poc

Structure the test with a setUp function reproducing the vulnerability preconditions, then a test_Exploit function that logs initial state, executes the attack steps in order, and asserts the claimed impact. Use forge-std Test with console2 logging and makeAddr for actor labels.

Run forge test --match-test with the exploit function name at -vvv verbosity, then verify the result maps to the claimed impact, such as assertGt for attacker profit or assertTrue for unauthorized role access. A passing test alone does not prove the vulnerability without impact assertions.

Templates cover reentrancy, access control bypass, price manipulation, flash loan attacks, integer overflow and underflow, and first depositor (ERC4626 inflation) attacks. Each template includes attacker contracts, cheatcode usage, and impact assertions.

Call reverted errors usually come from missing permissions, incorrect state preconditions, or insufficient balance and allowance. Use vm.prank or vm.startPrank for the attacker, fund accounts with vm.deal or deal, and add console2 logging to trace state before the failing call.

After three failed fix attempts, the attack scenario itself is reviewed and updated. Expected profit numbers are corrected, missing preconditions are added, or the finding is downgraded in severity or marked invalid if the exploit proves impossible.