Menu
SkillsMP has collected 94 skills from ccashwell/evm-cortex. Open a skill to review its source and details.
Showing 40 of 94 collected skills.
Use when performing an accounting-first smart contract security audit in the style of 0xSimao. Maps the protocol's money model first — assets, tracked totals, the asymmetry table, invariants, lifecycles, and actor cohorts — then attacks it with 12 parallel…
Use when building or reviewing Uniswap V4 hooks, custom AMM logic, dynamic fees, access controls, oracle hooks, return deltas, hook deployment, or hook-specific tests. Covers the current 14 permission flags, 10 callbacks, BaseHook implementation, delta…
Generate Echidna/Medusa-compatible Solidity fuzz suites from Foundry or Hardhat projects. Trigger on "fizz", "generate fuzz suite", "build fuzz harness", "stateful fuzzing", "fuzzing harness", "property testing", and "invariant suite".
Reconcile an existing Fizz harness with a changed source tree. Detects added/removed/changed contract functions, quarantines stale properties, regenerates drifted handler stubs, and refreshes the snapshot. Trigger on "fizz-sync", "resync fuzzing", "sync fuzz…
Use when performing a comprehensive smart contract security audit. Implements the Pashov Audit Group's parallelized 12-agent attacker-framing methodology — nine single-specialty lenses (math precision, access control, economic security, execution trace,…
Use when preparing for a security audit, performing reconnaissance on a new codebase, or creating a protocol overview. Generates a structured pre-audit readiness report covering architecture overview, threat model, cross-linked protocol invariants, entry…
Design Solidity contracts using type-driven composition instead of inheritance. Structs encapsulate storage, free functions define behavior via `using for global`, and contracts become thin external shells. Eliminates inheritance hell, exposes the full…
Use when integrating with Aave V3 for lending, borrowing, flash loans, or building on top of Aave markets. Covers Pool interactions, aToken mechanics, flash loans, eMode, isolation mode, and safe integration patterns.
Access control design patterns for Solidity protocols. Use when implementing role-based permissions, timelocks, emergency controls, or multi-sig requirements. Covers Ownable2Step, AccessControl, AccessManager, timelock patterns, and emergency pause.
Use when running Aderyn (by Cyfrin) static analysis on Solidity contracts. Covers installation, running analysis, detectors, report output, comparison with Slither, and CI integration.
Use when running a local Ethereum node with Anvil. Covers forking, impersonation, mining modes, state snapshots, storage manipulation, RPC methods, and chain configuration.
Yul/inline assembly patterns for advanced Solidity optimization. Use only when gas savings are significant and measured. Covers memory management, efficient hashing, bitwise operations, custom errors, low-level calls, and returndata handling.
Use when performing systematic breadth-first review of all contracts during a security audit. Covers contract-by-contract review, function-level risk assessment, attack surface mapping, and identifying leads for depth analysis.
Use when performing deep analysis of specific findings or high-risk areas during a security audit. Covers state trace analysis, token flow tracing, edge case enumeration, cross-contract interaction analysis, invariant verification, and economic incentive…
Use when preparing a codebase for security audit. Covers scope definition, documentation review, dependency analysis, invariant documentation, known issues lists, prior audit review, test coverage verification, and static analysis.
Use when performing initial audit reconnaissance. Covers automated tooling, dependency review, architecture mapping, entry point identification, trust boundary mapping, external call enumeration, and access control analysis.
Use when compiling final audit reports. Covers executive summary, scope and methodology, finding format, severity classification, risk summary tables, recommendations, and appendices.
Use when constructing proof-of-concept exploits, verifying audit findings against mainnet forks, classifying severity, and eliminating false positives. Covers PoC construction in Foundry, fork-testing vulnerabilities, severity classification, and evidence…
Use when deploying many identical upgradeable proxies using the Beacon proxy pattern. Covers UpgradeableBeacon, BeaconProxy, bulk upgrades, use cases, and comparison with UUPS/Transparent.
Use when querying onchain data through Blockscout MCP. Covers contract source retrieval, transaction analysis, address balance queries, event log queries, and token information.
