Exploit Lab
How capsules are created
A capsule is the sealed, replayable record of one exploit run. Here’s where it comes from and how it reaches this page.
- 1
Run
Execute an attack path or simulate a governance compromise against a sandboxed fork runtime — never a live chain. The Lab does this through its run endpoints (see the API reference below), which the CLI and SDK call too.
- 2
Seal
The engine records every step, side-effect, and receipt, then seals the transcript and stamps it with a SHA-256 fingerprint that uniquely identifies that exact run.
- 3
Open
Paste the fingerprint into Open a Capsule below — sealed capsules are scoped to your tenant and retrieved by fingerprint.
- 4
Verify
Inspect the per-step execution, balance and storage changes, and the downloadable reproducer — the evidence trail behind the verdict.
No capsules yet? Use Load demo data on theCapsule Transcript page to open a bundled demo capsule and see the format end to end.
Open a Capsule
Paste a capsule fingerprint to open its per-step breakdown.
Capsules in Your Tenant
Every capsule sealed against this tenant by any caller (portal, CLI, SDK). Tenant scoping is enforced server-side — cross-tenant reads return 404 indistinguishably.
Loading…
Recently Viewed in This Browser
No capsules opened yet
Open a fingerprint above, or click one from the tenant list — it will show up here.
API reference
These are developer endpoints for the CLI and SDK — capsules are created by calling them out-of-band, not from this page. Expand for the route reference.
Show API endpoints
- POST
/api/v1/lab/exploit/runRun exploit
Execute an attack path against a fork runtime. Returns a sealed capsule with per-step side-effects and a reproducer.
- POST
/api/v1/lab/governance/simulate-compromiseSimulate governance compromise
Compromise a privileged role and exercise every registered capability under threshold-policy rules; blast radius reported per action.
- POST
/api/v1/lab/zk/forge-proofForge ZK proof
Run the soundness fuzzer over an R1CS constraint set; reports witnesses that satisfy constraints while forging target outputs.
- POST
/api/v1/lab/cross-runtime/admin-impactCross-runtime admin impact
Propagate a compromised admin key across EVM/SVM bindings and bridge edges. Returns the full blast-radius graph.
- POST
/api/v1/lab/paths/suggestSuggest attack paths
Synthesize runnable attack paths from a batch of findings. Each suggestion is ready to hand to /exploit/run.
- GET
/api/v1/lab/capsules/{fingerprint}Fetch capsule
Retrieve a previously sealed capsule by fingerprint. Tenant-scoped — cross-tenant reads return 404 indistinguishably.
Sign in to access the Exploit Lab
Use the Sign In button in the navigation bar.