Smart Contract Audit

smart-contract-audit

A Claude skill (Claude Code / Claude.ai / Cowork) for auditing smart-contract and on-chain program code — Solidity/Vyper, Solana, and CosmWasm — for vulnerabilities and exploits.

A rigorous, multi-ecosystem security audit skill for Claude — built to review real smart-contract and on-chain program code for vulnerabilities, exploits, and attack vectors across three ecosystems:

• Solidity & Vyper / EVM (including L2, cross-chain/bridge, and account abstraction concerns)
• CosmWasm (Rust / Cosmos)
• Solana (Rust / Anchor & native)

It is attacker-centric by design. Rather than pattern-matching a checklist, it builds a model of what the protocol is trying to do, defines the invariants that must hold, and then reasons about how an adversary breaks the gap between intent and implementation — which is where most real losses come from. It runs static analyzers when they're available (Slither, Aderyn, cargo-audit) and falls back to thorough manual review when they aren't.

What it produces

A severity-rated findings report. Each finding includes its location, a concrete exploit scenario (the actual sequence of calls an attacker makes and what they gain), and a specific, actionable remediation. Severities are scored Impact × Likelihood, with an explicit discipline against over-claiming. The report also carries:

• An insider-resistance ("INS") analysis — for each privileged role, it assumes the role check passes and the holder is hostile or compromised, then asks what one transaction can extract or brick and whether that power is bounded (timelock, cap/rate-limit, deviation band, role separation). An unbounded power over user funds is reported as a finding even under a "trusted" multisig — the dominant 2025–2026 loss vector.
• A clear deployment verdict — GO / GO-with-conditions / NO-GO, with any required deployment-ordering gates and residual risk stated explicitly rather than buried in prose.

How it works

The skill follows a seven-phase methodology (Phases 0–6):

0. Scope & system model — what the protocol does, who holds privilege, where value lives.
1. Invariants — the properties that must always hold; most high-severity findings break one.
2. Automated pass — Slither / Aderyn / cargo-audit if installed (leads to verify, not findings).
3. Manual review — function-by-function against an ecosystem vector catalogue + the invariants.
4. Cross-cutting analysis — oracle manipulation (incl. L2 sequencer-uptime), flash-loan amplification, rounding/precision, MEV/ordering, composability, upgradeability, cross-chain/bridge messaging, account abstraction, governance, and insider/privileged-power abuse.
5. Severity & report — score each finding Impact × Likelihood and write it up with an exploit path and a specific fix.
6. Adversarial self-verification — re-derive each finding's exploit path before it ships; remove anything that can't be substantiated.

Around that core it also treats the target repo as untrusted (no unsandboxed code execution, key/secret hygiene, prompt-injection awareness), audits deployment and live on-chain state (proxy/upgrade authority, timelock delay, multisig health, chain-ID address correctness), and records an assumption ledger plus a proof/reproduction for High/Critical findings.

On top of the per-ecosystem catalogues it carries protocol-class playbooks — dense, class-specific checklists for ERC-4626/tokenized vaults, lending/CDP markets, and AMMs/DEXes — pulled in only when the protocol type matches.

The vulnerability catalogues are grounded in the OWASP Smart Contract Top 10 (2026), the OWASP SCWE weakness registry, the Sealevel attack classes (Solana), and CosmWasm audit practice. EVM coverage includes post-Pectra account abstraction (EIP-7702 / ERC-4337 / EIP-1271). VMs without a dedicated catalogue (Move, Cairo, Soroban, ink!, Clarity) get a general logic/economic review only — treat those results as partial.

Repository layout