cadence-audit

name

cadence-audit

description

Comprehensive audit and review skill for Cadence smart contracts on the Flow blockchain. Identifies security vulnerabilities, bugs, code quality issues, and optimization opportunities. Produces severity-rated findings (Critical/High/Medium/Low) with actionable fixes. TRIGGER when: auditing, reviewing, or improving Cadence code, checking for security issues, performing code review on .cdc files, looking for anti-patterns or vulnerabilities, optimizing smart contract code, "review cadence", "audit cadence", "check cadence security", "validate cadence contract", "review my .cdc file", "security review", "code review", "find vulnerabilities", "check this contract", "is this code secure", "audit my project". DO NOT TRIGGER when: writing new contracts from scratch (use cadence-scaffold), asking about Cadence syntax or patterns (use cadence-lang), building token contracts (use cadence-tokens).

Cadence Smart Contract Audit

Conduct comprehensive security, quality, and performance reviews of Cadence smart contracts.

Audit Modes

Single File Review

When reviewing a specific file or code snippet, analyze it across four dimensions and produce a structured report.

Project-Wide Audit

When auditing a full project:

1. Discover all .cdc files: cadence/contracts/*.cdc, cadence/transactions/*.cdc, cadence/scripts/*.cdc
2. If none found, search recursively from project root for *.cdc
3. Systematically audit each file using the checklist
4. Produce a project-level summary with file-by-file findings

Review Dimensions

1. Security — Vulnerabilities, access control, resource safety, capability management
2. Bugs — Nil dereferences, resource loss, type confusion, infinite loops
3. Code Quality — Readability, naming, documentation, patterns compliance
4. Optimization — Unnecessary copies, storage inefficiencies, gas usage

Quick Per-Function Checklist

• Can the field be let instead of var?
• Can the function be view?
• Can access be more restrictive (access(self), entitled)?
• Are inputs validated with pre-conditions?
• Are results verified with post-conditions?
• Are error messages descriptive with interpolated values?

Navigation

Reference	Content
audit-checklist.md	Full security, bugs, quality, DeFi, optimization checklists
review-format.md	Structured output format, severity levels, verdict criteria

Companion Skills

• cadence-lang — Essential during audits. Consult for access control rules, entitlement patterns, resource safety, anti-patterns, and design patterns. Every audit finding should reference the specific Cadence rule being violated.
• cadence-tokens — Consult when auditing NFT/FT contracts for standard compliance (NonFungibleToken interface, MetadataViews requirements).
• cadence-testing — Use to follow up on audit findings like "missing test coverage" or "edge case not tested" with concrete test-writing guidance.