Foundry POC Mainnet Fork — Development skill for Claude Code

foundry-poc-mainnet-fork

A [Claude Code](https://docs.claude.com/en/docs/claude-code/overview) skill that turns a smart contract vulnerability finding into a submission-ready Foundry PoC that forks mainnet and exercises real deployed contracts end-to-end.

Built and validated by [@cholakovvv](https://x.com/cholakovvv) across four production bounty findings spanning freeze, routing DoS, and pool-drain theft shapes.

What It Does

Given a vulnerability description and the deployed addresses of the affected protocol, the skill produces a single Foundry test file that:

• Forks mainnet (or any EVM chain) at a block where the bug is reachable
• Binds every protocol contract as a constant real address
• Executes the full causal chain from the action that first triggers the vulnerable state to the final realized impact
• Ends with assertions that encode the vulnerability's end-state (balance deltas for theft, reverts for DoS, quantified stranding for freeze)
• Passes forge test -vvvv on the first try, or flags a blocker with a concrete reason

No mocks. No minimal reimplementations. No `vm.store` shortcuts around protocol pipelines unless explicitly documented.

Who This Is For

Smart contract security researchers working on bug bounty platforms or audits who want to produce a clean mainnet-fork PoC without spending 2 hours on boilerplate and address-hunting. The skill takes care of:

• Classification of the finding (frozen historical vs forward-looking risk vs both)
• Identifying the first-triggering action in the causal chain
• Finding real deployed addresses when the user provides partial info
• Writing interfaces that match deployed bytecode
• End-to-end test structure with labeled balance deltas

Requirements

• Claude Code with a Claude Sonnet 4.5 or Claude Opus 4.5+ subscription (or API access)
• Foundry installed (forge, cast)
• An EVM RPC URL (free Alchemy, Infura, drpc.org, mevblocker.io all work)

Installation

cd ~/.claude/skills