[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FD6A0KH232S98DAZSRA093":3,"skill-same:01M6FD6A0KH232S98DAZSRA093":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":53,"linkOnly":54,"markdownContent":55,"markdownBody":56,"frontMatter":57,"refName":31,"commitSha":64,"skillDirectory":65,"forksCount":66,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":69,"install":70,"resources":83},"01M6FD6A0KH232S98DAZSRA093","web3-audit",null,"Smart contract security audit","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",13,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web3-audit\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52],"web3 audit","audit","web3","main","2026","smart contract","for","smart contract security","relevant","helper","offensive","scripts","scope","contract","commands","testing","community","only","security audit","Tools","license","testing tools","research","security","github","2026-11-10 10:12:30",false,"---\nname: web3-audit\ndescription: Smart contract security audit\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: public_research, community\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# WEB3 SMART CONTRACT AUDIT\n\n10 bug classes. Pre-dive kill signals. Foundry PoC template. Real paid examples.\n\n---\n\n## PRE-DIVE KILL SIGNALS (check BEFORE any code review)\n\n> ZKsync lesson: $322M TVL + OZ audit + 750K LOC + 5 sessions = 0 findings. Large well-audited bridges are extremely hard.\n\n1. **TVL \u003C $500K** → max payout capped too low for effort\n2. **2+ top-tier audits** (Halborn, ToB, Cyfrin, OpenZeppelin) on simple protocol → bugs already found\n3. **Protocol \u003C 500 lines, single A→B→C flow** → minimal attack surface\n4. **Formula**: `max_realistic_payout = min(10% × TVL, program_cap)` — if \u003C $10K, skip\n\n**Soft kill:** OZ\u002FToB\u002FCyfrin audit on current version + codebase > 500K LOC → expect 40+ hours for maybe 1 finding. Only proceed if bounty floor > $50K AND you have protocol-specific expertise.\n\n**Target scoring (go if >= 6\u002F10):**\n- TVL > $10M: +2\n- Immunefi program with Critical >= $50K: +2\n- No top-tier audit on current version: +2\n- \u003C 30 days since deploy: +1\n- Protocol you've hunted before: +1\n- Source code + natspec comments: +1\n- Upgradeable proxies: +1\n\n---\n\n## THE ONE RULE\n\n> \"Read ALL sibling functions. If `vote()` has a modifier, check `poke()`, `reset()`, `harvest()`. The missing modifier on the sibling IS the bug.\"\n\nThis single rule explains 19% of all Critical findings.\n\n---\n\n## 1. ACCOUNTING STATE DESYNCHRONIZATION\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### What It Is\nTwo state variables supposed to stay in sync. One code path updates A but forgets B. Later code reads both and makes decisions based on stale B.\n\n```\nReal Value = A - B\nIf A updated but B isn't → Real Value appears larger → phantom value\n```\n\n### Root Cause Patterns\n\n**Variant 1: Phantom Yield** (Yeet protocol — 35 duplicate reports)\n```solidity\nfunction startUnstake(uint256 amount) external {\n    totalSupply -= amount;  \u002F\u002F decremented BEFORE transfer\n    \u002F\u002F aToken.balanceOf(this) still reflects old value\n    \u002F\u002F yieldAmount = aToken.balanceOf - totalSupply = phantom yield\n}\n```\n\n**Variant 2: Fast Path Skips State Update** (Alchemix V3)\n```solidity\nfunction claimRedemption(uint256 tokenId) external {\n    if (transmuter.balance >= amount) {\n        transmuter.transfer(user, amount);\n        _burn(tokenId);\n        return;  \u002F\u002F EARLY RETURN — cumulativeEarmarked, _redemptionWeight, totalDebt never updated\n    }\n    \u002F\u002F Slow path: updates all state vars correctly\n    alchemist.redeem(...);\n}\n```\n\n**Variant 3: Update Happens in Wrong Order** (Alchemix)\n```solidity\nfunction deposit(uint256 amount) external {\n    _shares = (amount * totalShares) \u002F totalAssets;  \u002F\u002F Pre-deposit exchange rate\n    totalAssets += amount;   \u002F\u002F Pre-deposit pricing is normally intentional; prove an invariant violation before claiming a bug.\n}\n```\n\n### Grep Patterns\n```bash\n# Find all accounting variables\ngrep -rn \"totalSupply\\|totalShares\\|totalAssets\\|totalDebt\\|cumulativeReward\\|rewardPerShare\" contracts\u002F\n\n# Find all early returns in claim\u002Fredeem functions\ngrep -rn \"\\breturn\\b\" contracts\u002F -B3 | grep -B3 \"if\\b\"\n\n# For each early return: which state updates in normal path are skipped?