Lessons Library

Cycle 296 - MCP credential-forwarding / path-authority-injection vein (Apify CVE-2026-50143 class)

Lesson: capture-replay differential authz fuzzing (M3 v0.1)

M2 R2 (Garden HTLC, C4 2025-11): the R1 rules work; the remaining gap is severity calibration

M2 blind-audit calibration (Kinetiq C4 2025-04): two miss-patterns that cost 7 of 8 findings

Lesson (cycle295, 2026-06-28): on a multi-CVE-swept authz surface, the residual asymmetries are DESIGN, not gaps

LST/LRT withdrawal-queue anti-extraction: payout = MIN(rate@initiate, rate@unlock) + burn-exactly-locked

Manual-audit pre-grade CHECKLIST v1 (validated across Module 2 Escher + Module 3 RabbitHole)

Manual-audit review heuristics (banked from Module 2: Escher blind audit vs C4 answer key)

MFV cash lane: the compressed-joblib picklescan/modelscan bypass is SATURATED (Gate-0 walk) + the frontier map

Proxy authz-bypass via path-encoding is only live if the UPSTREAM normalizes the encoding the proxy's authz-check missed - test the upstream alone (cheap), don't assume "most routers normalize"

Discourse full-surface differential IDOR/BAC: WALK CLEAN (the 3rd cash-gated blue-chip)

Fame-ladder cash-gate sweep: fresh + paying + self-hostable is a near-empty intersection (banked)

Mattermost CORE /api/v4 differential IDOR/BAC: WALK CLEAN (fallback after GitLab)

GitLab CE latest - FULL /api/v4 surface differential IDOR/BAC: WALK CLEAN at scale (1179 endpoints)

Cycle282: incomplete-fix vein - the advisory-body sibling gate + the low-saturation yield lever

Cycle281 WALK: verify the PRECONDITION FEATURE EXISTS before drilling a parser-differential authz-bypass lead

Reproduce the FULL dependency topology (Kafka + coordinators + partition ring) before declaring an impact dead (Loki ingest-limits cycle277 live-PoC)

Cash-gate HARD RULE: verify the program is the CASH one + ACTIVE + current tier (2026-06-22)

Disclosure-gate HARD RULE: check the PLATFORM report board for the repo, not just GitHub+CVE (2026-06-21, DB-GPT)

Next.js middleware-bypass/SSRF class = SATURATED/freshly-swept; "young PROGRAM" != "young/less-picked SECURITY SURFACE" (cycle276 saturation WALK)

Mattermost applies the team-membership / per-user self-check authz pattern COMPREHENSIVELY (cycle275 WALK calibration)

HARD RULE: the CASH-GATE must read the CURRENT reward tier on the repo page, NOT historical report amounts

Cycle274: agent-tool unsandboxed code_interpreter RCE pattern + the huntr-OSV-lane EV-per-hour calibration

GGUF / chat_template Jinja2-SSTI vein = SATURATED across listed consumers (cycle271 Phase-0, disclosure-gated pre-PoC)

GitLab hierarchy-traversal authz: the entitlement-implication invariant (cycle270 Phase-3b, CVE-2026-1080 incomplete-fix vein)

GitLab IDOR/BAC source-guided audit invariants (cycle270 Phase-1, 2026-06-21)

SCOPE GATE: a finding is a candidate ONLY if its IMPACT is in the program's scope (GitLab metadata-exclusion, 2026-06-21)

HARD RULE (process-safety near-miss, 2026-06-21): never run git checkout/sparse-checkout after an unverified `cd`

Pattern: Loss-index / loss-factor saturation traps + stale-snapshot slashing of fresh lenders

Opus 4.8 vs 4.7 behavioral delta - PENDING (no live-migration occurred Cycle 185)

Pattern: `view`-keyword (STATICCALL) as an implicit reentrancy guard

Zest Protocol V2 (Stacks / Clarity 4) - Cycle 159 lessons file

Pattern: Just-in-time settlement callbacks lack actor-binding (payer/seller confusion in no-capital-lock offer models)

