Stackup Bounty Workspace

This skill helps you navigate and work with Stackup's bug bounty workspace containing two independent smart contract protocols built with Foundry.

Repository Structure

The workspace contains two independent Foundry projects:

1. **Keystore** (`keystore/`) - Merkle tree-based configuration management for ERC-4337 smart accounts

2. **Forwarding Address** (`forwarding-address/`) - Deterministic address generation for payment attribution

Instructions

When working with this codebase, follow these guidelines:

Build & Test Commands

Both projects use identical Foundry commands. Always run from the project directory (`keystore/` or `forwarding-address/`):

```bash

forge install # Install dependencies

forge build # Compile contracts

forge test # Run all tests

forge test --mt <name> # Run specific test by name

forge test -vvv # Verbose with traces

```

For Keystore, also handle npm dependencies:

```bash

cd keystore && npm install

npm run examples:verify-ucmt # Generate/verify Merkle tree example

```

Keystore Protocol Architecture

Understand the core structure:

**Key Concepts:**

**Validation Flow:**

```

Account → Keystore.validate() → Verifier.validateData() → returns 0 (success) or 1 (failed)

```

Forwarding Address Protocol Architecture

Minimal proxy pattern:

**Address Derivation:**

```

keccak256(abi.encode(receiver, salt)) → deterministic clone address

```

Code Style Conventions

When reviewing or writing code:

Security Review Focus

When conducting security reviews, prioritize these critical paths:

**Keystore:**

**Forwarding Address:**

Additional Resources

Usage Examples

**Run all tests for Keystore:**

```bash

cd keystore

forge test -vvv

```

**Test specific functionality:**

```bash

cd forwarding-address

forge test --mt testFuzz_sweepFor -vvv

```

**Review critical security paths:**

Start by reading the validation flow in `Keystore.validate()` and trace through to the verifier implementations.

Constraints