Attack Chains Skill

Purpose

Detect multi-step exploit sequences where individual steps may appear benign but combine into critical vulnerabilities. Real-world exploits rarely use a single vulnerability — they chain multiple issues together.

Why Attack Chains Matter

• $624M Ronin Bridge: Social engineering → Key compromise → Validator threshold bypass → Fund drain
• $326M Wormhole: Signature verification bypass → Fake VAA → Unauthorized minting
• $182M Beanstalk: Flash loan → Governance vote → Proposal execution → Fund drain
• $130M Cream Finance: Flash loan → Oracle manipulation → Under-collateralized borrow → Drain

Chain Types

Chain	Description	File
Flash Loan	Flash loan enables price/governance manipulation	flash-loan-chains.md
Oracle	Oracle distortion enables economic exploits	oracle-chains.md
Bridge	Cross-chain verification bypass chains	bridge-chains.md
Governance	Vote manipulation and proposal hijacking	governance-chains.md

Detection Approach

1. Identify entry points: Flash loans, large token transfers, governance proposals
2. Trace data flow: Follow manipulated values through the system
3. Check invariants: Verify economic invariants hold under manipulation
4. Simulate chains: Walk through multi-step sequences mentally or in tests

Severity

Attack chains are almost always Critical or High severity because they represent complete exploit paths.

Prerequisites

Attack chain analysis requires familiarity with individual vulnerability types. The Patterns skill MUST be loaded first. Flash loan chains additionally require understanding of DeFi composability.

Validation

To verify attack chain detection, test against known exploit reproductions:

// Example: Flash loan attack chain detection pattern
// Step 1: Flash loan entry
function attack() external {
    ILendingPool(pool).flashLoan(address(this), token, amount, "");
}
// Step 2: Price manipulation during callback
function executeOperation(address, uint256 amount, uint256 fee, bytes calldata) external {
    // Manipulate oracle price
    IOracle(oracle).update(manipulatedPrice);
    // Step 3: Exploit manipulated state
    IVault(vault).borrow(collateral, inflatedAmount);
    // Step 4: Restore and repay
    IERC20(token).transfer(pool, amount + fee);
}

# Validate chain detection coverage
known_chains = ["flash-loan", "oracle", "bridge", "governance"]
for chain in known_chains:
    assert chain_detector.can_detect(chain), f"Missing detection for {chain}"

# Run chain pattern matching tests
python -m pytest tests/attack_chains/ -v

Behavior Guidelines

• Chain analysis MUST consider all entry points (flash loans, large transfers, governance proposals)
• Auditors should optionally model economic profitability of detected chains
• Cross-contract interactions are required to be traced through all delegate calls

References

• Attack Chains References - Historical exploit timelines and chain diagrams