K2 Soroban DeFi Lending - LEARN-MODE pass (Cycle 154)

Pattern: Fixed-maturity boundary abuse + fungible-credit risk-transfer (zero-coupon lending economics breaks)

Investment Intelligence Methodology - Cycle 148

Compound III (Comet) Extended Asset List - dual-bitmap `assetsIn` invariant

Pattern: Derived tenor (vs independent maturity input) closes the fixed-maturity boundary seam

Base Azul - Cycle 150 LEARN-MODE pass (2nd lessons-library entry)

Audit-Saturation Skill - Cross-Target Validation Lessons

META: Cross-Target Pattern Transfer - Validated Hypothesis (Cycle 150)

GitLab GraphQL Mutation Broken-Access-Control Audit (2026-06-21)

ONNX external-data cluster = SWEPT (not point-fixed); huntr Model-File-Formats lane = high-saturation (cycle269, 2026-06-21)

Keras model-load deserialization = SATURATED (huntr); disclosure-gate kills it (cycle269, 2026-06-21)

Rate-accumulator (chi/sUSDS-fork) vault + liquidity-pull (take) invariants (Spark Vaults V2, cycle268, 2026-06-21)

Spark Phase-0 invariants: port-lag severity gate, audit-PDF disclosure gate, relayer-trust-boundary (cycle268, 2026-06-21)

Oracle config-field dead-code + push-rate staleness (EtherFi Cash v3 PriceProviderV2, 2026-06-21) - CANDIDATE-grade

Delegatecall-router config-provenance + fail-closed coarse dedup-key (EtherFi Cash top-up, 2026-06-21)

LST-deposit valuation: min(self-rate, market) + 1:1 cap defeats BOTH depeg-arb AND Curve-flash-manip (EtherFi Liquifier, 2026-06-21)

HyperEVM LST: stored-bounded-rate defeats precompile-read manipulation + instant-vs-queue reservation (EtherFi beHYPE, 2026-06-21)

AVS restaking-operator identity: forward-allowlist + EIP-1271 + beacon-proxy invariants (EtherFi avs-smart-contracts, 2026-06-21)

LayerZero-OFT supply-conservation + cross-chain native-mint (SyncPool) invariants (EtherFi weETH-cross-chain, 2026-06-21)

LST rate-source bifurcation + lazy-slash instant-redeem arbitrage bounds (EtherFi restaking, 2026-06-21)

Split-layer reservation enforcement = a fragility class to flag (EtherFi LiquidityPool, 2026-06-21)

Dual-withdrawal-queue shared-liquidity union bound (EtherFi LiquidityPool, 2026-06-21)

Snapshot + recomputed-share postcondition = safe-by-construction new entry-paths (EtherFi PriorityWithdrawalQueue, 2026-06-21)

The "guard-exists-but-unwired" SSRF tell - now a 3-instance validated pattern (2026-06-21)

Cycle 264 follow-up - Bisheng unauth SSRF: live-confirm techniques that worked (2026-06-21)

OSS-vs-cloud tenancy mismatch: before hunting cross-tenant IDOR, VERIFY the tenancy boundary actually exists in the OPEN-SOURCE schema. A "raw by-id, auth unused" pattern is only IDOR if a tenant column exists to enforce.

When IDOR is saturated/disciplined, PIVOT bug class to SSRF/server-side-fetch - it's the live unmined vein. Plus: the "fetch-a-URL feature" by-design gate (cloud/multi-tenant framing is the cash angle).

Disclosure gate is GATE-0 (before ANY compute). LIVE-WORKS != UNDISCLOSED. RAGFlow IDOR = SATURATED (2nd strike).

