web3-case-study-role-misconfig
Installation
SKILL.md
CASE STUDY: ROLE MISCONFIGURATION IN A YIELD AGGREGATOR
Bug Class: Access Control | Severity: Critical/Medium | Payout Range: $10K–$50K This file shows how to apply the full 10-class methodology to a real yield aggregator target.
TARGET PROFILE (Anonymized)
| Field | Value |
|---|---|
| Protocol Type | Yield aggregator — stablecoin → lending protocol → harvest → DEX → reward token |
| Max Bounty | $50K (Critical) |
| TVL | Low (fresh program, under $100K) |
| Core Contracts | Vault.sol, RewardsDistributor.sol |
| Program Age | ~5 days when hunted (fresh = low competition) |
| Prior Audits | Firm A (16 findings, all Risk Accepted) + Firm B (18 findings, all Risk Accepted) |
Scorecard: Max bounty (+2) + custom math (+1) + recent code (+1) + known prior audits (+1) + public source (+1) + program new (+2) = 8/10 → HUNT