@dilukangelo/web3-ai-skills 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md ADDED
@@ -0,0 +1,112 @@
1
+ # Web3 AI Skills
2
+
3
+ > 🚀 AI Agent templates for Web3 development — Solidity, Rust, DApp frontends, auditing, RPC, and indexing.
4
+
5
+ Supercharge your AI coding assistant with specialized Web3 knowledge. This package provides ready-to-use agent configurations, skills, and workflows for building on EVM chains, Solana, and beyond.
6
+
7
+ ---
8
+
9
+ ## Quick Start
10
+
11
+ ### Option 1: npx (no install)
12
+ ```bash
13
+ npx @dilukangelo/web3-ai-skills init
14
+ ```
15
+
16
+ ### Option 2: Global install
17
+ ```bash
18
+ npm install -g @dilukangelo/web3-ai-skills
19
+ web3-ai-skills init
20
+ # or shorthand:
21
+ w3ai init
22
+ ```
23
+
24
+ This creates a `.agent/` folder in your current directory with all Web3 agents, skills, and workflows.
25
+
26
+ ---
27
+
28
+ ## What's Included
29
+
30
+ ### 🤖 6 Specialist Agents
31
+
32
+ | Agent | Focus |
33
+ |-------|-------|
34
+ | **solidity-expert** | EVM smart contracts, Foundry, Hardhat, gas optimization |
35
+ | **rust-web3** | Solana (Anchor), CosmWasm, Arbitrum Stylus |
36
+ | **web3-frontend** | Next.js 15+, RainbowKit v2, Wagmi v2, viem |
37
+ | **contract-auditor** | Slither, Mythril, Aderyn, manual review |
38
+ | **web3-infra** | RPC optimization, Multicall3, MEV protection |
39
+ | **web3-orchestrator** | Multi-agent coordination for full-stack DApps |
40
+
41
+ ### 🧩 8 Skills
42
+
43
+ | Skill | Description |
44
+ |-------|-------------|
45
+ | **solidity-patterns** | Solidity 0.8.x+, ERC standards, gas optimization |
46
+ | **rust-smart-contracts** | Anchor/Solana, CosmWasm, Stylus |
47
+ | **rainbowkit-wagmi** | Wallet integration, SIWE, multi-chain |
48
+ | **smart-contract-auditing** | Audit methodology, vulnerability taxonomy |
49
+ | **dapp-patterns** | IPFS, ENS, token gating, account abstraction |
50
+ | **rpc-optimization** | Multicall3, batching, caching, MEV protection |
51
+ | **subgraph-indexing** | The Graph, Ponder, Subsquid, Envio |
52
+ | **clean-code** | Web3-specific coding standards |
53
+
54
+ ### 🔄 4 Workflows
55
+
56
+ | Command | Description |
57
+ |---------|-------------|
58
+ | `/deploy-contract` | Deploy & verify smart contracts |
59
+ | `/audit` | Run security audit |
60
+ | `/create-dapp` | Scaffold new DApp |
61
+ | `/create-contract` | Scaffold new contract project |
62
+
63
+ ---
64
+
65
+ ## Usage
66
+
67
+ After running `init`, your project will have a `.agent/` folder:
68
+
69
+ ```
70
+ .agent/
71
+ ├── GEMINI.md # Core AI instructions
72
+ ├── ARCHITECTURE.md # System overview
73
+ ├── agents/ # 6 specialist agents
74
+ ├── skills/ # 8 domain skills
75
+ ├── workflows/ # 4 slash commands
76
+ └── scripts/ # Validation scripts
77
+ ```
78
+
79
+ Your AI assistant will automatically pick the right agent based on your request:
80
+ - Writing Solidity? → `solidity-expert` agent activates
81
