web3-audit

# WEB3 SMART CONTRACT AUDIT 10 bug classes. Pre-dive kill signals. Foundry PoC template. Real paid examples. --- ## PRE-DIVE KILL SIGNALS (check BEFORE any code review) > ZKsync lesson: $322M TVL + OZ audit + 750K LOC + 5 sessions = 0 findings. Large well-audited bridges are extremely hard. 1. **TVL < $500K** → max payout capped too low for effort 2. **2+ top-tier audits** (Halborn, ToB, Cyfrin, OpenZeppelin) on simple protocol → bugs already found 3. **Protocol < 500 lines, single A→B→C flow** → minimal attack surface 4. **Formula**: `max_realistic_payout = min(10% × TVL, program_cap)` — if < $10K, skip **Soft kill:** OZ/ToB/Cyfrin audit on current version + codebase > 500K LOC → expect 40+ hours for maybe 1 finding. Only proceed if bounty floor > $50K AND you have protocol-specific expertise. **Target scoring (go if >= 6/10):** - TVL > $10M: +2 - Immunefi program with Critical >= $50K: +2 - No top-tier audit on current version: +2 - < 30 days since deploy: +1 - Protocol you've hunted before: +1 - Source code + natspec comments: +1 - Upgradeable proxies: +1 --- ## THE ONE RULE > "Read ALL sibling functions. If `vote()` has a modifier, check `poke()`, `reset()`, `harvest()`. The missing modifier on the sibling IS the bug." This single rule explains 19% of all Critical findings. --- ## 1. ACCOUNTING STATE DESYNCHRONIZATION > #1 Critical bug class — 28% of all Criticals on Immunefi. ### What It Is Two state variables supposed to stay in sync. One code path updates...