The PoC problem
You've found a vulnerability in a DeFi protocol. The bug bounty program wants proof it works. This is where most submissions fail.
Foundry has become the default toolkit for writing exploit proofs-of-concept, particularly on Immunefi, the largest Web3 bug bounty platform. The framework's fork testing capability lets researchers demonstrate vulnerabilities against real mainnet state without executing actual attacks.
Why Foundry won
The shift from Hardhat is about speed and capability. Foundry's Rust-based engine runs fork tests orders of magnitude faster. Its cheatcodes let researchers impersonate accounts (vm.startPrank), manipulate block state, and deal tokens without complex setup.
The killer feature: --fork-url testing against mainnet state at specific blocks. This matters for bug bounties because platforms like Immunefi require "minimally invasive" PoCs that prove impact without causing real damage. Fork testing satisfies this requirement.
The ecosystem around it
Immunefi maintains a repository replicating 182+ DeFi exploits, updated weekly. It's become a reference library for security researchers learning exploit patterns. The platform's tutorials walk through recreating incidents like SwapX using Foundry's tooling.
A CyberArk analysis using similar techniques found 100+ uninitialized contracts on mainnet, though most weren't exploitable. This demonstrates how Foundry-based scanning has become standard for vulnerability research.
The learning curve
Some researchers stick with Hardhat out of familiarity. Foundry requires writing tests in Solidity rather than JavaScript, which creates a barrier. But the performance gap and trace debugging (-vvvv flag) are pushing adoption.
For bug bounty hunters, the trade-off is clear: invest time learning Foundry's patterns or risk slower iteration and weaker submissions. Platforms increasingly expect Foundry-quality PoCs for critical severity payouts.
What this means
The standardization on Foundry creates a baseline expectation. Bug bounty programs can reasonably demand fork-tested PoCs. Researchers who haven't learned the toolkit are at a disadvantage when competing for high-value submissions.
The pattern: better tools raise the bar for everyone.