Getting a CVE correlates with FIXING THE CLASS: VEIN-A (incomplete-fix) on freshly-CVE'd projects mostly WALKS - it pays only when the release-diff shows a NARROW fix, or the target is an UNPORTED FORK

A cluster of identical CVEs disclosed together is AMBIGUOUS (sloppy-residual OR thorough class-sweep) - resolve it with a DIFFERENTIAL RELEASE DIFF, don't guess from advisory text

Incomplete-fix often lives in SIBLING FILES the fix never opened - first_patched-verifier must grep the fix's PATTERN repo-wide, not just re-read the patched file

The IDOR-asymmetry vein works everywhere, but YIELD + SEVERITY scale with the target's authz discipline, id-strength, and leak channels - triage targets by these BEFORE the deep sweep

Chase the census's ADJACENT FOOTNOTES: an SSRF/exec guard-census surfaced a cross-tenant IDOR in passing - the per-handler authz asymmetry is the highest-yield NOVEL-cash vein on fast-moving apps

An incomplete-fix gap confirmed in SOURCE is not a finding until the attacker can REACH a VICTIM's resource - an unguessable token + blocked enumeration kills cross-tenant reachability

GitLab incomplete-fix hunting: authz is a shared chokepoint (REST+GraphQL converge), and the cash window is the 30-day public-sink gap

Cross-fork port-lag: when upstream ships a security fix, the hard-fork is a high-EV regression target - and architectural divergence leaves the port incomplete

Gitea/Forgejo authz: the coarse route middleware is NOT the gate - the deeper per-resource access computation is. Check it before claiming a gap.

ML-platform model-deserialization is by-design-trusted UNLESS chained to an unauth/cross-tenant artifact-WRITE primitive

Disclosure gate: search OPEN GitHub issues + OPEN PRs by the EXACT sink name - a CVE/advisory/huntr-disclosed search is NOT enough

Cross-language forwarded sink: a bypass only counts if it survives the upstream guard AND is effective at the downstream language's parser

huntr cash lane: run the DISCLOSURE-status eligibility gate BEFORE the live PoC, not after

Guard-retrofit census: when a project centralizes a security guard, the bug is the call site added AFTER the retrofit (the N+1th)

Live PoC refuted a "sniffable inline serve -> stored XSS" static claim: contentDisposition(name) defaults to ATTACHMENT

Cycle256 - huntr AI/ML paid lane: "consistency check != content validation" + the serving-sink completes the XSS

Cycle255 - Directus TUS-vs-REST file-overwrite guard asymmetry = CONFIRMED HIGH (incomplete fix, live cross-user PoC)

GitLab CVE-2026-6269 (hidden-MR modification, developer role) incomplete-fix = WALK CLEAN

Gitea June-14-2026 advisory watch: GHSA-wrr5 + GHSA-fhx7 incomplete-fix hunts = WALK CLEAN

GitLab CVE-2026-6552 (Group SAML Identity account-takeover) incomplete-fix hunt = WALK CLEAN

2026-06-19 - Pejji Secure-Build Standard: defensive application of our offensive findings (dogfood)

Cycle254 - "Claimed-fixed version still vulnerable": verify the PUBLISHED artifact, not the advisory's word

2026-06-18 - Digest leads: distinguish a DOCUMENTED OPT-IN fix from a HIDDEN incomplete-fix

2026-06-18 - Research auto-regen: dataset-reconciliation false-alarm + token-in-clone-URL hygiene

2026-06-17 - n8n dynamic-node-parameters credential-authz cluster: WALK CLEAN (centralized sweep)

Cycle253 - Payment money-path was DEFENDED, but the debug log next to it leaked all PII (PHPNuxBill Paystack)

Cycle252 - Incomplete fix of a 3-day-old "parameterize queries" commit (PHPNuxBill PR #448)

2026-06-17 - hono 4.12.25 CORS fix: WALK CLEAN; user-misconfig reflection is NOT an incomplete fix

2026-06-17 - python-multipart 0.0.31 fresh 4-CVE cluster: WALK CLEAN (sibling-quadratic hypothesis empirically disproved)

Spark triage - ARGUS name-collision disambiguation + domain-fit gates EV (before saturation)

Cycle251 - Scrutiny dominates the point-fixer prior; and platform-bounded bugs need the platform

Cycle250 - aiohttp C/Python parser+writer parity: a sweeper walk (and how to test the divergence)