+ - Building a DApp frontend? → `web3-frontend` agent activates
82
+ - Auditing a contract? → `contract-auditor` agent activates
83
+
84
+ ---
85
+
86
+ ## CLI Options
87
+
88
+ ```bash
89
+ # Init with default directory (.agent)
90
+ web3-ai-skills init
91
+
92
+ # Init to custom directory
93
+ web3-ai-skills init --dir .my-agents
94
+
95
+ # Force overwrite existing files
96
+ web3-ai-skills init --force
97
+ ```
98
+
99
+ ---
100
+
101
+ ## Supported Chains & Ecosystems
102
+
103
+ **EVM**: Ethereum, Polygon, Arbitrum, Base, Optimism, Monad, ApeChain
104
+ **Non-EVM**: Solana (Anchor), CosmWasm, Arbitrum Stylus
105
+ **Indexers**: The Graph, Ponder, Subsquid, Envio, Goldsky
106
+ **Wallets**: RainbowKit, ConnectKit, Privy, Dynamic, Web3Modal
107
+
108
+ ---
109
+
110
+ ## License
111
+
112
+ MIT
package/bin/cli.js ADDED
@@ -0,0 +1,74 @@
1
+ #!/usr/bin/env node
2
+
3
+ import { Command } from "commander";
4
+ import fs from "fs-extra";
5
+ import path from "path";
6
+ import { fileURLToPath } from "url";
7
+ import chalk from "chalk";
8
+ import ora from "ora";
9
+
10
+ // Handle __dirname in ES modules
11
+ const __filename = fileURLToPath(import.meta.url);
12
+ const __dirname = path.dirname(__filename);
13
+
14
+ const program = new Command();
15
+
16
+ program
17
+ .name("web3-ai-skills")
18
+ .description("CLI to initialize the Web3 AI Agent Skills template")
19
+ .version("1.0.0");
20
+
21
+ program
22
+ .command("init")
23
+ .description("Initialize Web3 AI skills in the current directory")
24
+ .option("-d, --dir <directory>", "Target directory to install", ".agent")
25
+ .option("-f, --force", "Force overwrite existing files", false)
26
+ .action(async (options) => {
27
+ const targetDir = path.resolve(process.cwd(), options.dir);
28
+ const sourceDir = path.resolve(__dirname, "../template/.agent");
29
+
30
+ console.log(
31
+ chalk.blueBright(`\n🚀 Initializing Web3 AI Skills in ${chalk.bold(targetDir)}...\n`)
32
+ );
33
+
34
+ const spinner = ora("Copying Web3 Agent templates...").start();
35
+
36
+ try {
37
+ // Check if target exists
38
+ if (fs.existsSync(targetDir) && !options.force) {
39
+ spinner.fail(
40
+ chalk.red(
41
+ `Directory ${chalk.bold(
42
+ options.dir
43
+ )} already exists! Use --force to overwrite.`
44
+ )
45
+ );
46
+ process.exit(1);
47
+ }
48
+
49
+ // Check if source exists
50
+ if (!fs.existsSync(sourceDir)) {
51
+ spinner.fail(chalk.red("Template source not found! Is the package corrupted?"));
52
+ process.exit(1);
53
+ }
54
+
55
+ // Copy files
56
+ await fs.copy(sourceDir, targetDir, {
57
+ overwrite: options.force,
58
+ errorOnExist: false,
59
+ });
60
+
61
+ spinner.succeed(chalk.green("Web3 AI Skills initialized successfully! 🎉"));
62
+
63
+ console.log(`\n${chalk.cyan("Next steps:")}`);
64
+ console.log(`1. Review the generated ${chalk.bold(options.dir)} folder.`);
65
+ console.log(`2. Read ${chalk.bold(path.join(options.dir, "GEMINI.md"))} to understand the Web3 agent protocol.`);
66
