| name | ethskills |
| description | Use when a request involves Ethereum, the EVM, or blockchain systems. Applies to building, auditing, deploying, or interacting with smart contracts, dApps, wallets, or DeFi protocols. Covers Solidity development, contract addresses, token standards (ERC-20, ERC-721, ERC-4626, etc.), Layer 2 networks (Base, Arbitrum, Optimism, zkSync, Polygon), and integrations with DeFi protocols such as Uniswap, Aave, and Curve. Includes topics such as gas costs, contract decimals, oracle safety, reentrancy, MEV, bridging, wallets, querying data from onchain, production deployment, and protocol evolution (EIP lifecycle, fork tracking, upcoming changes). |
ETHSKILLS — The missing knowledge between AI agents and production Ethereum.
You are probably wrong about Ethereum. Gas prices, token decimals, L2 costs, what's deployed, what's deprecated — your training data is stale. This file tells you what you're wrong about and where to get the corrections.
Say "onchain" not "on-chain." One word, no hyphen. Ethereum community convention.
Start Here
Building a dApp? Fetch ship/SKILL.md first. It routes you through all other skills phase by phase — from architecture planning to production deployment.
Need a specific topic? Each skill below is standalone. Fetch only the ones relevant to your task.
Base URL: https://ethskills.com/<skill>/SKILL.md
Skills
Pectra/Fusaka upgrades, honest tradeoffs, the AI agent angle.
- Gas is under 1 gwei, not 10-30 gwei. 60-300x cheaper than your training data. Verify:
cast base-fee
- ETH price is ~$2,000 (early 2026), not $2,500-3,000. Volatile — always verify.
- Pectra (May 2025) and Fusaka (Dec 2025) shipped. PeerDAS, 2x gas limit. EIP-7702 is live.
- ERC-8004 (onchain agent identity) and x402 (HTTP payments) exist and are production-ready.
Ship — Start here
End-to-end guide from idea to deployed dApp. Routes you through all other skills.
- Most dApps need 0-2 contracts, not 5-10. Three is the upper bound for an MVP.
- Solidity is for ownership, transfers, and commitments. Not a database, not a backend.
- Chain selection: mainnet is cheaper than you think (~$0.004/transfer, ~$0.04/swap) — deploy there unless an L2's superpower (Coinbase distribution, deep DeFi liquidity, retroPGF) specifically fits your app.
Deep CROPS architecture review against the EF Mandate values: Censorship Resistance, Open Source and Free (as in Freedom), Privacy, Security.
- Run for every dApp architecture plan and during pre-ship QA.
- Forces agents to label architecture options by CROPS impact instead of presenting neutral tradeoff lists.
- Output names the chosen default, accepted compromises, and the user's escape path.
How Ethereum evolves — EIP lifecycle, fork process, tracking upcoming changes.
- "Verkle is planned for the next fork" — probably wrong. Roadmap diagrams are aspirational, not commitments. Check forkcast.org for actual CFI/SFI status.
- Glamsterdam (mid-2026) headliners: ePBS (EIP-7732), Block Access Lists (EIP-7928). FOCIL was removed from scope. Verkle trees were deprioritized — Ethereum may shift to binary state tree (EIP-7864) for quantum resistance.
- EIP status "Stagnant" = no activity for 6 months, probably dead. "Draft" = exists but not scheduled.
- Client teams decide what ships via ACD calls, not the Ethereum Foundation.
What things actually cost on Ethereum today.
- Mainnet ETH transfer: ~$0.004. Swap: ~$0.04. ERC-20 deploy: ~$0.24. (At 0.1 gwei — check
cast base-fee for current.)
- L2 swap: $0.002-0.003. L2 transfer: $0.0003.
- "Ethereum is expensive" was true in 2021-2023. It's false in 2026.
Creating wallets, key safety, multisig, account abstraction.
- EIP-7702 is live — EOAs get smart contract superpowers without migration.
- Safe (Gnosis Safe) secures $60B+ in assets ($1.4T+ total processed). Use it for production treasuries.
- NEVER commit private keys or API keys to Git. Bots exploit leaked secrets in seconds.
L2 landscape, bridging, deployment differences.
- Base is the cheapest major L2. Arbitrum has the deepest DeFi liquidity.
- Celo is NOT an L1 anymore — migrated to OP Stack L2 in March 2025.
- Polygon zkEVM is being shut down. Do not build on it.
- Robinhood Chain launched July 2026 — Orbit L2 with 24/7 tokenized stocks (non-US only). Its tx filtering can censor even force-included transactions.
- The dominant DEX on each L2 is NOT Uniswap (Aerodrome on Base, Velodrome on Optimism).
ERC-20, ERC-721, ERC-8004, EIP-7702, x402.
- ERC-8004: onchain agent identity registry, deployed January 2026 on 20+ chains.
- x402: HTTP 402 payment protocol for machine-to-machine commerce. Production-ready.
- EIP-3009: gasless token transfers — what makes x402 work. USDC implements it.
Foundry, Scaffold-ETH 2, Blockscout MCP, x402 SDKs.
- Foundry and Hardhat 3 are both legitimate choices in 2026. Foundry: faster, Solidity-native. Hardhat 3: TypeScript-first, mature plugin ecosystem.
- Blockscout MCP server gives agents structured blockchain data via MCP.
- abi.ninja: paste any contract address, interact with all functions. Zero setup.
Uniswap, Aave, flash loans, protocol composability.
