Audit Smart Contracts for Security Vulnerabilities

This skill acts as an expert smart contract auditor across EVM-compatible Solidity code, identifying vulnerabilities, security risks, and optimization opportunities. Six critical vulnerability categories anchor the review: reentrancy attacks (external calls before state updates), integer overflow/underflow (SafeMath or Solidity 0.8+ protection), access control flaws (role-based permissions and ownership), front-running (MEV opportunities and commit-reveal defenses), flash loan attacks (price oracle manipulation and atomic-transaction risk), and denial-of-service via gas limits and unbounded loops. Gas optimization guidance covers preferring uint256 over smaller uints, packing struct variables efficiently, using external over public for non-internal functions, caching array lengths in loops, and using immutable/constant appropriately.

Use it when auditing Solidity or other EVM-compatible smart contracts for security vulnerabilities, gas inefficiency, or DeFi-specific risk patterns before deployment or as part of a security review.

Static analysis covers contract architecture (inheritance hierarchy, diamond pattern, proxy upgrade mechanisms, multi-sig integrations) and function-level analysis, illustrated with a reentrancy example where the vulnerable version updates balance after an external .call, versus the secure Checks-Effects-Interactions version that updates state first. It flags public arrays with unguarded push operations in favor of private storage gated by an authorized-users mapping. Common vulnerability patterns covered with vulnerable-vs-secure code pairs include oracle price manipulation (a single price source versus multiple oracle sources with a deviation check averaged together) and unsafe external calls (an unchecked target.call(data) versus an owner-gated call to an allowlisted target with return-value checking). DeFi-specific patterns cover liquidity pool auditing (slippage protection, minimum liquidity, fee accuracy, impermanent loss) with a worked addLiquidity example enforcing a 95% slippage floor, and governance security via a timelock contract queuing critical transactions with a minimum 2-day delay before execution. Testing guidance includes invariant-testing examples for an ERC20 token: total supply must equal the sum of all holder balances, and no balance may go negative.

The audit report format classifies findings by severity - Critical (funds stolen or permanently locked), High (significant economic impact), Medium (limited or temporary impact), Low (minor issues), Informational (code quality/optimization) - and structures each recommendation as issue description, impact assessment, a proof-of-concept code example, specific remediation code changes, and prevention guidance, always citing specific line numbers and exact code snippets.

Smart contract developers, security reviewers, and DeFi protocol teams who need a systematic, severity-rated audit methodology covering reentrancy, oracle manipulation, access control, and DeFi-specific risks, with concrete before/after code fixes rather than generic security advice.