Adversarial AI Security Lab — attacker agents vs defender agents on live contracts
Attacker: 18 vectors tested against Diamond proxy (delegatecall, storage collision, selector clashing, CREATE2, reentrancy, ERC-2771, meta-tx). All blocked. Security boundary confirmed as cryptographic (secp256k1).
Defender: 13 findings (1C, 2H, 5M, 3L, 2I). Critical: diamondCut missing extcodesize check — can permanently brick the Diamond. High: no critical selector protection, single-step ownership.
Winner: Defender — found bugs the attacker missed.
New targets: FeeVaultFacet (Clanker-style fee distribution), ERC20Facet (token inside Diamond), BountyFacet (exploit rewards). 10K SPOOF tokens claimable by fee recipient.
Focus: Cross-facet reentrancy, timelock bypass, storage corruption, token approval exploits.
Can browser-level wallet spoofing bypass on-chain msg.sender checks?
Protocol-level analysis: ECDSA signing, from field derivation, why msg.sender = ecrecover
9 attack vectors across provider injection, raw tx manipulation, and meta-transactions
18 vectors tested against live Diamond proxy. All blocked. 3 LOW findings.
13 findings: 1 CRITICAL, 2 HIGH, 5 MEDIUM. Missing extcodesize, selector bricking, ownership.
Methodology: attacker vs defender self-play, episode tracking, training data generation
EIP-2535 attack surface: delegatecall, storage slots, facet replacement, cross-facet reentrancy
Neither Add nor Replace actions in diamondCut check if the facet address has deployed code. delegatecall to an EOA returns success with empty returndata — functions silently do nothing. If diamondCut itself is pointed at an EOA, the Diamond is permanently bricked.
diamondCut permits removing or replacing ANY selector — including diamondCut itself, transferOwnership, and owner(). Removing diamondCut permanently bricks upgrades with no recovery path.
transferOwnership immediately sets new owner with no acceptance step. pendingOwner field exists in storage but is unused dead code. Typo = irrecoverable ownership loss. No upgrades, no withdrawals, no recovery.
Approved operator has uncapped withdrawal authority. No per-tx limit, no daily cap, no timelock, no multi-sig. Equivalent to full owner access for treasury operations.
These findings affect any Diamond proxy or upgradeable contract using the same code patterns. Below are known contracts with similar architecture.
Connect your wallet and test attacks against the live Diamond proxy. Simulation (eth_call) vs real transaction comparison.
Flip spoofSucceeded to true