vulnhunter

Search for user input flowing into database calls without parameterization using grep patterns for f-strings, concatenation, and format strings in execute() calls. Semgrep taint-tracking rules can automate detection of source-to-sink flows.

Variant analysis extracts the abstract pattern from a confirmed vulnerability, such as source-to-sink data flow, then searches the codebase for structurally similar flaws. Each candidate match is validated for reachability, input control, and impact before being reported.

Semgrep provides cross-language pattern matching, CodeQL enables dataflow analysis, and language-specific tools include Bandit for Python, Slither for Solidity, and cargo audit for Rust. The methodology combines automated scans with manual checklist review.

Yes, the skill includes Solidity-specific patterns covering reentrancy, tx.origin authentication, delegatecall risks, and integer overflow. A worked example demonstrates hunting reentrancy variants across a DeFi protocol using Slither and Semgrep rules.

Findings are scored using CVSS-like factors including access vector, complexity, privileges, and impact, then mapped to a priority matrix combining exploitability with impact. Critical issues that are easy to exploit are flagged for immediate remediation.