\n```\n\n---\n\n## 2. ACCESS CONTROL\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Variant 1: Missing Modifier on Sibling Function\n```solidity\nfunction vote(uint256 tokenId) external onlyNewEpoch(tokenId) {  \u002F\u002F guarded\nfunction reset(uint256 tokenId) external onlyNewEpoch(tokenId) { \u002F\u002F guarded\nfunction poke(uint256 tokenId) external {                         \u002F\u002F NO GUARD → infinite FLUX inflation\n}\n```\n\n### Variant 2: Wrong Check (Existence vs Ownership)\n```solidity\nfunction split(uint256 tokenId, uint256 amount) external {\n    _requireOwned(tokenId);  \u002F\u002F checks if token EXISTS, not if caller OWNS it\n    _burn(tokenId);\n    _mint(msg.sender, amount);  \u002F\u002F attacker steals tokens they don't own\n}\n```\n\n### Variant 3: Silent Modifier (if vs require)\n```solidity\n\u002F\u002F Non-admin returns without executing the body; lack of revert is not an access bypass by itself:\nmodifier onlyAdmin() {\n    if (msg.sender == admin) {\n        _;  \u002F\u002F body only executes for admin, but non-admin doesn't revert\n    }\n}\n\u002F\u002F CORRECT: require(msg.sender == admin, \"Not admin\"); _;\n```\n\n### Variant 4: Uninitialized Proxy\n```solidity\nfunction initialize(address _owner) public {  \u002F\u002F MISSING: initializer modifier\n    owner = _owner;  \u002F\u002F anyone can call → become owner\n}\n\u002F\u002F Protect the proxy initializer with initializer and deploy\u002Finitialize atomically.\n\u002F\u002F Separately lock implementation initialization: constructor() { _disableInitializers(); }\n```\n\n### Grep Patterns\n```bash\n# Find sibling function families — do ALL have the same modifier set?\ngrep -rn \"function vote\\|function poke\\|function reset\\|function update\\|function claim\\|function harvest\" contracts\u002F -A2\n\n# Ownership check: existence vs ownership?\ngrep -rn \"_requireOwned\\|ownerOf\\|_isApprovedOrOwner\\|_checkAuthorized\" contracts\u002F -B5\n\n# Silent modifiers\ngrep -rn \"modifier\\b\" contracts\u002F -A8 | grep -B3 \"if (\" | grep -v \"require\\|revert\"\n\n# Uninitialized initializer\ngrep -rn \"function initialize\\b\" contracts\u002F -A3\ngrep -rn \"_disableInitializers()\" contracts\u002F\n```\n\n### Real Paid Examples\n\n| Protocol | Payout | Bug |\n|---|---|---|\n| Wormhole | $10M | Uninitialized UUPS proxy → anyone calls initialize() |\n| ZeroLend | n\u002Fa | split() uses existence check, not ownership check |\n| Alchemix | n\u002Fa | poke() missing onlyNewEpoch → infinite FLUX inflation |\n| Parity | $150M frozen | No access control on initWallet() in library |\n\n---\n\n## 3. INCOMPLETE CODE PATH\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### The Function Family Comparison Test\n```\n1. List all state changes in function A (deposit\u002Fplace\u002Fcreate)\n2. List all state changes in function B (withdraw\u002Fupdate\u002Fcancel)\n3. For each state change in A: does B have the corresponding reverse?\n4. For each token transfer in A: does B have the corresponding refund?\nIf A does X but B doesn't do the reverse of X → BUG.\n```\n\n### Variant 1: Update Function Missing Refund (ThunderNFT)\n```solidity\nfunction place_order(OrderInput calldata order) external {\n    token.safeTransferFrom(msg.sender, address(this), order.price);  \u002F\u002F takes tokens\n    orders[orderId] = order;\n}\nfunction update_order(OrderInput calldata updatedOrder) external {\n    \u002F\u002F BUG: NO REFUND for sell orders when price decreases → tokens permanently stuck\n    orders[orderId] = updatedOrder;\n}\n```\n\n### Variant 2: Partial Fill Token Stuck (Plume)\n```solidity\nfunction swapForETH(uint256 amountIn) external {\n    token.safeTransferFrom(msg.sender, address(this), amountIn);\n    uint256 filled = dex.swap(amountIn);  \u002F\u002F partial fill possible\n    _refundExcessEth(amountIn - filled);  \u002F\u002F BUG: refunds ETH only, not ERC20\n}\n```\n\n### Variant 3: mint() Bypasses Check That deposit() Has (MetaPool)\n```solidity\nfunction deposit(uint256 assets, address receiver) public override {\n    shares = _deposit(assets, receiver);  \u002F\u002F includes receipt validation\n}\nfunction mint(uint256 shares, address receiver) public override {\n    assets = convertToAssets(shares);\n    _mint(receiver, shares);  \u002F\u002F MISSING: _deposit() validation → mints without receiving assets\n}\n```\n\n### Grep Patterns\n```bash\ngrep -rn \"function place_\\|function create_\\|function add_\\|function open_\" contracts\u002F -A5\ngrep -rn \"function update_\\|function modify_\\|function cancel_\" contracts\u002F -A5\ngrep -rn \"safeApprove\\b\" contracts\u002F    # safeApprove without zero-reset before\ngrep -rn \"delete\\b\" contracts\u002F -B5 -A5  # delete before operation completes\ngrep -rn \"function deposit\\|function mint\\|function withdraw\\|function redeem\" contracts\u002F -A10\n```\n\n---\n\n## 4. OFF-BY-ONE & BOUNDARY CONDITIONS\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Root Cause\n```solidity\n\u002F\u002F VeChain Stargate — post-exit reward drain:\nfunction _claimableDelegationPeriods(address delegator) internal view returns (uint256) {\n    if (endPeriod > nextClaimablePeriod) {  \u002F\u002F BUG: should be >=\n        return 0;  \u002F\u002F exited users get nothing\n    }\n    return nextClaimablePeriod - lastClaimedPeriod;  \u002F\u002F rewards for period AFTER exit\n}\n```\n\n### Mental Test for Every Comparison\n> For every `if (A > B)`: \"What happens when A == B?