Agent skill · research science · yaklang
defi-attack-patterns
DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilities, and token standard edge cases in decentralized finance protocols.
Why this skill is useful
Provides detailed attack patterns and executable strategies for exploiting vulnerabilities in DeFi protocols that are not commonly known.
What it needs
About 8k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: DeFi Attack Patterns — Expert Attack Playbook AI LOAD INSTRUCTION: Expert DeFi exploitation techniques. Covers flash loan mechanics, oracle manipulation (spot vs TWAP), MEV extraction (sandwich, JIT, liquidation), precision loss attacks, governance exploits, bridge vulnerabilities, and token standard pitfalls. Base models often miss the single-transaction atomicity constraint of flash loans and the distinction between spot price and TWAP manipulation. 0. RELATED ROUTING smart-contract-vulnerabilities for underlying Solidity vulnerability patterns (reentrancy, integer overflow, delegatecall) deserialization-insecure when targeting off-chain bridge relayer or indexer infrastructure --- 1. FLASH LOAN ATTACKS 1.1 Mechanism Flash loans provide uncollateralized borrowing within a single transaction. The entire borrow → use → repay cycle must complete atomically; if repayment fails, the transaction reverts as if nothing happened. Provider Max Amount Fee --- --- --- Aave V3 Pool liquidity per asset 0.05% (can be 0 for approved borrowers) dYdX Pool liquidity 0 (uses internal balance manipulation) Uniswap V3 Pool liquidity per pair 0.3% (swap fee tier) Balancer Pool liquidity Protocol-configurable 1.2 Price Oracle Manipulation Key insight: protocols using AMM spot reserves (getReserves()) as price oracles are vulnerable. Must use TWAP or external oracle (Chainlink). 1.3 Liquidity Pool Drain via Reentrancy Flash borrow → deposit into pool → trigger reentrancy during callback → withdraw more than deposited → repay loan. Exploits the combination of flash loan capital with reentrancy in pool accounting logic. 1.4 Governance Flash Borrow Defense: snapshot-based voting (Compound Governor Bravo), timelocks, minimum proposal period. --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/defi-attack-patterns