advanced
n4igmen4igme

vuln-web3-modern

Automate Foundry PoC template provisioning for DeFi vulnerability scanners.

Community
Intermediate