web3-audit
Installation
SKILL.md
WEB3 SMART CONTRACT AUDIT
10 bug classes. Pre-dive kill signals. Foundry PoC template. Real paid examples.
PRE-DIVE KILL SIGNALS (check BEFORE any code review)
ZKsync lesson: $322M TVL + OZ audit + 750K LOC + 5 sessions = 0 findings. Large well-audited bridges are extremely hard.
- TVL < $500K → max payout capped too low for effort
- 2+ top-tier audits (Halborn, ToB, Cyfrin, OpenZeppelin) on simple protocol → bugs already found
- Protocol < 500 lines, single A→B→C flow → minimal attack surface
- Formula:
max_realistic_payout = min(10% × TVL, program_cap)— if < $10K, skip
Soft kill: OZ/ToB/Cyfrin audit on current version + codebase > 500K LOC → expect 40+ hours for maybe 1 finding. Only proceed if bounty floor > $50K AND you have protocol-specific expertise.