\" Is that correct?\n\n### 6 Boundary Locations to Check\n1. Period\u002FEpoch boundaries: `>` vs `>=` at period end\n2. Time-based locks: does `block.timestamp == deadline` lock or unlock?\n3. Loop break conditions: `break` with `>` vs `>=`\n4. Array index boundaries: `i \u003C= array.length` (should be `i \u003C array.length`)\n5. Amount\u002Fbalance boundaries: `>= amount` allows exact full withdrawal?\n6. Rounding\u002Fprecision: can any input produce 0 output that should be non-zero?\n\n### Grep Patterns\n```bash\n# Boundaries in comparisons\ngrep -rn \"Period\\|Epoch\\|Round\\|Deadline\\|period\\|epoch\\|deadline\" contracts\u002F -A3 | grep \"[\u003C>][^=]\"\n\n# Loop breaks\ngrep -rn \"\\bbreak\\b\" contracts\u002F -B10\n\n# Off-by-one in array access\ngrep -rn \"\\.length\\s*-\\s*1\\|i\\s*\u003C=\\s*.*\\.length\\b\" contracts\u002F\n```\n\n---\n\n## 5. ORACLE \u002F PRICE MANIPULATION\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Bug A: Missing Staleness Check (most common)\n```solidity\n\u002F\u002F VULNERABLE:\n(, int256 price,,,) = priceFeed.latestRoundData();\nreturn uint256(price);  \u002F\u002F If Chainlink node goes down, stale price returned indefinitely\n\n\u002F\u002F CORRECT:\n(, int256 price,, uint256 updatedAt,) = priceFeed.latestRoundData();\nrequire(updatedAt > 0 && updatedAt \u003C= block.timestamp && block.timestamp - updatedAt \u003C= MAX_PRICE_AGE, \"Stale price\");\nrequire(price > 0, \"Invalid price\");\n```\n\n### Bug B: Missing Confidence Interval (Pyth)\n```solidity\n\u002F\u002F VULNERABLE:\nPythStructs.Price memory p = pyth.getPriceUnsafe(priceFeed);\nreturn p.price;  \u002F\u002F ignores p.conf (confidence interval)\n\n\u002F\u002F CORRECT:\nrequire(p.price > 0, \"Invalid price\");\nrequire(uint256(p.conf) * 10 \u003C= uint256(uint64(p.price)), \"Price too uncertain\");\n\u002F\u002F illustrative10% policy; also validate publishTime, exponent, units and supported feed.\n\u002F\u002F conf > 10% of price = untrustworthy\n```\n\n### Bug C: TWAP Too Short (flash loan manipulatable)\n```solidity\n\u002F\u002F VULNERABLE: 60-second TWAP\nuint32[] memory secondsAgos = new uint32[] (2);\nsecondsAgos[0] = 60; secondsAgos[1] = 0;\n\u002F\u002F A same-transaction flash loan cannot span elapsed60s; analyze multi-block capital, liquidity and observation behavior.\n\n\u002F\u002F Choose window\u002Fheartbeat\u002Fliquidity and bounded deviation from an economic threat model; no universal safe30-minute minimum.\n```\n\n### Bug D: Single-Source Oracle\n```solidity\n\u002F\u002F VULNERABLE: only Uniswap spot price\nuint price = getUniswapSpotPrice(token);  \u002F\u002F flash loan manipulatable\n\n\u002F\u002F CORRECT: Chainlink primary, Uniswap TWAP as fallback, require close agreement\n```\n\n### Grep Patterns\n```bash\n# Missing staleness check\ngrep -rn \"latestRoundData\" contracts\u002F -A5 | grep -v \"updatedAt\\|timestamp\"\n\n# Pyth price usage — confidence interval checked?\ngrep -rn \"getPriceUnsafe\\|getPrice\\b\" contracts\u002F -A8 | grep -v \"conf\\|confidence\"\n\n# TWAP windows — short TWAP flag\ngrep -rn \"secondsAgo\\|TWAP\\|cardinality\" contracts\u002F -A5\n```\n\n---\n\n## 6. ERC4626 VAULT ATTACKS\n\n### Exchange Rate Manipulation (near-empty vault)\n```solidity\n\u002F\u002F VULNERABLE — first depositor attack:\n\u002F\u002F 1. Attacker deposits 1 wei → gets 1 share\n\u002F\u002F 2. Attacker donates large amount directly (transfer, not deposit)\n\u002F\u002F 3. Exchange rate: 1 share = (1 + donation) assets\n\u002F\u002F 4. Victim deposits → rounds down to 0 shares → free donation to attacker\n\n\u002F\u002F CORRECT: virtual shares (OpenZeppelin v4.9+)\nfunction _decimalsOffset() internal view virtual override returns (uint8) {\n    return 9;  \u002F\u002F 1e9 virtual shares versus1 virtual asset in OZ's formula; mitigation is not a blanket guarantee.