---
name: evm-proof-of-impact
description: Turn a concrete EVM finding into a realistic, runnable Foundry proof with controls, final-state assertions and explicit attacker resources. Use after identifying a specific candidate, not for generic discovery or mainnet exploitation.
---

# EVM proof-of-impact specialist

Read [forefy's Foundry PoC instructions](references/foundry-poc.md), then apply the constraints below.
This is a native adaptation; no Foundry installer, service, or extra runner is bundled. See SOURCES.md.

1. Identify the existing project toolchain, target commit, implementation/configuration, and fork
   chain/block. Read the actual path and inspect test/dependency scripts before executing them.
2. Use the project's existing Foundry setup. If it is unavailable, record the missing prerequisite;
   do not silently install a toolchain or describe an unexecuted test as a reproduction.
3. Show how the attacker reaches every prerequisite. A test cheatcode may model fixture setup,
   but may not grant authority, funds, state corruption, or code changes unavailable in the scenario.
4. Run a permitted baseline and a treatment that changes the hypothesized cause. Keep the target
   implementation intact; change only controlled fixtures, calls and genuinely available inputs.
5. Assert the final claimed effect, including victim and attacker balances, debt/shares, locked assets,
   or another eligible invariant. Profit is necessary only when the claim is profitable extraction;
   integrity or availability findings have their own success conditions.
6. Include financing, fees and liquidity where material. Verify a causal counterexample or patch
   comparison when feasible, and explain why the assertion distinguishes the flaw from ordinary use.
7. Save the exact command, environment and observed result. Keep the source evidence and minimal
   test separate from a redacted report; use fp-check before a report-ready verdict.

Use local execution. No mainnet broadcast, real-fund movement or interaction with third-party accounts.
Failure to compile, a failed control, or an unavailable fork remains blocked/inconclusive, not a finding.