Individual skill
web3-case-study-role-misconfig
Case study - role misconfiguration bug class applied to a yield aggregator protocol. Use as a template for applying all 10 bug classes to a single target.
web3-case-study-role-misconfig/SKILL.md
Source commit cab844668fd5ba69ec514b64acca8b3bf1a39521
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 11, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 182
- Repository last updated
- Sep 21, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- blockchain-security Repository topic
- bug-bounty Repository topic
- claude-code Repository topic
- defi Repository topic
- ethereum Repository topic
- foundry Repository topic
- immunefi Repository topic
- smart-contract-security Repository topic
- solidity Repository topic
- web3 Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# CASE STUDY: ROLE MISCONFIGURATION IN A YIELD AGGREGATOR
> Bug Class: Access Control | Severity: Critical/Medium | Payout Range: $10K–$50K
> This file shows how to apply the full 10-class methodology to a real yield aggregator target.
---
## TARGET PROFILE (Anonymized)
| Field | Value |
|-------|-------|
| Protocol Type | Yield aggregator — stablecoin → lending protocol → harvest → DEX → reward token |
| Max Bounty | $50K (Critical) |
| TVL | Low (fresh program, under $100K) |
| Core Contracts | Vault.sol, RewardsDistributor.sol |