Deterministic Proof-of-Concept exploits for high-severity Web3 vulnerabilities across EVM, SVM, and MoveVM architectures. Maintained by Arkheionx (@Yudis-bit).
| ID | Date | Protocol | Vulnerability Vector | Severity | PoC Path |
|---|---|---|---|---|---|
| 01 | 2022-10 | Illuminate / APWine | DoS via 1 wei Donation | 🔴 High | EVM/test/2022-10-Illuminate.t.sol |
| 02 | 2023-03 | Euler Finance | Logic Error (Donation) | 🔴 Critical | EVM/test/2023-03-EulerFinance.t.sol |
Vulnerabilities currently under responsible disclosure or active contest embargo. Proof of Concepts will be published post-patch.
| Target Environment | Vulnerability Class | Expected Release | Status |
|---|---|---|---|
| Soroban (Stellar) | Cryptography / Signature Replay | TBD | 🟡 Pending Fix Validation |
| EVM (Arbitrum) | Logic Error / DeFi Math | Q3 2026 | 🟢 Patched |
- Logic & State: Euler Finance
- Denial of Service (DoS): Illuminate
- Cryptography & Signatures: (Embargoed)
Environments are isolated by virtual machine. Dependencies, execution flows, and runtime assumptions are scoped per VM family.
Dependencies:
curl -L https://foundry.paradigm.xyz | bashExecution:
forge test --fork-url $ETH_RPC_URL -vvvv(Forked block numbers are pinned in test file headers).
Dependencies: Solana CLI, Anchor, Bankrun
Execution:
anchor test --skip-local-validatorExecution:
aptos move test --dev- Isolation: One exploit per file. Zero shared state across tests.
- Deterministic Verification: Every exploit terminates with hard assertions against concrete post-exploit state.
- Call Trace Transparency: Tests are designed for maximum trace visibility. Full call traces expose calldata manipulation and internal state transitions.
- Real State Execution: No mocks. Exploits utilize mainnet forks at pinned block numbers or deterministic local validators with deployed bytecode.
Format: [VM_Directory]/test/YYYY-MM-ProtocolName.[ext]
| Component | Definition |
|---|---|
| YYYY-MM | Disclosure date |
| ProtocolName | PascalCase |
| [ext] | .t.sol for Foundry, .rs for Rust |
| Level | Definition |
|---|---|
| 🔴 Critical | Direct, unconditional loss of funds or protocol takeover. |
| 🔴 High | Loss of funds under specific conditions, or permanent DoS of core functionality. |
| 🟡 Medium | Conditional fund risk, governance manipulation, or reversible DoS. |
This repository is provided exclusively for defensive security research, vulnerability analysis, and auditor training. Any unauthorized reproduction, deployment, or adaptation of these Proof of Concepts against live, unpatched contracts, protocols, or production systems is strictly prohibited and may violate applicable law, contractual restrictions, and responsible disclosure obligations.
Contact: Arkheionx (@Yudis-bit)