web3-blockchain-development

Production-grade Web3 development with Solidity smart contracts, ethers.js/web3.js integration, DApp architecture, security patterns, and AI-enhanced blockchain development (ChatWeb3, Aider + Gemini 2024)

Zur Installation springen

Repository: bobmatnyc/mcp-skillset
Letzte Quellaktivität: 25. November 2025 um 10:39
Erkannte Sprache von SKILL.md: Englisch
Sterne: 20
Forks: 5

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Zurück zur Suche Zurück zur Installation

name	Web3 & Blockchain Development
skill_id	web3-blockchain
version	1.0.0
description	Production-grade Web3 development with Solidity smart contracts, ethers.js/web3.js integration, DApp architecture, security patterns, and AI-enhanced blockchain development (ChatWeb3, Aider + Gemini 2024)
category	Blockchain & Web3
tags	["web3","blockchain","solidity","ethereum","smart-contracts","dapp","ethers","hardhat","security","defi"]
author	mcp-skillset
license	MIT
created	2025-11-25T00:00:00.000Z
last_updated	2025-11-25T00:00:00.000Z
toolchain	["Solidity 0.8+","Hardhat","ethers.js v6","OpenZeppelin Contracts"]
frameworks	["Ethereum","Hardhat","Foundry","OpenZeppelin"]
related_skills	["security-testing","test-driven-development","fastapi-web-development","cloudflare-edge-ai"]

Web3 & Blockchain Development

Overview

Master Web3 development with Solidity smart contracts, DApp architecture, and modern tooling (Hardhat, ethers.js v6). Learn security-first patterns, gas optimization, and AI-enhanced development with ChatWeb3 and Aider + Gemini for Solidity (2024).

When to Use This Skill

Building decentralized applications (DApps) on Ethereum
Writing secure smart contracts for DeFi, NFTs, or DAOs
Creating token contracts (ERC-20, ERC-721, ERC-1155)
Integrating blockchain functionality into web applications
Auditing smart contracts for security vulnerabilities
Optimizing gas costs for efficient contract execution
Deploying contracts to mainnet or Layer 2 networks

Core Principles

1. Solidity Security Patterns

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/security/Pausable.sol";

// ✅ GOOD: Security-first contract
contract SecureWallet is ReentrancyGuard, Ownable, Pausable {
    mapping(address => uint256) public balances;

    event Deposit(address indexed user, uint256 amount);
    event Withdrawal(address indexed user, uint256 amount);

    // ✅ Use receive() for accepting Ether
    receive() external payable {
        balances[msg.sender] += msg.value;
        emit Deposit(msg.sender, msg.value);
    }

    // ✅ Checks-Effects-Interactions pattern (prevents reentrancy)
    function withdraw(uint256 amount) external nonReentrant whenNotPaused {
        // Checks
        require(amount > 0, "Amount must be greater than 0");
        require(balances[msg.sender] >= amount, "Insufficient balance");

        // Effects (update state BEFORE external call)
        balances[msg.sender] -= amount;

        // Interactions (external call last)
        (bool success, ) = msg.sender.call{value: amount}("");
        require(success, "Transfer failed");

        emit Withdrawal(msg.sender, amount);
    }

    // ✅ Emergency stop mechanism
    function pause() external onlyOwner {
        _pause();
    }

    function unpause() external onlyOwner {
        _unpause();
    }
}

// ❌ BAD: Vulnerable to reentrancy attack
contract VulnerableWallet {
    mapping(address => uint256) public balances;

    function withdraw(uint256 amount) external {
        require(balances[msg.sender] >= amount);

        // ❌ WRONG: External call before state update
        (bool success, ) = msg.sender.call{value: amount}("");
        require(success);

        // Attacker can re-enter withdraw() before this line executes!
        balances[msg.sender] -= amount;
    }
}

Common Vulnerabilities (SWC Registry):

