EVM smart contracts and DeFi, plus Rust and Solana consensus. Prove every finding. Never assume.
authorize · scope · recon · analyze · prove · rate · report · disclose
Kensho (検証) means verification. That single idea is the spine of this playbook: a finding is not real until it is proven on a fork, in a harness, or by eth_call, and a live system is never exploited.
Kensho is an end-to-end methodology for finding, proving, rating, and responsibly disclosing vulnerabilities in Web3 systems. It is written so a solo researcher can run it top to bottom, and so a team can adopt it as a shared standard. Every step ships with concrete commands, decision gates, quality bars, and fill-in templates.
- Independent security researchers and bug bounty hunters.
- Audit teams and security firms that want a repeatable, defensible process.
- Protocol engineers who want to understand how their systems get attacked.
| Track | Surface |
|---|---|
| A | EVM smart contracts and DeFi protocols |
| B | Rust and Solana consensus and validator code |
Both run through the same lifecycle and hold to the same discipline.
| Phase | What happens |
|---|---|
| 0 | Authorize and scope |
| 1 | Intake |
| 2 | Verify audit status |
| 3 | Recon and mapping |
| 4 | Analysis |
| 5 | Proof of concept |
| 6 | Severity and risk rating |
| 7 | Reporting |
| 8 | Disclosure and fix review |
- Rules of engagement. Authorization, verification safety, and integrity, stated as hard rules.
- A bug-class library. Ten EVM classes and ten consensus classes, each with pattern, detection, and fix.
- Reusable detection heuristics. Grep-level patterns that map to real historical exploits.
- A severity taxonomy. Impact times likelihood, with the bound always stated, and centralization separated from a permissionless exploit.
- Proof-of-concept and reporting standards. Reproducible from one command, asserted in numbers, one finding per report.
- A full Rust and Solana consensus track. Scope discipline, the consensus prize list, and a method for building and running a dynamic byzantine harness.
- Tooling and automation. An AI audit tool stack, a multi-agent fleet pattern, and environment gotchas learned in the field.
As a Claude Code or Agent skill. Place this folder in your skills directory and invoke it by name (kensho). The agent runs the lifecycle for you.
As a manual playbook. Open SKILL.md and work top to bottom. Every step is copy-paste ready.
- Authorized scope only.
- Fork, harness, or
eth_callproof only. Never exploit a live system. - Honest severity, always. State the bound.
- Separate centralization risk from a permissionless exploit.
- Kill your own findings when they do not hold up.
- Private until patched. Ask, never threaten.
| File | Purpose |
|---|---|
SKILL.md |
The full playbook |
README.md |
This overview |
LICENSE |
Attribution terms |
Created and maintained by Duke (@dukedotsol, GitHub cryptoduke01). Built from real offensive security engagements across EVM DeFi and Rust and Solana consensus. Field-tested, not theoretical.
Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are free to share and adapt this work, including for commercial use, as long as you keep attribution to Duke (@dukedotsol). See LICENSE.
A finding is not real until it is proven.