Defi Attack Patterns

This is a comprehensive reference for understanding how DeFi protocols get exploited, covering everything from flash loan mechanics to MEV extraction and bridge vulnerabilities. Load it when you're auditing smart contracts, analyzing post-mortems of exploits, or building protocol defenses. The real value is in the specifics: it breaks down the exact atomicity constraints that make flash loans work, explains why spot price oracles are dangerous compared to TWAP, and walks through attack sequences like vault inflation and JIT liquidity. It won't write exploit code for you, but it will make you think like an attacker when reviewing lending protocols or AMM integrations.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill defi-attack-patterns --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: DeFi Attack Patterns — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert DeFi exploitation techniques. Covers flash loan mechanics, oracle manipulation (spot vs TWAP), MEV extraction (sandwich, JIT, liquidation), precision loss attacks, governance exploits, bridge vulnerabilities, and token standard pitfalls. Base models often miss the single-transaction atomicity constraint of flash loans and the distinction between spot price and TWAP manipulation.

0. RELATED ROUTING

smart-contract-vulnerabilities for underlying Solidity vulnerability patterns (reentrancy, integer overflow, delegatecall)
deserialization-insecure when targeting off-chain bridge relayer or indexer infrastructure

1. FLASH LOAN ATTACKS

1.1 Mechanism

Flash loans provide uncollateralized borrowing within a single transaction. The entire borrow → use → repay cycle must complete atomically; if repayment fails, the transaction reverts as if nothing happened.

SKILL.md on GitHub