/exploit-live

description: Generate an exploit against a *deployed* contract on a fork. Validates the exploit works on live state.
argument-hint: "<chain> <address> <finding-id>"
allowed-tools: Read, Write, Bash, Agent, Skill, mcp__block-explorer__*, mcp__anvil__*, mcp__forge-runner__*

/exploit-live — exploit a deployed contract on a fork

For when the user has a finding from `/audit-live` and wants to verify it works on the real deployment.

Procedure

Step 1 — Fork the chain

mcp__anvil__fork(chain=<chain>, block=latest)

Capture the RPC URL.

Step 2 — Pull source if needed

If we don't already have the source from `/audit-live`, pull it via `block-explorer`.

Step 3 — Write the PoC against the fork

Same template as `/exploit` but using `vm.createFork` and `vm.activeFork` to target the live deployment:

function setUp() public {
    forkId = vm.createFork(ANVIL_FORK_URL);
    vm.selectFork(forkId);
    target = Vault(payable(LIVE_ADDRESS));
}

function test_Exploit_Live() public {
    // attempt against the *actual deployed state*
}

Step 4 — Run

Use `forge-runner` MCP with `--fork-url` pointed at the anvil instance.

Step 5 — Output

If the test passes:

✗ EXPLOITABLE on live deployment

  Chain:     berachain
  Block:     12345678
  Contract:  0xabc...
  Finding:   REENT-001
  Value extractable: ~$420K (at current price)

  PoC: test/live-exploits/ExploitLive-REENT-001.t.sol

If the test fails (i.e. the exploit doesn't work in practice):

✓ Finding REENT-001 does NOT exploit the live deployment as written.
  Possible reasons: live state differs from setUp assumption, finding requires
  preconditions not met by current state, or finding is a false positive.

This is a valuable output — false positives caught.

Responsible disclosure

If the exploit works against a contract not owned by the user, the output should include a **prominent disclosure reminder**:

⚠ RESPONSIBLE DISCLOSURE
This exploit works against a live deployment that you may not own.
DO NOT execute on mainnet. Coordinate disclosure via:
  - Immunefi:           https://immunefi.com
  - Protocol's bounty:  (check the protocol's docs)
  - SEAL 911:           https://seal-911.com  (emergency)

Notes

• Always fork at a recent block to reflect current state.
• Don't share the PoC publicly until the protocol has patched. Use `/bounty` to generate a disclosure-ready report and `/bounty-submit` to package it for Immunefi.