0xHacked

0xHacked (opens in a new tab) is a post-audit security protocol that enables war rooms for whitehats, where the white hat can submit the proof of exploit to claim a bug bounty without disclosing details through ZKP.

Please feel free to contact me via Telegram (opens in a new tab) if you have any questions or encounter any errors.

Enjoy Hacking!

Quickstart

1. prepare the PoC

// SPDX-License-Identifier: UNLICENSED
pragma solidity >=0.4.22 <0.9.0;
 
// This `Exploit` contract is a must-have. zkProver invokes Exploit contract by default.
contract Exploit {
    // constructor functions aren't supported.
    // constructor() {
    //    code here doesn't work.
    // }
 
    function exploit() public {
    }
}

Here are some PoC demos (opens in a new tab) for your reference.

2. generate the proof

After debugging this exploit contract using Foundry (opens in a new tab), you can generate the proof of exploit on 0xHacked Online Tool (opens in a new tab) or follow the commands below to do it locally. 0xHacked also supports flash loans, we stay the same as https://book.getfoundry.sh/reference/forge-std/deal (opens in a new tab). See zkProver evm -h for more details.

zkProver evm Exploit.sol -b BLOCK_NUMBER -r https://rpc.flashbots.net/
 
# use -d to set the balance of your PoC contract
zkProver evm Exploit.sol -b BLOCK_NUMBER -r https://rpc.flashbots.net/ -d 10000ethers -d 0xdac17f958d2ee523a2206206994597c13d831ec7:100000gwei

If you haven't installed zkProver, please visit zkProver repository (opens in a new tab).

3. upload the proof

Upload your proof binary file to 0xHacked (opens in a new tab). The sample proof file can be downloaded from Github (opens in a new tab). We'll check the token balance change and state diff once uploaded and confirm the exploit asap.