Cycle249 - Same DoS class, fixed RIGHT (ASGI) vs WRONG (Truncator) in the SAME release

Cycle248 - A fix that ADDS a mitigation constant + docstring promise but never APPLIES it (dead mitigation)

Cycle247 - Same bug-class, opposite completeness: axios (swept) vs form-data npm (point-fixed)

Cycle246 - Trace the FULL control flow before claiming a validation gap (verify-before-claim, control-flow edition)

Cycle245 - Full-cluster audit scorecard: a "point-fixer" maintainer signal (2 of 5 fixes incomplete)

Cycle244 - "The fix addressed a SIDE-EFFECT of the named threat, not the threat itself"

Cycle243 - Predictor refinement: scattered architecture is necessary-not-sufficient for incomplete-fix; maintainer-sweep-discipline is the missing axis

Cycle242 - "Validate the initial value, miss the redirect hop" (per-hop set-difference)

Cycle241 - "Spec-faithful fix" still leaves a sibling param un-escaped in the SAME sink

Cycle 240 - Fleet ORDER BY oracle fix is THOROUGH (WALK CLEAN). The set-difference predicts incomplete-fix BUT must weight the SINK, not just the call site.

Cycle 239 - Web2 self-host active-testing lane: token-scope fixes ship per-handler, so audit the WHOLE class

Cycle 239d - Centralized authz gate (MinIO) resists the incomplete-patch class that per-handler checks (Gitea) invite. Cross-target META.

Cycle 239b - An unscoped load-by-ID in the router is NOT an IDOR if the model/service layer enforces ownership. Verify the WHOLE write path before claiming.

Subdomain-takeover sweep: cross-cert dead-app discovery + Vercel/Heroku fingerprint triage refinements

RWA-backed stablecoin: withdrawal-queue + keeper-bot + sanctions-wrapper + yield-adapter audit primitives

Re-validate a standing gate's PREMISE against fresh signals (premise can go stale even when preference holds)

META - Subdomain-Takeover Triage Playbook (transferable)

Lesson: Vercel `DEPLOYMENT_NOT_FOUND` is a fingerprint, not a confirmed takeover - the team-verification gate decides claimability

Lesson: subdomain-takeover "dangling != claimable" - the four false-positive classes

Lesson: Statuspage takeover triage needs the Host-header / claimed-control discriminator, not the raw-CNAME 302

Lesson: Firebase Hosting dangling-domain takeover fingerprint + passive/active confirmation boundary

Lesson: CORS triage double-gate - static-ACAO vs reflective, AND auth-model gate

Lesson: CT-source failover (crt.sh is the single point of failure) + "resolves != claimed" CNAME triage

Lesson: reflective-CORS + credentials=true is exploitable ONLY under cookie/HTTP-auth, NOT bearer-token

Lesson: Empty-CNAME NXDOMAIN/NODATA != dangling-CNAME takeover candidate

Rule-38.4 sub-lesson: consolidation/delete commits - signature-diff is the discriminator

META - Collateral/Oracle Seam-Hunting Playbook (transferable)

Lesson: Fresh-program subdomain-takeover triage -- claimed-CNAME fingerprint table

Lesson: OZ Governor + TimelockController consumer-side role triage (ENS DAO, SEAMS lane)

Lesson: Euler resolvedVault donation hunt - the isProxy classifier, the LTV=0 inert-config trap, and why this class is near-unwinnable on Euler scope

Lesson: Hand-rolled lzCompose handlers - what to check, and a fresh WALK-CLEAN data point

Lesson: Cross-chain consumer message-trust - where to actually look, and where it's a dead end

Lesson: Dead-oracle-feed liquidation-DoS - confirm LIVE not just MECHANICAL, and gate scope HARD

Lesson: settle LST/LRT self-rate donation-inflatability with a FORK DONATION TEST, never with a single balanceOf read

Lesson: Web2 authorization-QUOTABILITY (not target-hardness) is the binding constraint for the smaller-program pivot

Lesson: LRT-collateral oracle - the decisive bit is feed TYPE (market vs redemption), read it from dataFeedId/value-comparison, not from the wrapper

