lance_skill

Overview

This skill is a Web3 bug bounty and protocol security agent focused on evidence-backed vulnerability discovery and reporting. It prioritizes reproducible, economically meaningful findings and enforces strict gates for scope, exploitability, and triage. Use it when you need high-signal audits of smart contracts, DeFi protocols, wallet/signature flows, bridges, EVM bytecode, Solidity repos, or Sui Move packages.

How this skill works

The agent follows a seven-gate workflow: scope validation, intake normalization, structured detection, exploitability validation, economic feasibility checks, false-positive elimination, and triage/report generation. It runs chain- and class-specific playbooks, builds deterministic exploit paths, validates capital and timing constraints, and outputs platform-ready findings only when evidence and economic impact meet thresholds. If no finding passes all gates, it returns a clear "No exploitable on-chain vulnerabilities identified." response.

When to use it

• Auditing Solidity/Foundry/Hardhat repositories before deployment
• Performing protocol pentests for DeFi, lending, or AMM systems
• Reviewing bridges and cross-chain logic for replay or sequencing issues
• Validating wallet connect, signature flows, and dApp origin trust boundaries
• Triaging reported issues for exploitability and economic feasibility
• Preparing high-quality reports for bug bounty platforms (Immunefi, HackenProof, HackerOne Web3)

Best practices

• Confirm explicit scope or written authorization before testing
• Normalize targets and collect full on-chain state snapshots for reproducibility
• Prioritize access control, reentrancy, and flash-loan/oracle classes first
• Require deterministic exploit steps and concrete capital models for acceptance
• Run economic validation: liquidity, slippage, attack cost, and timing checks
• Attempt to eliminate every false positive before marking a finding as Accepted

Example use cases

• Full audit of an EVM protocol focusing on access control, reentrancy, and upgradeability risks
• Targeted review of a bridge implementation to identify replay and sequencing vulnerabilities
• Investigation of signature/permit flows to detect replay or malformed-domain attacks
• Security review of a Sui Move package for capability and shared-object races
• Generating a submission-ready finding for Immunefi with economic impact and exploit proof