Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

LIVE HUNT: ZKsync Era — DEFENSE STUDY · gabson0x | DecimalAI

securityby gabson0x

LIVE HUNT: ZKsync Era — DEFENSE STUDY

gabson0x/web3-hunt-zksync-era

Source gabson0x/bountyforge ↗License Not recorded

ZKsync Era (Immunefi) completed hunt — 0 findings after exhaustive 5-session audit. Use as a DEFENSE STUDY — learn what makes a protocol unhuntable, which patterns block all 10 bug classes, and when to abandon a target. Contains architecture breakdown, 25 tested attack vectors, and pre-dive scoring refinements for large L1 bridge protocols.

SkillScore73Maintained

Automatic

Security & AppSec pack

Last verified 10/9/2026

What it changes

Passed 16 of 22 test cases with the skill, and 5 of 22 without it.

Without skill23%

With skill73%

Checks it passed that the model alone missed

The strategy recommends shifting focus to ZK circuits written in Rust or RISC-V.
The report specifies a 5-role RBAC access control model using AccessControlEnumerable.
The strategy highlights Yul bootloader assembly code as a primary secondary target surface.

and 12 more in the full report

11 fixed5 passed either way6 still failing0 broke

Pass-rate lift: +50 pp
Tokens: +74%
Agent turns: 0%
Response time: +8%

Model gemini-3.6-flashMeasured 10/9/2026v116 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/gabson0x-web3-hunt-zksync-era/SKILL.md https://app.decimal.ai/s/gabson0x-web3-hunt-zksync-era/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add gabson0x-web3-hunt-zksync-era, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/gabson0x-web3-hunt-zksync-era/ and pins it in .decimal/skills.lock

decimalai skills add gabson0x-web3-hunt-zksync-era

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/gabson0x-web3-hunt-zksync-era/SKILL.md https://app.decimal.ai/s/gabson0x-web3-hunt-zksync-era/SKILL.md

Raw file: /s/gabson0x-web3-hunt-zksync-era/SKILL.md ↗ · machine-readable summary at /s/gabson0x-web3-hunt-zksync-era.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 11

Prompt

Can you prepare a smart contract security analysis summarizing why a major L2 bridge stack resisted exploitation despite extensive testing? Formulate the output as a dual-table breakdown: first, a structured matrix detailing cross-chain messaging and bridge attack vectors with failure reasons; second, a defense pattern catalog highlighting structural safeguards like check-effects-interactions and encoding isolation.

What was checked, without and with the skill
Checked	Without skill	With skill
The output includes L1Nullifier legacy byte encoding failure reasons in the attack vector matrix.	Missed	Passed
The output details failure reasons for secondBridgeAddress return value manipulation in Bridgehub.	Missed	Passed
The defense catalog details system contract isolation requiring bootloader caller authorization.	Missed	Passed

case-02 · gemini-3.6-flash · 10/9/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md174 linessingle file

LIVE HUNT: ZKsync Era — DEFENSE STUDY

0 findings after exhaustive 5-session audit. Learn what makes a protocol unhuntable.

See also: [[Web3 Audit]], [[Methodology]], [[Web3 Bug Classes]], [[Trust Map]], [[Lead Ledger]]

TARGET PROFILE

Field	Value
Protocol	ZKsync Era (L2 rollup)
Platform	Immunefi
TVL	$322M (L2BEAT Total Value Secured)
Bounty	$100K minimum Critical, $1.1M max
Codebase	750K LOC (Solidity + Rust + Yul)
Audits	OpenZeppelin V29 (June 2025), multiple prior audits
Version	Protocol V29.4
Repo	`github.com/matter-labs/era-contracts`
Primacy	Primacy of Impact — even out-of-scope assets qualify
Prior payouts	$50K (ChainLight ZK circuit bug)

Pre-Dive Scorecard

Check	Result	Score
TVL > $500K	$322M	PASS
Max payout > $10K	$100K minimum	PASS
Simple protocol?	750K LOC, L1↔L2 bridge + ZK + governance	PASS (complex)
< 500 lines?	750K LOC	PASS
Audit quality	OpenZeppelin (top-tier) on ALL critical paths	WARNING

REFINEMENT: Pre-dive should weight audit quality MORE for large protocols. A protocol passing TVL/LOC/payout checks can still be unhuntable if OZ/ToB audited the exact code you'd hunt. Add "audit firm tier" as a SOFT kill signal for 500K+ LOC protocols.

ARCHITECTURE (What Makes It Hardened)

Track record

Benchmark

16 / 22

test cases passed, vs 5 / 22 without

Adoption

Users: 1
Times used: 20

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 9/18/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

gabson0x / bountyforge

skills/web3/web3-hunt-zksync-era/SKILL.md

View on GitHub ↗

Imported 9/18/2026Version v1

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

LIVE HUNT: ZKsync Era — DEFENSE STUDY

TARGET PROFILE

Pre-Dive Scorecard

ARCHITECTURE (What Makes It Hardened)

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills