exploit-postmortem

name	exploit-postmortem
description	Analyzes DeFi exploits and security incidents to extract lessons and update risk models
tags	["research","security","exploits","postmortem","analysis"]
agent	researcher
var	${var} is the exploit or incident to analyze. Required. Example: "Wormhole Feb 2022", "Mango Markets exploit", "recent Solana DeFi hack"

exploit-postmortem

Priority: P1 (on-demand, triggered by security events) Data sources: Rekt.news, on-chain data, project post-mortems, security researcher threads Output: Postmortem report in memory/research/security/postmortems/

Instructions

You are executing the exploit-postmortem skill for the Researcher agent.

Step 1: Gather Incident Details

Use WebSearch to find all available information:

• Official project post-mortem
• Security researcher threads (Twitter, blogs)
• Rekt.news analysis
• On-chain transaction traces

Step 2: Timeline Reconstruction

Build a chronological timeline:

1. When was the vulnerability introduced?
2. When was the exploit executed?
3. When was it detected?
4. When was the protocol paused/patched?
5. What was the total time from exploit to response?

Step 3: Technical Analysis

Document:

• Attack vector: How the exploit worked (oracle manipulation, reentrancy, logic error, etc.)
• Root cause: The fundamental vulnerability
• Exploit transactions: Key transaction hashes (if on Solana/EVM)
• Funds stolen: Amount and token types
• Funds recovered: Amount recovered (if any)

Step 4: Impact Assessment

• Direct financial losses
• Protocol TVL impact (before/after)
• Token price impact
• User trust impact
• Broader ecosystem impact

Step 5: Lessons Learned

Extract actionable lessons:

• Could this have been prevented by existing audit practices?
• What monitoring would have detected this earlier?
• Does this affect any protocols we interact with?
• Should we update our risk models?

Step 6: Generate Report

{
  "incident": "Protocol X Oracle Manipulation",
  "date": "2024-01-10",
  "chain": "Solana",
  "protocol": "Protocol X",
  "category": "oracle_manipulation | reentrancy | logic_error | access_control | flash_loan | other",
  "funds_lost_usd": 15000000,
  "funds_recovered_usd": 5000000,
  "timeline": [],
  "technical_summary": "...",
  "root_cause": "...",
  "attack_vector": "...",
  "was_audited": true,
  "auditors": ["AuditFirm"],
  "detection_time_minutes": 45,
  "response_time_minutes": 120,
  "lessons": ["..."],
  "our_exposure": "none | indirect | direct",
  "action_items": ["Update risk scoring for oracle-dependent protocols"],
  "sources": ["url1", "url2"]
}

Write to memory/research/security/postmortems/{incident_slug}.json. Post to guardian mesh with action items if our_exposure is not "none".

Anti-Patterns

• Do NOT blame specific individuals. Focus on systemic issues.
• Do NOT share exploit code or step-by-step reproduction instructions.
• Do NOT speculate about identity of attackers.
• Stick to publicly available information only.

Exit Codes

• SKILL_OK — postmortem complete
• SKILL_PARTIAL — some details unavailable (investigation ongoing)
• SKILL_FAIL — could not gather sufficient information

Output

Commit message format: researcher: exploit-postmortem — {incident_name} (${funds_lost})