decipher-solidity-superpowers

Generate the complete audit package before engaging an external auditor

Run a full gas optimization audit on a contract before deployment

Start a new smart contract, interface, library, or protocol component

Run the pre-deployment checklist and deploy via a Forge script

Verify storage layout safety and run staged checks before any proxy upgrade

Use this agent when the solidity-gas-optimizer skill requests a gas audit on a Solidity contract. Given a contract file path and name, runs forge inspect for storage layout analysis, forge snapshot for gas baseline, and a full 8-category gas checklist (storage packing, visibility, calldata, loops, arithmetic, errors, compiler config, events). Applies HIGH and MEDIUM findings automatically, measures delta with forge snapshot --diff, and writes a structured findings report to docs/audits/YYYY-MM-DD-<contract>-gas.md. Do not invoke directly — dispatched by the solidity-gas-optimizer skill.

Use this agent when the solidity-code-reviewer skill requests a security review of a Solidity contract. Performs a two-stage review: (1) spec compliance against the provided interface and design document; (2) security analysis covering reentrancy (CEI, cross-function, read-only), access control (Ownable2Step, tx.origin, role escalation), external call safety (SafeERC20, return values, adversarial addresses, fee-on-transfer tokens), integer arithmetic (unchecked blocks, division before multiplication, downcasts), oracle security (Chainlink staleness, TWAP windows, decimal normalization), flash loan and MEV vectors (first depositor, sandwiching), upgrade safety (storage layout, initializer security, _authorizeUpgrade), and protocol logic invariants. Produces severity-rated findings (Critical/High/Medium/Low/Info) with exact file:line references, impact statements, proof-of-concept attack paths, remediation code, and regression test function names. Writes the full report to docs/audits/YYYY-MM-DD-<contract>-security.md. Do not invoke directly — dispatched by the solidity-code-reviewer skill.

Audit preparation gate for Solidity contracts before external security review. Use when preparing for external audit engagement, when creating audit scope documentation, or when the user says "prepare for audit", "audit package", "scope document", "what do auditors need", "I'm getting this audited", or "external security review". Enforces: complete audit package (scope, protocol overview, threat model, internal findings log, and coverage report) before engaging auditors. Produces professional-grade documentation that maximizes audit value and minimizes wasted auditor time on obvious issues.

TDD implementation gate for Solidity smart contracts. Use after an approved design doc and committed interface exist. Triggers on: "implement this", "write the contract", "fill in the logic", "implement the interface", "code this up", or any intent to write Solidity implementation code. Enforces strict Red-Green-Refactor: no production code without a failing Forge test first. Covers: CEI pattern, custom errors, access control, SafeERC20, ReentrancyGuard, gas snapshots, and all implementation standards for Solidity ^0.8.20 with Foundry.

Security review gate for completed Solidity contract implementations. Use after any contract implementation is complete and before marking work done, merging, or deploying. Triggers on: "review this contract", "security review", "is this secure?", "check for vulnerabilities", "audit this", "pen test this", or when any contract implementation is complete. Dispatches the reviewoor agent with full context: source code, interface, design doc, invariant list, and git diff if modifying an existing contract. All Critical and High severity findings must be resolved with regression tests before exiting this skill.

Deployment gate for Solidity contracts. Use before any deployment to testnet, mainnet, or public fork environments. Triggers on: "deploy this contract", "run the deploy script", "let's go to testnet", "deploy to mainnet", "how do I deploy", "deployment configuration", or any mention of broadcasting transactions or deploy scripts. Enforces: forge script (not forge create), pre-deployment checklist, simulation before broadcast, on-chain verification, multisig ownership transfer, and deployment manifest generation. No manual deployments allowed.

Gas optimization gate for Solidity contracts before deployment. Dispatches the optimizoor agent to run a full 8-category gas audit. Use when: tests pass and contract is ready for gas review, user asks "is this gas efficient?", "can we reduce gas costs?", "optimize gas", "check gas usage", or after any implementation change to a value-handling function. Covers: storage layout and slot packing, function visibility, calldata vs memory, loop optimization, arithmetic (unchecked), custom errors, compiler configuration, and event vs storage decisions. Produces a gas audit report with forge snapshot diff before deployment.

2 hooks across 2 events