immunefi

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

18 Claude Code skill files for smart contract security — built from 2,749 Immunefi reports, 681 DeFiHack reproductions, and real hunt experience

A BugBounty companion that checks out high-reward yielding bug bounty code-bases from Immunefi/code4rena 🙌 (use at own risk)

Combines Hardhat, TypeChain, Ethers, Waffle, Solhint, Solcover, Prettier, Tracer, storage layout analysis, EVM network forking, Immunefi/Etherscan contract download and external contract testing

This is my portfolio showcasing the vulnerabilities I have discovered during my one-year journey as a bug hunter.

Find the hole in your bug bounty report before the triager does. Pre-submission review for bounty reports and smart-contract findings, on your own model key.

🔐 Bug bounty research dashboard — CVE hunting, DeFi exploits, audit findings, vulnerability patterns. Data from HackerOne, Immunefi, DeFiHackLabs, Solodit.

Auction.sol POC

Behavioral specs (CLAUDE.md) for Claude Code. Solidity audit, Rust HFT, VLESS Reality, async Python.

Mythos-class autonomous smart contract security reasoning engine. Bloodhound maps protocol state-spaces, identifies complex logic gaps, and chains anomalies into verified exploit hypotheses using a model-agnostic LLM loop. Built for deep EVM auditing and agentic security workflows.

TUI/CLI tool for exploring Immunefi bug bounties with acceptance probability scoring

🐕 Multi-chain smart contract vulnerability scanner — 27 rules, self-learning, 5 chains

Claude skill turning a coding agent into a Web3 security researcher, built from 1,001 published Immunefi findings across 35 vulnerability classes.

Bug bounty hunting toolkit — target selection, vulnerability patterns, and report templates for smart contract security audits

🛡️ Production Web3 Smart Contract Security Audits & Foundry PoC Exploit Suites (Code4rena, Sherlock, Immunefi, CodeHawks)

Which Web3 bug bounty programs pay without KYC — and is the in-scope code actually alive? Live index + free JSON API at agent.zbang.net/radar