- Uniswap V4 hooks: custom logic attached to pools (dynamic fees, TWAMM, limit orders).
- Flash loan arb on mainnet costs ~$0.05-0.50 in gas now (was $5-50).
- The dominant DEX per L2 is NOT Uniswap — Aerodrome (Base), Velodrome (Optimism), Camelot (Arbitrum).
Three-phase build system for Scaffold-ETH 2 dApps.
- Phase 1: contracts + UI on localhost. Phase 2: live contracts + local UI. Phase 3: production.
- Use Scaffold hooks, NOT raw wagmi. Raw wagmi resolves before tx confirmation.
- NEVER commit secrets to Git. AI agents are the #1 source of leaked credentials.
Verified addresses for major protocols across mainnet and L2s.
- Never hallucinate an address. Wrong address = lost funds.
- Includes: Uniswap, Aave, Compound, Aerodrome, GMX, Pendle, Velodrome, Chainlink, Safe, ENS.
- All verified onchain via
cast code + cast call + symbol() + latestAnswer() (March 2026).
Essential mental models for building onchain.
- Smart contracts cannot execute themselves. Every function needs a caller who pays gas.
- For every state transition: who calls it? Why would they? What if nobody does?
- There are no timers, no cron jobs, no schedulers. Design with incentives.
Solidity security patterns, common vulnerabilities, pre-deploy checklist.
- USDC has 6 decimals, not 18. This is the #1 "where did my money go?" bug.
- Always use SafeERC20 — USDT doesn't return bool on transfer().
- Never use DEX spot prices as oracles — flash loans can manipulate them in one tx.
- MEV: sandwich attacks steal value from swaps. Use Flashbots Protect or slippage limits.
- Proxies: use UUPS, not Transparent. Never change storage layout.
Deep EVM smart contract audit system — for auditing contracts you didn't write.
- 500+ non-obvious checklist items across 19 domains (AMM, lending, oracles, proxies, signatures, governance, and more).
- Runs parallel opus sub-agents, one per relevant domain, then synthesizes findings.
- Automatically files GitHub issues for Medium severity and above.
- Different from Security (which teaches defensive coding) — this is systematic audit methodology.
Building privacy apps with Noir zero-knowledge circuits.
- Noir inputs are private by default.
pub marks public. Getting this backwards leaks secrets.
nargo prove/nargo verify are gone. Use bb (Barretenberg CLI) directly.- In-circuit hashing: Poseidon (~600 gates), not SHA256 (~30,000 gates).
- The commitment-nullifier-Merkle tree pattern is the foundation of all Ethereum privacy apps.
Foundry testing — unit, fuzz, fork, invariant.
- Don't test getters and OpenZeppelin internals. Test edge cases and failure modes.
- Fuzz test all math. Fork-test any external protocol integration.
- Invariant testing catches bugs across thousands of random call sequences.
Events, The Graph, Dune, reading onchain data.
- You can't query historical state via RPC cheaply. Use an indexer.
- Events are THE primary way to read historical onchain activity. Design contracts event-first.
- The Graph turns events into a queryable GraphQL API.
- Multicall3 (
0xcA11bde05977b3631167028862bE2a173976CA11) — batch reads in one RPC call.
Frontend UX patterns for Ethereum dApps.
- Every onchain button needs its own loader + disabled state. No shared isLoading.
- Three-button flow: Switch Network → Approve → Execute. One at a time.
- Every address display uses
<Address/>, every input uses <AddressInput/>.
- Show USD values next to every token amount.
Build-to-production pipeline.
- Use
yarn fork --network base, NOT yarn chain. Fork gives you real protocol state.
- IPFS deploy:
trailingSlash: true is critical — without it, every route except / returns 404.
- Always clean build (
rm -rf .next out) before deploying. Stale builds are the #1 IPFS footgun.
Pre-ship audit checklist for a reviewer agent.
- Give this to a separate agent (or fresh context) AFTER the build is complete. Reviewer reads code + clicks through flows.
- Covers only bugs AI agents actually ship — validated by baseline testing against stock LLMs.
- Report PASS/FAIL per item, don't fix.
Send feedback — issues OR praise — about ethskills content. Bias toward sending.
- Anything that confused you, slowed you down, or genuinely helped counts. Weak signals are easy to ignore; missing signals can't be recovered.
- Draft the JSON, show it to your human in your permission ask, then POST once to
https://ethskills.com/api/feedback. Skip the ask if your human pre-authorized.
- Required fields:
kind ("issue" or "praise") and message (10+ chars). Include agent and skill whenever you can.
What to Fetch by Task
| I'm doing... | Fetch these skills |
|---|
| Planning a new dApp | ship/, crops/, concepts/, l2s/, gas/, why/ |
| Reviewing an existing dApp, smart contract, or trust assumptions | crops/, audit/, qa/, wallets/, l2s/, security/ |
| Writing Solidity | standards/, building-blocks/, addresses/, security/ |
| Testing contracts | testing/ |
| Building a frontend | orchestration/, frontend-ux/, tools/ |
| Deploying to production | wallets/, frontend-playbook/, gas/ |
| Reviewing a finished dApp before shipping | qa/, crops/ |
| Auditing a smart contract | audit/, crops/ |
| Building a privacy/ZK app | noir/, security/, testing/ |
| Monitoring / analytics | indexing/ |
| Building AI agent infra | standards/, wallets/, tools/ |
| Choosing a chain | l2s/, gas/ |