\n}\n```\n\n### ERC4626 Transfer (moves shares but not stake\u002Flock records)\n```solidity\n\u002F\u002F VULNERABLE: shares transferred, but lock records stay with original owner\n\u002F\u002F → shares stuck, can't redeem → permanent freeze (Belong pattern)\nfunction transfer(address to, uint256 amount) external override {\n    _transfer(msg.sender, to, amount);  \u002F\u002F moves shares\n    \u002F\u002F MISSING: transfer lock record from msg.sender to `to`\n}\n```\n\n### Grep Patterns\n```bash\ngrep -rn \"function transfer\\|function transferFrom\" contracts\u002F -A15\ngrep -rn \"function deposit\\|function mint\\|function withdraw\\|function redeem\" contracts\u002F -A10\n```\n\n---\n\n## 7. REENTRANCY\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Variants\n- **Single-function**: attacker re-enters same function before state updated\n- **Cross-function**: re-enters a sibling function with stale state\n- **Cross-contract**: re-enters via a callback to another protocol\n- **Read-only**: re-enters a view function that returns stale data used by attacker\n\n### Root Cause Pattern\n```solidity\n\u002F\u002F VULNERABLE (effects after interaction):\nfunction withdraw(uint256 amount) external {\n    require(balances[msg.sender] >= amount);\n    (bool success,) = msg.sender.call{value: amount}(\"\");  \u002F\u002F INTERACTION first\n    require(success);\n    balances[msg.sender] -= amount;  \u002F\u002F EFFECT after → reentrancy window\n}\n\n\u002F\u002F CORRECT (CEI — Checks, Effects, Interactions):\nfunction withdraw(uint256 amount) external {\n    require(balances[msg.sender] >= amount);  \u002F\u002F CHECK\n    balances[msg.sender] -= amount;            \u002F\u002F EFFECT\n    (bool success,) = msg.sender.call{value: amount}(\"\");  \u002F\u002F INTERACTION last\n    require(success);\n}\n```\n\n### Grep Patterns\n```bash\n# External calls before state updates\ngrep -rn \"\\.call{value\\|safeTransfer\\|transfer(\" contracts\u002F -B10 | grep -v \"require\\|revert\"\n\n# Missing nonReentrant modifier on critical functions\ngrep -rn \"function withdraw\\|function redeem\\|function claim\" contracts\u002F -A2 | grep -v \"nonReentrant\"\n\n# Storage slot for reentrancy guard\ngrep -rn \"nonReentrant\\|ReentrancyGuard\\|_notEntered\" contracts\u002F\n```\n\n---\n\n\n## Contents\n\n- [8. FLASH LOAN ATTACKS](references\u002Fdetails.md)\n- [9. SIGNATURE REPLAY](references\u002Fdetails.md)\n- [10. PROXY \u002F UPGRADE ISSUES](references\u002Fdetails.md)\n- [FOUNDRY POC TEMPLATE](references\u002Fdetails.md)\n- [Related Skills & Chains](references\u002Fdetails.md)\n- [Operator Notes (Claude-BugHunter)](references\u002Fdetails.md)\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n\n### Scope and evidence corrections\n\nPre-dive TVL\u002Fpayout thresholds and point scores are uncalibrated operator preferences, not safety or audit-quality rules; audits\u002Flow LOC never prove absence of bugs. No frequency percentages or named payout summaries above were independently reproduced. A missing sibling modifier is a lead, not proof: functions may require different invariants. Owner compromise or broad intended owner delegatecall is a threat-model decision, not automatically a vulnerability.\n\nUse authorized isolated local forks pinned to chain\u002Fblock\u002Faddress\u002Fcompiler\u002Fimplementation; never broadcast exploitation, move live funds, extract keys or manipulate a production oracle. Fork\u002FRPC data can cost money and leave the host; preserve secrets and validate target scope. Economic profit assertions must account for source of funds, fees, liquidity and repayment; cheatcode funding\u002Fimpersonation\u002Fwarping cannot prove an attacker has those powers. Separate reportable demonstrated impact from hypotheses. No Foundry\u002Fparser\u002Fcontract test was run.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n# WEB3 SMART CONTRACT AUDIT\n\n10 bug classes. Pre-dive kill signals. Foundry PoC template. Real paid examples.\n\n---\n\n## PRE-DIVE KILL SIGNALS (check BEFORE any code review)\n\n> ZKsync lesson: $322M TVL + OZ audit + 750K LOC + 5 sessions = 0 findings. Large well-audited bridges are extremely hard.\n\n1. **TVL \u003C $500K** → max payout capped too low for effort\n2. **2+ top-tier audits** (Halborn, ToB, Cyfrin, OpenZeppelin) on simple protocol → bugs already found\n3. **Protocol \u003C 500 lines, single A→B→C flow** → minimal attack surface\n4. **Formula**: `max_realistic_payout = min(10% × TVL, program_cap)` — if \u003C $10K, skip\n\n**Soft kill:** OZ\u002FToB\u002FCyfrin audit on current version + codebase > 500K LOC → expect 40+ hours for maybe 1 finding. Only proceed if bounty floor > $50K AND you have protocol-specific expertise.