Megaeth Developer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:33 AM UTC
• Version: 0.1.0

Overview

This is a coherent MegaETH developer guide, but it gives high-impact mainnet wallet, swap, approval, bridge, and deployment instructions with several unsafe or inconsistent examples that could cause real fund loss if copied.

Review this skill carefully before installing. Use it only with explicit human confirmation for every approval, swap, bridge, transfer, signed transaction, and deployment; prefer testnet first; verify chain ID, RPC endpoint, contract/token addresses, spender/router addresses, amounts, slippage, calldata, and simulation results from authoritative sources; and pin any external repositories or dependencies before building or installing them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T08 · Insecure Dependencies

Warning

• Location: testing.md:9

Finding

Unpinned External Repositories and Skills Create Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

` before compilation. - Install Solady using an explicit reviewed commit, for example `forge install vectorized/solady@`. - Commit and verify dependency lockfiles where supported. - Verify release signatures or published checksums before building binaries. - Review Cargo build scripts and transitive dependencies before compilation. - Audit external Skills independently before installation and pin a specific reviewed release when the platform supports it. - Document that external installation must not occur automatically or without user approval. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: wallet-operations.md:216

Finding

Remote Aggregator Response Is Submitted as a Wallet Transaction Without Validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: wallet-operations.md:187

Finding

Unlimited ERC-20 Approval Grants Excessive Long-Term Authority

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: smart-contracts.md:327

Finding

Example Multi-Token Contract Allows Unrestricted Public Minting

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: smart-contracts.md:103

Finding

Deployment Guidance Broadcasts Transactions While Skipping Simulation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: wallet-operations.md:160

Finding

Conflicting MEGA Token Addresses Can Redirect Asset Operations

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill covers wallet management, transaction submission, swaps, and bridging, but it does not include prominent warnings that these actions are irreversible and can directly move or lose funds. In this context, omission of user-safety messaging increases the risk that an agent will proceed with high-impact on-chain actions without confirmation, network verification, slippage review, or destination-address checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The gas guidance is internally contradictory: it tells users to 'skip estimation when possible' and to 'always use remote eth_estimateGas'. In a skill that guides real transaction submission, this ambiguity can cause an agent or developer to choose unsafe defaults, leading to failed transactions, underprovisioned gas, or unintended fund loss through repeated retries and bad transaction handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-reference section includes ready-to-run commands that interact with the live mainnet RPC, including sending value and broadcasting deployments, without any warning that these actions can create irreversible real transactions and spend funds. In a developer skill focused on wallet operations and deployment, users may copy-paste commands directly, which increases the chance of accidental mainnet execution, especially with flags like --broadcast and --skip-simulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples show how to submit signed transactions directly to a mainnet RPC endpoint without an explicit warning that doing so will broadcast a live transaction. In a developer skill focused on wallet operations and transaction handling, this omission increases the chance of accidental on-chain submission, fund movement, or unintended contract interaction by users copying examples verbatim.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This snippet demonstrates sending a signed raw transaction to an external mainnet endpoint, which is inherently a state-changing, irreversible action once used with a real signed payload. While expected in blockchain documentation, presenting it without strong safety framing can cause accidental transmission of valid signed transactions to production infrastructure.

Content

Scanner excerpt · rpc-methods.md (reported line 29)May include surrounding context.

bash

# Both work identically:
curl -X POST https://mainnet.megaeth.com/rpc \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section mixes MegaETH/EVM guidance with concepts and APIs that appear inconsistent with the rest of the document, such as Solana-style blockhash handling and transaction retry semantics. In a developer security guide, inaccurate chain-specific advice can cause operators to implement the wrong safety controls, miss real failure modes, or trust invalid assumptions during transaction submission and incident response.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The audit recommendation to 'Verify CPI targets' is inconsistent with the EVM/MegaETH context, where CPI is not standard terminology and suggests copy-pasted guidance from another ecosystem. In a security playbook, this kind of cross-chain confusion can mislead developers and auditors into checking the wrong interaction model, leaving actual external-call risks insufficiently reviewed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · testing.md (reported line 152)May include surrounding context.

bash

# Detailed timing breakdown
curl -i -X POST https://mainnet.megaeth.com/rpc \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' \
  -w "dns: %{time_namelookup} | connect: %{time_connect} | total: %{time_total}\n"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · wallet-operations.md (reported line 43)May include surrounding context.

bash

# Generate wallet (one-time)
node src/setup.js --json
# Stores key at ~/.evm-wallet.json (chmod 600)

Check Balance

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example uses approve(spenderAddress, maxUint256), which grants an unlimited ERC-20 allowance. If the spender contract is compromised, upgraded maliciously, or the address is incorrect, the wallet's entire token balance can be drained without further user approval. In a wallet-operations skill, omitting an inline warning makes this more dangerous because readers may copy the pattern directly into production flows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · wallet-operations.md (reported line 307)May include surrounding context.

md

## Security Notes

1. **Never expose private keys** — store at `~/.evm-wallet.json` with chmod 600
2. **Confirm before sending** — always show recipient, amount, gas before execution
3. **Use hardware wallets** for large amounts
4. **Verify contract addresses** — check explorer before interacting

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown instructs implementers to call eth_chainId or eth_blockNumber during app initialization, wallet connection, or network switch. That is user-affecting network behavior, but the documentation presents it purely as a performance optimization and does not disclose that it triggers outbound requests before the user explicitly performs a transaction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.