Reentrancy (SWC-107) - Use ReentrancyGuard

// ERC-20 Token (Fungible Token)
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import "@openzeppelin/contracts/access/Ownable.sol";

contract MyToken is ERC20, Ownable {
    constructor() ERC20("MyToken", "MTK") {
        _mint(msg.sender, 1000000 * 10 ** decimals());
    }

    // Optional: Mint new tokens
    function mint(address to, uint256 amount) external onlyOwner {
        _mint(to, amount);
    }
}

// ERC-721 NFT (Non-Fungible Token)
import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";

contract MyNFT is ERC721, ERC721URIStorage, Ownable {
    uint256 private _tokenIdCounter;

    constructor() ERC721("MyNFT", "MNFT") {}

    function safeMint(address to, string memory uri) external onlyOwner {
        uint256 tokenId = _tokenIdCounter++;
        _safeMint(to, tokenId);
        _setTokenURI(tokenId, uri);
    }

    // Override required by Solidity
    function tokenURI(uint256 tokenId)
        public
        view
        override(ERC721, ERC721URIStorage)
        returns (string memory)
    {
        return super.tokenURI(tokenId);
    }

    function supportsInterface(bytes4 interfaceId)
        public
        view
        override(ERC721, ERC721URIStorage)
        returns (bool)
    {
        return super.supportsInterface(interfaceId);
    }
}

// ERC-1155 (Multi-Token Standard)
import "@openzeppelin/contracts/token/ERC1155/ERC1155.sol";

contract GameItems is ERC1155, Ownable {
    uint256 public constant GOLD = 0;
    uint256 public constant SILVER = 1;
    uint256 public constant SWORD = 2;

    constructor() ERC1155("https://game.example/api/item/{id}.json") {
        _mint(msg.sender, GOLD, 10**18, "");
        _mint(msg.sender, SILVER, 10**27, "");
        _mint(msg.sender, SWORD, 1, "");
    }

    function mint(address account, uint256 id, uint256 amount)
        external
        onlyOwner
    {
        _mint(account, id, amount, "");
    }
}

// ❌ BAD: Expensive storage operations
contract Expensive {
    uint256[] public numbers;

    function addNumbers(uint256[] memory nums) external {
        for (uint256 i = 0; i < nums.length; i++) {
            numbers.push(nums[i]);  // SSTORE every iteration (expensive!)
        }
    }
}

// ✅ GOOD: Batch operations and minimize SSTORE
contract Optimized {
    uint256[] public numbers;

    function addNumbers(uint256[] memory nums) external {
        uint256 length = nums.length;  // Cache array length
        for (uint256 i; i < length; ) {  // Skip initialization (i = 0)
            numbers.push(nums[i]);
            unchecked { ++i; }  // Skip overflow check (safe here)
        }
    }
}

// ✅ Use uint256 (native word size) instead of smaller types
uint256 a;  // Cheaper than uint8, uint16, etc.

// ✅ Pack storage variables
struct User {
    address wallet;      // 20 bytes
    uint96 balance;      // 12 bytes (fits in same slot)
    uint32 lastUpdate;   // 4 bytes (fits in same slot)
    bool isActive;       // 1 byte (fits in same slot)
}  // Total: 1 storage slot (32 bytes) instead of 4 slots!

// ✅ Use events instead of storage for historical data
event Transfer(address indexed from, address indexed to, uint256 amount);

// ✅ Use immutable and constant
address public immutable OWNER;  // Set in constructor, cheaper than storage
uint256 public constant MAX_SUPPLY = 1000000;  // Compile-time constant

// ✅ Short-circuit evaluations
require(msg.sender == owner || balances[msg.sender] > 0);  // Cheap check first

// ✅ Use calldata for read-only function parameters
function process(uint256[] calldata data) external {
    // calldata is cheaper than memory for external functions
}

import { ethers } from 'ethers';

// Connect to MetaMask
const provider = new ethers.BrowserProvider(window.ethereum);
await provider.send("eth_requestAccounts", []);
const signer = await provider.getSigner();

