Two routes, nothing else:
The three tabs: Discover finds and prices contracts. Analyse reads the code and prepares the transaction. Processing proves it live and runs it.
The toggle in the header switches every word on the page between plain English and technical.
More networks = slower cycles. Start on mainnet. Cycle rotates one network per pass; n networks × n interval.
Takeable = dollars you could walk away with, discounted by reach difficulty and staleness. Sorted by this number. A nasty bug behind an owner check scores low; loose money scores high. takeable = value × reach × fresh (USD). value = native + token bag + owned LP off live reserves. reach ∈ {1.00 unguarded, 0.85 open init, 0.60 unread, 0.45 shove, 0.15 guarded}. fresh = 0.5–1.5 from age.
Only pools with a confirmed weakness. Ranked by reachable money. Filtered to executable reach (free/claim/shove). Ranked by takeable.
The arithmetic: what's there, how reachable, how fresh. Every multiplier named. value × reach × fresh, in dollars. All weights explicit.
An unguarded function that hands value out — skim, sweep, withdraw — no owner check. One tx, money moves.
Permissionless value-egress: public/external function moving value out with no modifier/sender guard. unguarded-payout finding, weight 1.00 (0.80 if deposit needed).
Flash-loan → move a thin pool's price → sell into the wrong number → repay. Costs only gas on failure. Flash-loan price manipulation: buy on victim pair, read sibling/oracle on displaced reserves, unwind and repay same tx. reach 0.45, SHOVE_YIELD = 2% of pool depth.
0–100 risk. Matters only if the money is reachable. Weighted risk, capped 100. Subordinate to reach.
Pick a block just before the incident if reproducing history.
Copy into a Foundry project. Read every TODO. Copy into Foundry. TODOs mark the wiring.
Real count at each step. Most contracts stop at step two — that's the funnel working. met → priced → source → route → takeable. Per enabled network, last 3h.
Spends nothing. Overrides the pool's storage, asks the contract what it thinks. If the answer changes, the window is open. eth_call with stateDiff on the pair's reserve slot. Victim's view functions called in the overridden world vs. normal.
Deploy the flash contract and fire the swap. Everything shows here — tx hash, block, profit. Compile → deploy → flash swap → arb on sibling venue → repay → profit to master wallet.
Watches every qualifying target, proves the window, and fires automatically when the edge is real. Runs 24/7. Background loop: query DB → strike proof → executor pipeline. Fires on confirmed positive edge with liquid sibling.