Use when interacting with Ethereum contracts and data from the command line using Foundry's cast. Covers read/write calls, storage inspection, ABI encoding/decoding, block queries, and common one-liners.
Use when building cross-chain USDC transfers, integrating with Circle's Cross-Chain Transfer Protocol (CCTP V2), or using Circle Gateway for unified balances. Covers the burn-attestation-mint flow, MessageTransmitter and TokenMessenger contracts, domain IDs…
Use when integrating Chainlink price feeds, building oracle-dependent contracts, or implementing staleness checks. Covers AggregatorV3Interface, decimal handling, L2 sequencer uptime, heartbeat validation, and safe price feed wrappers.
Use when integrating with Compound V3 (Comet) for lending, borrowing, or building liquidation bots. Covers single-asset lending, collateral management, absorb mechanics, and interest rate models.
Constructor and initializer patterns for deploying Solidity contracts. Use when designing deployment flows, upgradeable proxies, factory patterns, or CREATE2 deployments. Covers constructor validation, initializer safety, and factory patterns.
Use when verifying deployed contracts on block explorers. Covers forge verify-contract, Etherscan/Basescan/Arbiscan APIs, Blockscout verification, constructor args encoding, flattening, proxy verification, and multi-file verification.
Use when measuring test coverage for Solidity contracts, identifying untested code paths, or establishing coverage requirements. Covers forge coverage, lcov output, visualization, and coverage-driven testing.
Use when deploying contracts to deterministic addresses with CREATE2. Covers address prediction, salt selection, factory patterns, cross-chain same-address deployment, CREATE3, vanity addresses, and replay protection.
Cross-chain security patterns for multi-chain Solidity deployments and bridge interactions. Use when deploying contracts across multiple chains, integrating with bridges, or handling chain-specific behavior differences. Covers message replay, finality, and…
Use when integrating with Curve Finance for stablecoin swaps, liquidity provision, or gauge-based reward systems. Covers StableSwap math, crypto pools, meta-pools, gauge voting, and safe swap patterns.
Use when building dApp frontends with wagmi v2 and viem. Covers useReadContract, useWriteContract, useSimulateContract, useWaitForTransactionReceipt, wallet connection (RainbowKit), chain switching, and ENS resolution.
Delegatecall risks and safety patterns for Solidity proxies and modular contracts. Use when implementing upgradeable proxies, diamond patterns, or any contract using delegatecall. Covers storage layout requirements, context preservation, and implementation…
Denial-of-service attack vectors and prevention patterns for Solidity. Use when designing loops, batch operations, withdrawal mechanisms, or any contract that iterates over user-controlled data. Covers unbounded loops, gas limits, griefing, and force-send ETH.
Use when building large modular contracts with EIP-2535 Diamond pattern. Covers facets, diamondCut, diamond loupe, AppStorage and DiamondStorage patterns, selector mapping, and facet upgrade process.
Use when implementing Dutch auctions for token sales, NFT mints, fair launch mechanisms, or Gradual Dutch Auctions (GDAs). Covers linear/exponential price decay, batch auctions, and MEV-resistant patterns.
Economic attack vectors and defenses for DeFi protocols. Use when designing vaults, lending pools, AMMs, or any system with share-based accounting. Covers first depositor inflation, donation attacks, sandwich attacks on liquidity, JIT liquidity, and flash…
Use when implementing EIP-712 typed structured data signing. Covers domain separator, type hashing, encoding rules, DOMAIN_SEPARATOR caching, chain ID fork handling, permit (EIP-2612), and gasless transaction patterns.
Use when building multi-token contracts with ERC-1155. Covers batch operations, URI handling, supply tracking, hybrid fungible and non-fungible patterns, and game item architectures.
Use when implementing, extending, or integrating ERC-20 tokens. Covers standard interface, OpenZeppelin extensions (Permit, Votes, Burnable, Pausable, Capped, Snapshot), common pitfalls (USDT no-return, fee-on-transfer, rebasing), and SafeERC20 usage.
Use when building tokenized vaults with ERC-4626. Covers deposit/mint/withdraw/redeem, share math, rounding rules, first depositor attack mitigation, yield strategies, and integration patterns.