\n\n**Target scoring (go if >= 6\u002F10):**\n- TVL > $10M: +2\n- Immunefi program with Critical >= $50K: +2\n- No top-tier audit on current version: +2\n- \u003C 30 days since deploy: +1\n- Protocol you've hunted before: +1\n- Source code + natspec comments: +1\n- Upgradeable proxies: +1\n\n---\n\n## THE ONE RULE\n\n> \"Read ALL sibling functions. If `vote()` has a modifier, check `poke()`, `reset()`, `harvest()`. The missing modifier on the sibling IS the bug.\"\n\nThis single rule explains 19% of all Critical findings.\n\n---\n\n## 1. ACCOUNTING STATE DESYNCHRONIZATION\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### What It Is\nTwo state variables supposed to stay in sync. One code path updates A but forgets B. Later code reads both and makes decisions based on stale B.\n\n```\nReal Value = A - B\nIf A updated but B isn't → Real Value appears larger → phantom value\n```\n\n### Root Cause Patterns\n\n**Variant 1: Phantom Yield** (Yeet protocol — 35 duplicate reports)\n```solidity\nfunction startUnstake(uint256 amount) external {\n    totalSupply -= amount;  \u002F\u002F decremented BEFORE transfer\n    \u002F\u002F aToken.balanceOf(this) still reflects old value\n    \u002F\u002F yieldAmount = aToken.balanceOf - totalSupply = phantom yield\n}\n```\n\n**Variant 2: Fast Path Skips State Update** (Alchemix V3)\n```solidity\nfunction claimRedemption(uint256 tokenId) external {\n    if (transmuter.balance >= amount) {\n        transmuter.transfer(user, amount);\n        _burn(tokenId);\n        return;  \u002F\u002F EARLY RETURN — cumulativeEarmarked, _redemptionWeight, totalDebt never updated\n    }\n    \u002F\u002F Slow path: updates all state vars correctly\n    alchemist.redeem(...);\n}\n```\n\n**Variant 3: Update Happens in Wrong Order** (Alchemix)\n```solidity\nfunction deposit(uint256 amount) external {\n    _shares = (amount * totalShares) \u002F totalAssets;  \u002F\u002F Pre-deposit exchange rate\n    totalAssets += amount;   \u002F\u002F Pre-deposit pricing is normally intentional; prove an invariant violation before claiming a bug.\n}\n```\n\n### Grep Patterns\n```bash\n# Find all accounting variables\ngrep -rn \"totalSupply\\|totalShares\\|totalAssets\\|totalDebt\\|cumulativeReward\\|rewardPerShare\" contracts\u002F\n\n# Find all early returns in claim\u002Fredeem functions\ngrep -rn \"\\breturn\\b\" contracts\u002F -B3 | grep -B3 \"if\\b\"\n\n# For each early return: which state updates in normal path are skipped?\n```\n\n---\n\n## 2. ACCESS CONTROL\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Variant 1: Missing Modifier on Sibling Function\n```solidity\nfunction vote(uint256 tokenId) external onlyNewEpoch(tokenId) {  \u002F\u002F guarded\nfunction reset(uint256 tokenId) external onlyNewEpoch(tokenId) { \u002F\u002F guarded\nfunction poke(uint256 tokenId) external {                         \u002F\u002F NO GUARD → infinite FLUX inflation\n}\n```\n\n### Variant 2: Wrong Check (Existence vs Ownership)\n```solidity\nfunction split(uint256 tokenId, uint256 amount) external {\n    _requireOwned(tokenId);  \u002F\u002F checks if token EXISTS, not if caller OWNS it\n    _burn(tokenId);\n    _mint(msg.sender, amount);  \u002F\u002F attacker steals tokens they don't own\n}\n```\n\n### Variant 3: Silent Modifier (if vs require)\n```solidity\n\u002F\u002F Non-admin returns without executing the body; lack of revert is not an access bypass by itself:\nmodifier onlyAdmin() {\n    if (msg.sender == admin) {\n        _;  \u002F\u002F body only executes for admin, but non-admin doesn't revert\n    }\n}\n\u002F\u002F CORRECT: require(msg.sender == admin, \"Not admin\"); _;\n```\n\n### Variant 4: Uninitialized Proxy\n```solidity\nfunction initialize(address _owner) public {  \u002F\u002F MISSING: initializer modifier\n    owner = _owner;  \u002F\u002F anyone can call → become owner\n}\n\u002F\u002F Protect the proxy initializer with initializer and deploy\u002Finitialize atomically.\n\u002F\u002F Separately lock implementation initialization: constructor() { _disableInitializers(); }\n```\n\n### Grep Patterns\n```bash\n# Find sibling function families — do ALL have the same modifier set?\ngrep -rn \"function vote\\|function poke\\|function reset\\|function update\\|function claim\\|function harvest\" contracts\u002F -A2\n\n# Ownership check: existence vs ownership?