smart-contract-security

name	smart-contract-security
description	Master smart contract security with auditing, vulnerability detection, and incident response
sasmp_version	1.3.0
version	2.0.0
updated	2025-01
bonded_agent	06-smart-contract-security
bond_type	PRIMARY_BOND
atomic	true
single_responsibility	security_auditing
parameters	{"topic":{"type":"string","required":true,"enum":["vulnerabilities","auditing","tools","incidents"]},"severity":{"type":"string","default":"all","enum":["critical","high","medium","low","all"]}}
retry_config	{"max_attempts":3,"backoff":"exponential","initial_delay_ms":1000}
logging	{"level":"info","include_timestamps":true,"track_usage":true}

Smart Contract Security Skill

Master smart contract security with vulnerability detection, auditing methodology, and incident response procedures.

Quick Start

# Invoke this skill for security analysis
Skill("smart-contract-security", topic="vulnerabilities", severity="high")

Topics Covered

1. Common Vulnerabilities

Recognize and prevent:

• Reentrancy: CEI pattern violation
• Access Control: Missing modifiers
• Oracle Manipulation: Flash loan attacks
• Integer Issues: Precision loss

2. Auditing Methodology

Systematic review process:

• Manual Review: Line-by-line analysis
• Static Analysis: Automated tools
• Fuzzing: Property-based testing
• Formal Verification: Mathematical proofs

3. Security Tools

Essential tooling:

• Slither: Fast static analysis
• Mythril: Symbolic execution
• Foundry: Fuzzing, invariants
• Certora: Formal verification

4. Incident Response

Handle security events:

• Triage: Assess severity
• Mitigation: Emergency actions
• Post-mortem: Root cause analysis
• Disclosure: Responsible reporting

Vulnerability Quick Reference

Critical: Reentrancy

// VULNERABLE
function withdraw(uint256 amount) external {
    (bool ok,) = msg.sender.call{value: amount}("");
    require(ok);
    balances[msg.sender] -= amount;  // After call!
}

// FIXED: CEI Pattern
function withdraw(uint256 amount) external {
    balances[msg.sender] -= amount;  // Before call
    (bool ok,) = msg.sender.call{value: amount}("");
    require(ok);
}

High: Missing Access Control

// VULNERABLE
function setAdmin(address newAdmin) external {
    admin = newAdmin;  // Anyone can call!
}

// FIXED
function setAdmin(address newAdmin) external onlyOwner {
    admin = newAdmin;
}