// Contract ABI and address
const contractAddress = "0x...";
const abi = [
  "function balanceOf(address owner) view returns (uint256)",
  "function transfer(address to, uint256 amount) returns (bool)",
  "event Transfer(address indexed from, address indexed to, uint256 amount)"
];

// Create contract instance
const contract = new ethers.Contract(contractAddress, abi, signer);

// Read from contract (free, no transaction)
const balance = await contract.balanceOf(signer.address);
console.log(`Balance: ${ethers.formatEther(balance)} ETH`);

// Write to contract (requires transaction & gas)
const tx = await contract.transfer(
  "0xRecipientAddress",
  ethers.parseEther("1.0")
);

// Wait for confirmation
const receipt = await tx.wait();
console.log(`Transaction confirmed in block ${receipt.blockNumber}`);

// Listen to events
contract.on("Transfer", (from, to, amount, event) => {
  console.log(`Transfer: ${from} -> ${to}: ${ethers.formatEther(amount)} ETH`);
});

// Type-safe contract with TypeChain
import { MyToken__factory } from './typechain-types';
const typedContract = MyToken__factory.connect(contractAddress, signer);

// test/MyToken.test.ts
import { expect } from "chai";
import { ethers } from "hardhat";
import { MyToken } from "../typechain-types";

describe("MyToken", function () {
  let token: MyToken;
  let owner: any;
  let addr1: any;

  beforeEach(async function () {
    [owner, addr1] = await ethers.getSigners();

    const TokenFactory = await ethers.getContractFactory("MyToken");
    token = await TokenFactory.deploy();
    await token.waitForDeployment();
  });

  it("Should assign total supply to owner", async function () {
    const ownerBalance = await token.balanceOf(owner.address);
    expect(await token.totalSupply()).to.equal(ownerBalance);
  });

  it("Should transfer tokens between accounts", async function () {
    const amount = ethers.parseEther("50");

    await token.transfer(addr1.address, amount);
    expect(await token.balanceOf(addr1.address)).to.equal(amount);
  });

  it("Should fail if sender doesn't have enough tokens", async function () {
    const amount = ethers.parseEther("1000000");

    await expect(
      token.connect(addr1).transfer(owner.address, amount)
    ).to.be.revertedWith("ERC20: transfer amount exceeds balance");
  });

  it("Should emit Transfer event", async function () {
    const amount = ethers.parseEther("50");

    await expect(token.transfer(addr1.address, amount))
      .to.emit(token, "Transfer")
      .withArgs(owner.address, addr1.address, amount);
  });
});

// Run tests:
// npx hardhat test
// npx hardhat coverage  (with solidity-coverage plugin)

blockchain-project/
├── contracts/
│   ├── MyToken.sol
│   ├── MyNFT.sol
│   └── interfaces/
│       └── IMyToken.sol
├── test/
│   ├── MyToken.test.ts
│   └── MyNFT.test.ts
├── scripts/
│   ├── deploy.ts
│   └── verify.ts
├── hardhat.config.ts
├── .env
├── .gitignore
└── package.json

// scripts/deploy.ts
import { ethers } from "hardhat";

async function main() {
  const [deployer] = await ethers.getSigners();
  console.log("Deploying contracts with:", deployer.address);

  const balance = await ethers.provider.getBalance(deployer.address);
  console.log("Account balance:", ethers.formatEther(balance));

  const TokenFactory = await ethers.getContractFactory("MyToken");
  const token = await TokenFactory.deploy();
  await token.waitForDeployment();

  console.log("Token deployed to:", await token.getAddress());

  // Wait for block confirmations before verification
  if (process.env.ETHERSCAN_API_KEY) {
    console.log("Waiting for block confirmations...");
    await token.deploymentTransaction()?.wait(6);

    console.log("Verifying contract on Etherscan...");
    await run("verify:verify", {
      address: await token.getAddress(),
      constructorArguments: [],
    });
  }
}

main().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});