\ngrep -rn \"_requireOwned\\|ownerOf\\|_isApprovedOrOwner\\|_checkAuthorized\" contracts\u002F -B5\n\n# Silent modifiers\ngrep -rn \"modifier\\b\" contracts\u002F -A8 | grep -B3 \"if (\" | grep -v \"require\\|revert\"\n\n# Uninitialized initializer\ngrep -rn \"function initialize\\b\" contracts\u002F -A3\ngrep -rn \"_disableInitializers()\" contracts\u002F\n```\n\n### Real Paid Examples\n\n| Protocol | Payout | Bug |\n|---|---|---|\n| Wormhole | $10M | Uninitialized UUPS proxy → anyone calls initialize() |\n| ZeroLend | n\u002Fa | split() uses existence check, not ownership check |\n| Alchemix | n\u002Fa | poke() missing onlyNewEpoch → infinite FLUX inflation |\n| Parity | $150M frozen | No access control on initWallet() in library |\n\n---\n\n## 3. INCOMPLETE CODE PATH\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### The Function Family Comparison Test\n```\n1. List all state changes in function A (deposit\u002Fplace\u002Fcreate)\n2. List all state changes in function B (withdraw\u002Fupdate\u002Fcancel)\n3. For each state change in A: does B have the corresponding reverse?\n4. For each token transfer in A: does B have the corresponding refund?\nIf A does X but B doesn't do the reverse of X → BUG.\n```\n\n### Variant 1: Update Function Missing Refund (ThunderNFT)\n```solidity\nfunction place_order(OrderInput calldata order) external {\n    token.safeTransferFrom(msg.sender, address(this), order.price);  \u002F\u002F takes tokens\n    orders[orderId] = order;\n}\nfunction update_order(OrderInput calldata updatedOrder) external {\n    \u002F\u002F BUG: NO REFUND for sell orders when price decreases → tokens permanently stuck\n    orders[orderId] = updatedOrder;\n}\n```\n\n### Variant 2: Partial Fill Token Stuck (Plume)\n```solidity\nfunction swapForETH(uint256 amountIn) external {\n    token.safeTransferFrom(msg.sender, address(this), amountIn);\n    uint256 filled = dex.swap(amountIn);  \u002F\u002F partial fill possible\n    _refundExcessEth(amountIn - filled);  \u002F\u002F BUG: refunds ETH only, not ERC20\n}\n```\n\n### Variant 3: mint() Bypasses Check That deposit() Has (MetaPool)\n```solidity\nfunction deposit(uint256 assets, address receiver) public override {\n    shares = _deposit(assets, receiver);  \u002F\u002F includes receipt validation\n}\nfunction mint(uint256 shares, address receiver) public override {\n    assets = convertToAssets(shares);\n    _mint(receiver, shares);  \u002F\u002F MISSING: _deposit() validation → mints without receiving assets\n}\n```\n\n### Grep Patterns\n```bash\ngrep -rn \"function place_\\|function create_\\|function add_\\|function open_\" contracts\u002F -A5\ngrep -rn \"function update_\\|function modify_\\|function cancel_\" contracts\u002F -A5\ngrep -rn \"safeApprove\\b\" contracts\u002F    # safeApprove without zero-reset before\ngrep -rn \"delete\\b\" contracts\u002F -B5 -A5  # delete before operation completes\ngrep -rn \"function deposit\\|function mint\\|function withdraw\\|function redeem\" contracts\u002F -A10\n```\n\n---\n\n## 4. OFF-BY-ONE & BOUNDARY CONDITIONS\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Root Cause\n```solidity\n\u002F\u002F VeChain Stargate — post-exit reward drain:\nfunction _claimableDelegationPeriods(address delegator) internal view returns (uint256) {\n    if (endPeriod > nextClaimablePeriod) {  \u002F\u002F BUG: should be >=\n        return 0;  \u002F\u002F exited users get nothing\n    }\n    return nextClaimablePeriod - lastClaimedPeriod;  \u002F\u002F rewards for period AFTER exit\n}\n```\n\n### Mental Test for Every Comparison\n> For every `if (A > B)`: \"What happens when A == B?\" Is that correct?\n\n### 6 Boundary Locations to Check\n1. Period\u002FEpoch boundaries: `>` vs `>=` at period end\n2. Time-based locks: does `block.timestamp == deadline` lock or unlock?\n3. Loop break conditions: `break` with `>` vs `>=`\n4. Array index boundaries: `i \u003C= array.length` (should be `i \u003C array.length`)\n5. Amount\u002Fbalance boundaries: `>= amount` allows exact full withdrawal?\n6. Rounding\u002Fprecision: can any input produce 0 output that should be non-zero?\n\n### Grep Patterns\n```bash\n# Boundaries in comparisons\ngrep -rn \"Period\\|Epoch\\|Round\\|Deadline\\|period\\|epoch\\|deadline\" contracts\u002F -A3 | grep \"[\u003C>][^=]\"\n\n# Loop breaks\ngrep -rn \"\\bbreak\\b\" contracts\u002F -B10\n\n# Off-by-one in array access\ngrep -rn \"\\.length\\s*-\\s*1\\|i\\s*\u003C=\\s*.*\\.length\\b\" contracts\u002F\n```\n\n---\n\n## 5. ORACLE \u002F PRICE MANIPULATION\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Bug A: Missing Staleness Check (most common)\n```solidity\n\u002F\u002F VULNERABLE:\n(, int256 price,,,) = priceFeed.latestRoundData();\nreturn uint256(price);  \u002F\u002F If Chainlink node goes down, stale price returned indefinitely\n\n\u002F\u002F CORRECT:\n(, int256 price,, uint256 updatedAt,) = priceFeed.latestRoundData();\nrequire(updatedAt > 0 && updatedAt \u003C= block.timestamp && block.timestamp - updatedAt \u003C= MAX_PRICE_AGE, \"Stale price\");\nrequire(price > 0, \"Invalid price\");\n```\n\n### Bug B: Missing Confidence Interval (Pyth)\n```solidity\n\u002F\u002F VULNERABLE:\nPythStructs.Price memory p = pyth.getPriceUnsafe(priceFeed);\nreturn p.price;  \u002F\u002F ignores p.conf (confidence interval)\n\n\u002F\u002F CORRECT:\nrequire(p.price > 0, \"Invalid price\");\nrequire(uint256(p.conf) * 10 \u003C= uint256(uint64(p.price)), \"Price too uncertain\");\n\u002F\u002F illustrative10% policy; also validate publishTime, exponent, units and supported feed.