---
name: exploit-postmortem
description: Analyzes DeFi exploits and security incidents to extract lessons and update risk models
tags: [research, security, exploits, postmortem, analysis]
agent: researcher
var: >
  ${var} is the exploit or incident to analyze. Required.
  Example: "Wormhole Feb 2022", "Mango Markets exploit", "recent Solana DeFi hack"
---

# exploit-postmortem

> **Priority**: P1 (on-demand, triggered by security events)
> **Data sources**: Rekt.news, on-chain data, project post-mortems, security researcher threads
> **Output**: Postmortem report in `memory/research/security/postmortems/`

## Instructions

You are executing the **exploit-postmortem** skill for the Researcher agent.

### Step 1: Gather Incident Details

Use WebSearch to find all available information:
- Official project post-mortem
- Security researcher threads (Twitter, blogs)
- Rekt.news analysis
- On-chain transaction traces

### Step 2: Timeline Reconstruction

Build a chronological timeline:
1. When was the vulnerability introduced?
2. When was the exploit executed?
3. When was it detected?
4. When was the protocol paused/patched?
5. What was the total time from exploit to response?

### Step 3: Technical Analysis

Document:
- **Attack vector**: How the exploit worked (oracle manipulation, reentrancy, logic error, etc.)
- **Root cause**: The fundamental vulnerability
- **Exploit transactions**: Key transaction hashes (if on Solana/EVM)
- **Funds stolen**: Amount and token types
- **Funds recovered**: Amount recovered (if any)

### Step 4: Impact Assessment

- Direct financial losses
- Protocol TVL impact (before/after)
- Token price impact
- User trust impact
- Broader ecosystem impact

### Step 5: Lessons Learned

Extract actionable lessons:
- Could this have been prevented by existing audit practices?
- What monitoring would have detected this earlier?
- Does this affect any protocols we interact with?
- Should we update our risk models?

### Step 6: Generate Report

```json
{
  "incident": "Protocol X Oracle Manipulation",
  "date": "2024-01-10",
  "chain": "Solana",
  "protocol": "Protocol X",
  "category": "oracle_manipulation | reentrancy | logic_error | access_control | flash_loan | other",
  "funds_lost_usd": 15000000,
  "funds_recovered_usd": 5000000,
  "timeline": [],
  "technical_summary": "...",
  "root_cause": "...",
  "attack_vector": "...",
  "was_audited": true,
  "auditors": ["AuditFirm"],
  "detection_time_minutes": 45,
  "response_time_minutes": 120,
  "lessons": ["..."],
  "our_exposure": "none | indirect | direct",
  "action_items": ["Update risk scoring for oracle-dependent protocols"],
  "sources": ["url1", "url2"]
}
```

Write to `memory/research/security/postmortems/{incident_slug}.json`.
Post to guardian mesh with action items if our_exposure is not "none".

### Anti-Patterns

- Do NOT blame specific individuals. Focus on systemic issues.
- Do NOT share exploit code or step-by-step reproduction instructions.
- Do NOT speculate about identity of attackers.
- Stick to publicly available information only.

### Exit Codes

- `SKILL_OK` — postmortem complete
- `SKILL_PARTIAL` — some details unavailable (investigation ongoing)
- `SKILL_FAIL` — could not gather sufficient information

### Output

Commit message format: `researcher: exploit-postmortem — {incident_name} (${funds_lost})`