// Deploy: npx hardhat run scripts/deploy.ts --network sepolia

// hardhat.config.ts
import { HardhatUserConfig } from "hardhat/config";
import "@nomicfoundation/hardhat-toolbox";
import "dotenv/config";

const config: HardhatUserConfig = {
  solidity: {
    version: "0.8.20",
    settings: {
      optimizer: {
        enabled: true,
        runs: 200,  // Balance between deployment cost and execution cost
      },
    },
  },
  networks: {
    hardhat: {
      chainId: 31337,
    },
    sepolia: {
      url: process.env.SEPOLIA_RPC_URL || "",
      accounts: process.env.PRIVATE_KEY ? [process.env.PRIVATE_KEY] : [],
    },
    mainnet: {
      url: process.env.MAINNET_RPC_URL || "",
      accounts: process.env.PRIVATE_KEY ? [process.env.PRIVATE_KEY] : [],
    },
  },
  etherscan: {
    apiKey: process.env.ETHERSCAN_API_KEY,
  },
  gasReporter: {
    enabled: process.env.REPORT_GAS === "true",
    currency: "USD",
    coinmarketcap: process.env.COINMARKETCAP_API_KEY,
  },
};

export default config;

// Using OpenZeppelin Upgradeable
import "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";

contract MyTokenV1 is Initializable, ERC20Upgradeable {
    function initialize() public initializer {
        __ERC20_init("MyToken", "MTK");
        _mint(msg.sender, 1000000 * 10 ** decimals());
    }

    // No constructor! Use initialize() instead
}

// Deploy with hardhat-upgrades plugin
import { ethers, upgrades } from "hardhat";

const TokenV1 = await ethers.getContractFactory("MyTokenV1");
const proxy = await upgrades.deployProxy(TokenV1, [], { initializer: 'initialize' });

import "@chainlink/contracts/src/v0.8/interfaces/AggregatorV3Interface.sol";

contract PriceConsumer {
    AggregatorV3Interface internal priceFeed;

    constructor() {
        // ETH/USD on Sepolia
        priceFeed = AggregatorV3Interface(
            0x694AA1769357215DE4FAC081bf1f309aDC325306
        );
    }

    function getLatestPrice() public view returns (int) {
        (, int price, , , ) = priceFeed.latestRoundData();
        return price;
    }
}

# Slither (static analysis)
pip3 install slither-analyzer
slither ./contracts

# Mythril (symbolic execution)
pip3 install mythril
myth analyze contracts/MyToken.sol

# Echidna (fuzzing)
docker run -v $(pwd):/code trailofbits/echidna /code/contracts/MyToken.sol

# Foundry (property testing)
forge install
forge test --match-test invariant

# Manual audit checklist:
# 1. Access control on sensitive functions
# 2. Reentrancy guards on external calls
# 3. Integer overflow/underflow checks
# 4. Proper use of tx.origin vs msg.sender
# 5. Gas optimization opportunities
# 6. Event emission for state changes

ChatWeb3 (conversational Solidity assistant):
- Natural language to Solidity code generation
- Security pattern recommendations
- Gas optimization suggestions

Aider + Google Gemini for Solidity:
- Context-aware code completion
- Vulnerability detection during development
- Refactoring assistance

Usage: "Write a secure ERC-20 token with vesting schedule"
→ Generates OpenZeppelin-based contract with best practices

// BAD: Vulnerable to phishing attacks
function withdraw() external {
    require(tx.origin == owner);  // ❌ NEVER!
    // ...
}

// GOOD: Use msg.sender
function withdraw() external {
    require(msg.sender == owner);  // ✅
    // ...
}

// BAD: Miners can manipulate
uint256 random = uint256(keccak256(abi.encodePacked(block.timestamp)));

// GOOD: Use Chainlink VRF for secure randomness

// BAD: Unchecked external call
address(target).call(data);

// GOOD: Check success
(bool success, ) = address(target).call(data);
require(success, "Call failed");