\n\u002F\u002F conf > 10% of price = untrustworthy\n```\n\n### Bug C: TWAP Too Short (flash loan manipulatable)\n```solidity\n\u002F\u002F VULNERABLE: 60-second TWAP\nuint32[] memory secondsAgos = new uint32[] (2);\nsecondsAgos[0] = 60; secondsAgos[1] = 0;\n\u002F\u002F A same-transaction flash loan cannot span elapsed60s; analyze multi-block capital, liquidity and observation behavior.\n\n\u002F\u002F Choose window\u002Fheartbeat\u002Fliquidity and bounded deviation from an economic threat model; no universal safe30-minute minimum.\n```\n\n### Bug D: Single-Source Oracle\n```solidity\n\u002F\u002F VULNERABLE: only Uniswap spot price\nuint price = getUniswapSpotPrice(token);  \u002F\u002F flash loan manipulatable\n\n\u002F\u002F CORRECT: Chainlink primary, Uniswap TWAP as fallback, require close agreement\n```\n\n### Grep Patterns\n```bash\n# Missing staleness check\ngrep -rn \"latestRoundData\" contracts\u002F -A5 | grep -v \"updatedAt\\|timestamp\"\n\n# Pyth price usage — confidence interval checked?\ngrep -rn \"getPriceUnsafe\\|getPrice\\b\" contracts\u002F -A8 | grep -v \"conf\\|confidence\"\n\n# TWAP windows — short TWAP flag\ngrep -rn \"secondsAgo\\|TWAP\\|cardinality\" contracts\u002F -A5\n```\n\n---\n\n## 6. ERC4626 VAULT ATTACKS\n\n### Exchange Rate Manipulation (near-empty vault)\n```solidity\n\u002F\u002F VULNERABLE — first depositor attack:\n\u002F\u002F 1. Attacker deposits 1 wei → gets 1 share\n\u002F\u002F 2. Attacker donates large amount directly (transfer, not deposit)\n\u002F\u002F 3. Exchange rate: 1 share = (1 + donation) assets\n\u002F\u002F 4. Victim deposits → rounds down to 0 shares → free donation to attacker\n\n\u002F\u002F CORRECT: virtual shares (OpenZeppelin v4.9+)\nfunction _decimalsOffset() internal view virtual override returns (uint8) {\n    return 9;  \u002F\u002F 1e9 virtual shares versus1 virtual asset in OZ's formula; mitigation is not a blanket guarantee.\n}\n```\n\n### ERC4626 Transfer (moves shares but not stake\u002Flock records)\n```solidity\n\u002F\u002F VULNERABLE: shares transferred, but lock records stay with original owner\n\u002F\u002F → shares stuck, can't redeem → permanent freeze (Belong pattern)\nfunction transfer(address to, uint256 amount) external override {\n    _transfer(msg.sender, to, amount);  \u002F\u002F moves shares\n    \u002F\u002F MISSING: transfer lock record from msg.sender to `to`\n}\n```\n\n### Grep Patterns\n```bash\ngrep -rn \"function transfer\\|function transferFrom\" contracts\u002F -A15\ngrep -rn \"function deposit\\|function mint\\|function withdraw\\|function redeem\" contracts\u002F -A10\n```\n\n---\n\n## 7. REENTRANCY\n> Heuristic review category; source frequency\u002Fseverity claims are not established here.\n\n### Variants\n- **Single-function**: attacker re-enters same function before state updated\n- **Cross-function**: re-enters a sibling function with stale state\n- **Cross-contract**: re-enters via a callback to another protocol\n- **Read-only**: re-enters a view function that returns stale data used by attacker\n\n### Root Cause Pattern\n```solidity\n\u002F\u002F VULNERABLE (effects after interaction):\nfunction withdraw(uint256 amount) external {\n    require(balances[msg.sender] >= amount);\n    (bool success,) = msg.sender.call{value: amount}(\"\");  \u002F\u002F INTERACTION first\n    require(success);\n    balances[msg.sender] -= amount;  \u002F\u002F EFFECT after → reentrancy window\n}\n\n\u002F\u002F CORRECT (CEI — Checks, Effects, Interactions):\nfunction withdraw(uint256 amount) external {\n    require(balances[msg.sender] >= amount);  \u002F\u002F CHECK\n    balances[msg.sender] -= amount;            \u002F\u002F EFFECT\n    (bool success,) = msg.sender.call{value: amount}(\"\");  \u002F\u002F INTERACTION last\n    require(success);\n}\n```\n\n### Grep Patterns\n```bash\n# External calls before state updates\ngrep -rn \"\\.call{value\\|safeTransfer\\|transfer(\" contracts\u002F -B10 | grep -v \"require\\|revert\"\n\n# Missing nonReentrant modifier on critical functions\ngrep -rn \"function withdraw\\|function redeem\\|function claim\" contracts\u002F -A2 | grep -v \"nonReentrant\"\n\n# Storage slot for reentrancy guard\ngrep -rn \"nonReentrant\\|ReentrancyGuard\\|_notEntered\" contracts\u002F\n```\n\n---\n\n\n## Contents\n\n- [8. FLASH