Hunting in the Dark Forest: How I Uncovered a Private $25M Simulation Fork via an RPC Misconfiguration

A Web3 bug bounty hunter discovered an exposed private Tenderly simulation fork on a DeFi protocol by fuzzing RPC endpoint paths with EVM Chain IDs. The exposed node showed a $22M discrepancy versus real Mainnet balances, revealing an artificial simulation state. After the triage team initially dismissed the report as public blockchain data, the researcher proved the vulnerability by executing a state override via eth_call with a stateDiff parameter — something only possible on a Tenderly fork, not a standard public RPC proxy. The team ultimately validated the finding. Key takeaways include fingerprinting RPC nodes with web3_clientVersion, comparing balances against Etherscan, and using state overrides as definitive proof of simulation environments.