Lesson: "permissioned protocol" curating a permissionless venue is STILL curator-risk

Lesson: Pendle FIXED-LINEAR-DISCOUNT PT oracle seam (no-AMM valuation)

Lesson: PT-as-Collateral Seam Hunting (Pendle PT in lending markets)

Lesson: Rule-38.4-B containment check on "new-mechanism" High findings (Fluid net-transfer)

Lesson: Rule 38.4-B across TWO repos - the protection can move to a SEPARATE codebase

Lesson: For Web2 active-test lanes, pick programs whose ACTIVE-TEST authorization is server-rendered TEXT on the vendor's OWN domain

Lesson: `ACAO: *` WITHOUT allow-credentials is intended public-API CORS, not a finding

Lesson: MetaMorpho `totalAssets` is share-accounted, so it is NOT donation-inflatable as an oracle price source

Lesson: ERC4626 `convertToAssets` consumed as an oracle price - the bounds + monotonicity seam

Lesson: repurposed-padding-byte bit-vector expansion is a Rule-38 hot-spot (Compound Comet, 2026-06-11)

Lesson: Rule 38.4 on Morpho - "fee accrual removed from reallocate" is conservation-equivalent, not a regression

Lesson: Differential pure-math testing for "fix A replaced by equivalent fix B"

Lesson: SSRF "domain-input" validator audit - the DNS-resolution test matrix

Lesson: Rule-38 sub-pattern 38.4 - "fix REPLACED, not reverted"

DeFi / Smart-Contract Audit Lens INDEX

Governance / Timelock / Access-Control Audit Primitives

Cycle 237 - Uniswap V3 Core Concentrated-Liquidity AMM Audit Lens Mine

Cycle 236 - Morpho Blue Liquidation Engine Lesson-Mine (LENDING-LIQUIDATION audit lens)

Cross-Chain Bridge Audit Primitives (Intent / Optimistic flavor)

Cross-Chain OFT / OApp Audit Primitives (LayerZero V2)

V4-launchpad graduation/migration value-transfer lens (banked Cycle 231, Doppler/Whetstone)

V4-singleton-hook-AMM audit lens (banked Cycle 230, PancakeSwap Infinity)

Lesson: the same metric is a different SIGNAL on different sources - normalize before you threshold

Modular Account V2 - LEARN-MODE lessons (Cycle 141 + Cycle 142C)

Lesson: Oracle PROVIDER + Schnorr-aggregate-signature audit lens

Stackup Keystore (Cycle 223) - cross-chain keystore / AA config-replay primitives

Pattern: On an exchange-rate LST/vault, the cycle219 "funding clock" generalizes to "who controls the numerator of exchangeRate" - and balance-read backing is keeper-fenced while price-quote backing is the manipulable case

Lessons: Mezo mUSD (Cycle 220) - Liquity-fork-with-interest CDP

Pattern: A keeper-published shared funding-index clock closes BOTH the rounding-farm seam AND the maturity-boundary seam in one architectural move

Validate-then-mutate seam: the escalation decider (Cycle 218, Midas H5)

Cycle 217 - Contest-scanner recon rules (substring-status trap, codeAccess gate, lifecycle signal)

Lesson: list-vs-detail API asymmetry silently drops the richest leads

Intent-Settlement Router Witness-Binding Primitives (C209/C210 inversion)

Restaking: slash-vs-withdrawal-epoch invariant + the union-bound vs per-capture-subset trap

Concrete Earn V2 - Cycle 214 keeper lessons (async ERC4626 withdrawal-queue vault)

Cycle 212 - Midas RWA vault: decimals-equality gate (positive control) + validate-then-mutate slippage seam

Allowlisted-Aggregator / Diamond Router Primitives (C209 refinement)

DEX Router / Aggregator Audit Primitives (reusable checklist)

Rebasing two-track share-accounting drift: measure the SIGN, not just existence

Lesson: Async-filler "split-rounding value gate" (Cycle 204, Reserve Trusted Fillers)