LOAN ATTACKS](references\u002Fdetails.md)\n- [9. SIGNATURE REPLAY](references\u002Fdetails.md)\n- [10. PROXY \u002F UPGRADE ISSUES](references\u002Fdetails.md)\n- [FOUNDRY POC TEMPLATE](references\u002Fdetails.md)\n- [Related Skills & Chains](references\u002Fdetails.md)\n- [Operator Notes (Claude-BugHunter)](references\u002Fdetails.md)\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n\n### Scope and evidence corrections\n\nPre-dive TVL\u002Fpayout thresholds and point scores are uncalibrated operator preferences, not safety or audit-quality rules; audits\u002Flow LOC never prove absence of bugs. No frequency percentages or named payout summaries above were independently reproduced. A missing sibling modifier is a lead, not proof: functions may require different invariants. Owner compromise or broad intended owner delegatecall is a threat-model decision, not automatically a vulnerability.\n\nUse authorized isolated local forks pinned to chain\u002Fblock\u002Faddress\u002Fcompiler\u002Fimplementation; never broadcast exploitation, move live funds, extract keys or manipulate a production oracle. Fork\u002FRPC data can cost money and leave the host; preserve secrets and validate target scope. Economic profit assertions must account for source of funds, fees, liquidity and repayment; cheatcode funding\u002Fimpersonation\u002Fwarping cannot prove an attacker has those powers. Separate reportable demonstrated impact from hypotheses. No Foundry\u002Fparser\u002Fcontract test was run.\n",{"name":5,"risk":38,"source":58,"license":14,"sources":59,"category":51,"date_added":60,"description":7,"source_repo":61,"source_type":44,"compatibility":62,"license_source":63},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","public_research, community","2026-09-20","elementalsouls\u002FClaude-BugHunter","Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-web3-audit",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-14 14:18:11",{"source":8,"skillName":5,"commands":71,"prompt":81,"zipAvailable":82},[72,75,78],{"tool":73,"command":74},"npx","npx skills add boisenoise\u002Fskills-collections --skill web3-audit",{"tool":76,"command":77},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill web3-audit",{"tool":79,"command":80},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill web3-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web3-audit\u002FSKILL.md",true,[84],{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fdetails.md","REFERENCE","参考文档",11215,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web3-audit\u002Freferences\u002Fdetails.md",[91,118,142,165,184,206],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":96,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":53},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[100,101,102,103,104,105,106,107,47,108,109,45,110,111,112,113,114,115,116,117,32],"web","access","web access","official","development","browser","search","data","read","fetch","youtube","free tools","platform","critical","free","cover","normal","when",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":122,"sourceHtmlUrl":123,"categories":124,"keywords":128,"publishedAt":53},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[125],{"categoryNo":126,"categoryName":127,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[120,129,130,52,103,104,48,47,131,132,133,134,135,136,137,113,138,139,140,141,32],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":146,"sourceHtmlUrl":147,"categories":148,"keywords":152,"publishedAt":53},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[149],{"categoryNo":150,"categoryName":151,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000038","人力资源",[144,52,103,48,153,154,155,156,157,158,113,159,160,161,139,34,162,163,164,141,120,32],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":169,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":53},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[173,174,175,52,103,48,176,177,153,178,131,179,180,181,157,113,182,183,141,120,32],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":188,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":53},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[192,193,52,50,103,194,48,195,196,197,198,199,113,200,201,202,203,204,205,141],"make","make ugc","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":95,"licenseFileUrl":210,"sourceHtmlUrl":211,"categories":212,"keywords":213,"publishedAt":53},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[214,215,216,52,103,48,217,218,156,219,220,113,221,222,223,224,225,226,227,141],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]