blockchain-pentest

name	blockchain-pentest
description	Guides blockchain and smart contract security testing with reentrancy, flash loan, and access control analysis using Slither and EVM tooling. Use when auditing Solidity contracts, DeFi protocols, EVM dApps, or Web3 signing workflows in engagement scope.

Blockchain Pentest

Prerequisites

• Target contract addresses and chains are in scope (scope/scope-master.txt, engagement ROE).
• Use testnet forks or local Anvil/Hardhat before mainnet interaction.
• Flash loan and reentrancy tests may require ROE authorization for live DeFi pools.

Workflow

Task Progress:
- [ ] Map protocol architecture (contracts, oracles, admin keys)
- [ ] Static analysis (Slither, Mythril) and manual review
- [ ] Test reentrancy, access control, and arithmetic edge cases
- [ ] Run mutation testing to validate test coverage
- [ ] Document findings with transaction hashes and PoC scripts

Phase 1: Architecture mapping

Information gathering

MSF: No direct module. Use block explorers and on-chain queries.

CLI fallback:

# Etherscan/Sourcify contract source verification
# Proxy pattern detection (EIP-1967, EIP-1822, beacon proxies)
# cast call, cast storage for on-chain state reads
cast code 0xContractAddress --rpc-url $RPC_URL
cast storage 0xContractAddress 0 --rpc-url $RPC_URL

Key concepts

Term	Relevance
Smart contract	On-chain logic with immutable/deployed code
DeFi	Financial primitives (lending, AMM, staking)
Flash loan	Uncollateralized loan within single transaction
MEV	Miner/validator extractable value from tx ordering
Proxy	Upgradeable contract pattern via delegatecall

Phase 2: Vulnerability classes

Reentrancy

MSF: No direct module. Use Foundry/Slither for testing.

CLI fallback:

// Vulnerable pattern: external call before state update
function withdraw() external {
    uint amount = balances[msg.sender];
    (bool ok,) = msg.sender.call{value: amount}("");
    balances[msg.sender] = 0;
}

Test: single-function, cross-function, read-only (ERC-777 hooks), cross-contract.

Access control

MSF: No direct module. Use Slither detectors.

CLI fallback:

function setOwner(address _new) external { owner = _new; }
require(tx.origin == owner);

Oracle manipulation and flash loan attacks

MSF: No direct module. Use Foundry fork tests.

CLI fallback:

anvil --fork-url $RPC_URL --fork-block-number 18000000
forge test -vvv --fork-url $RPC_URL --match-test testFlashLoan

Phase 3: Static analysis

Slither

MSF: No direct module. Use Slither CLI.

CLI fallback:

slither contracts/ --print human-summary
slither contracts/ --detect reentrancy-eth,reentrancy-no-eth
slither contracts/ --print vars-and-auth
slither contracts/ --checklist
slither contracts/ --json slither_output.json

Mythril

MSF: No direct module. Use Mythril CLI.

CLI fallback:

myth analyze contracts/Vault.sol -o json
myth analyze -a 0xContractAddress --rpc infura

Slither mutation testing

MSF: No direct module. Use slither-mutate.

CLI fallback:

pip install slither-analyzer slither-mutate
slither-mutate contracts/ --test-cmd "forge test" --mutation-operator all

Phase 4: Dynamic testing with Foundry

Setup fork and PoC

MSF: No direct module. Use Foundry/Anvil.

CLI fallback:

anvil --fork-url $RPC_URL --fork-block-number 18000000
forge test -vvv --fork-url $RPC_URL --match-test testReentrancy

Phase 5: Web3 signing and frontend

dApp frontend testing

MSF: No direct module for smart contracts. Use web-app-pentest for frontends.

CLI fallback:

# Test XSS, SSRF in dApp frontends
# Verify transaction preview matches actual calldata
# Test RPC endpoint exposure and API key leaks

Load web-app-pentest for dApp frontend vulnerability testing.

Impact escalation

Stage	Technique
Info	Read public storage, event logs
Financial	Drain funds via reentrancy, flash loan
Governance	Flash-borrow votes, proposal manipulation
Admin	Uninitialized proxy, compromised upgrade key
Persistent	Backdoored implementation contract

Metasploit integration

MSF has limited blockchain coverage. Use for adjacent infrastructure (JSON-RPC nodes, web frontends, exposed services).

Search for web3/JSON-RPC modules

MSF MCP (preferred):

msf_search_modules(query="ethereum")
msf_search_modules(query="json rpc")
msf_search_modules(query="geth")
msf_search_modules(query="web3")

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'search ethereum; search json rpc; search geth; exit'"
searchsploit ethereum json-rpc

Scan blockchain node infrastructure

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="<node_ip>",
  nmap_args="-sV -p 8545,8546,30303,8080,443"
)
msf_service_info(host="<node_ip>", only_up=true)

CLI fallback:

nmap -sV -p 8545,8546,30303,8080,443 <node_ip>
curl -X POST http://<node_ip>:8545 -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"web3_clientVersion","params":[],"id":1}'

Test exposed JSON-RPC auxiliary modules

MSF MCP (preferred):

msf_run_auxiliary_module(
  engagement_id="<id>",
  module_name="auxiliary/scanner/http/http_version",
  options={"RHOSTS": "<node_ip>", "RPORT": 8545}
)
msf_module_check(
  engagement_id="<id>",
  module_type="auxiliary",
  module_name="auxiliary/scanner/http/http_version",
  options={"RHOSTS": "<node_ip>", "RPORT": 8545}
)

CLI fallback:

curl -s http://<node_ip>:8545/
nmap -sV --script http-headers -p 8545 <node_ip>

Pair with web-app-pentest for dApp frontends and wallet connect flows.

Related skills

• web-app-pentest - dApp frontends, API endpoints, SSRF to RPC nodes
• reversing-pentest - bytecode analysis when source unavailable
• reporting-pentest - document on-chain PoC with tx hashes
• ssrf-pentest - SSRF to JSON-RPC nodes and internal blockchain services