# Turning an out-of-scope root cause into an in-scope exploit

Mentorship Series #10 · 17 December 2025 · [@0xfirefist](https://x.com/0xFireFist) · Mento V3 · Cantina

Mentorship Series · [The Contest Academy](https://0xsimao.com/the-contest-academy) · written by 0xSimao

---

We continued the Mento V3 [contest](https://cantina.xyz/competitions/fe8e03b1-f8db-4698-8a21-44b3a862e434) on Cantina.

**Lesson Summary:**

- Simao picked out where the bugs were most likely to be from what the sponsors said alone;
- When a lead's root cause sits in an out-of-scope contract, treat that behaviour as intended and look for a way to exploit it through the in-scope contracts;
- Study the \`Insert\` function in the library;
- Look for a way to exploit the case where the timestamp median and the value median differ;
- Try to turn the first bug into a working exploit.

https://youtu.be/-q3PRff85bo

Session video: https://youtu.be/-q3PRff85bo

Written by 0xSimao (https://0xsimao.com/) · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests.

---

Newer: [Exhausting a flow before moving on, and who profits when the median moves](https://0xsimao.com/the-contest-academy/mento-median-price-manipulation) · Older: [Keeping a bad price out of storage: expired reports and permissionless cleanup](https://0xsimao.com/the-contest-academy/mento-expired-oracle-reports)