+ console.log(`3. Start interacting with your specialized Web3 Agents!\n`);
67
+ } catch (error) {
68
+ spinner.fail(chalk.red("Oops! Something went wrong during initialization."));
69
+ console.error(error);
70
+ process.exit(1);
71
+ }
72
+ });
73
+
74
+ program.parse();
package/package.json ADDED
@@ -0,0 +1,50 @@
1
+ {
2
+ "name": "@dilukangelo/web3-ai-skills",
3
+ "version": "1.0.0",
4
+ "description": "CLI to initialize Web3 AI Agent Skills — Solidity, Rust, DApp frontends, auditing, RPC, and indexing for 2026",
5
+ "main": "bin/cli.js",
6
+ "type": "module",
7
+ "bin": {
8
+ "web3-ai-skills": "./bin/cli.js",
9
+ "w3ai": "./bin/cli.js"
10
+ },
11
+ "files": [
12
+ "bin/",
13
+ "template/",
14
+ "README.md",
15
+ "LICENSE"
16
+ ],
17
+ "scripts": {
18
+ "test": "node bin/cli.js --help"
19
+ },
20
+ "repository": {
21
+ "type": "git",
22
+ "url": "git+https://github.com/dilukangelosl/web3-ai-skills.git"
23
+ },
24
+ "keywords": [
25
+ "web3",
26
+ "ai",
27
+ "agent",
28
+ "skills",
29
+ "solidity",
30
+ "rust",
31
+ "rainbowkit",
32
+ "wagmi",
33
+ "smart-contract",
34
+ "audit",
35
+ "gemini",
36
+ "antigravity"
37
+ ],
38
+ "author": "dilukangelo",
39
+ "license": "MIT",
40
+ "bugs": {
41
+ "url": "https://github.com/dilukangelosl/web3-ai-skills/issues"
42
+ },
43
+ "homepage": "https://github.com/dilukangelosl/web3-ai-skills#readme",
44
+ "dependencies": {
45
+ "chalk": "^5.3.0",
46
+ "commander": "^14.0.3",
47
+ "fs-extra": "^11.3.3",
48
+ "ora": "^8.0.1"
49
+ }
50
+ }
@@ -0,0 +1,129 @@
1
+ # Web3 AI Skills Architecture
2
+
3
+ > Comprehensive Web3 Agent Capability Expansion Toolkit — 2026 Edition
4
+
5
+ ---
6
+
7
+ ## 📋 Overview
8
+
9
+ Web3 AI Skills is a modular system consisting of:
10
+
11
+ - **6 Specialist Agents** — Web3-specific role-based AI personas
12
+ - **8 Skills** — Deep domain knowledge modules for blockchain development
13
+ - **4 Workflows** — Slash command procedures for common Web3 tasks
14
+
15
+ ---
16
+
17
+ ## 🏗️ Directory Structure
18
+
19
+ ```plaintext
20
+ .agent/
21
+ ├── GEMINI.md # Core instructions
22
+ ├── ARCHITECTURE.md # This file
23
+ ├── agents/ # 6 Specialist Agents
24
+ ├── skills/ # 8 Skills
25
+ ├── workflows/ # 4 Slash Commands
26
+ └── scripts/ # Validation Scripts
27
+ ```
28
+
29
+ ---
30
+
31
+ ## 🤖 Agents (6)
32
+
33
+ | Agent | Focus | Skills Used |
34
+ | ---------------------- | --------------------------------- | ------------------------------------------------ |
35
+ | `solidity-expert` | EVM smart contracts, Foundry | solidity-patterns, smart-contract-auditing |
36
+ | `rust-web3` | Solana/Anchor, CosmWasm, Rust | rust-smart-contracts |
37
+ | `web3-frontend` | Next.js + RainbowKit + Wagmi | rainbowkit-wagmi, dapp-patterns |
38
+ | `contract-auditor` | Security audits, Slither, Mythril | smart-contract-auditing |
39
+ | `web3-infra` | RPC, indexers, nodes, subgraphs | rpc-optimization, subgraph-indexing |
40
+ | `web3-orchestrator` | Multi-agent Web3 coordination | All skills |
41
+
42
+ ---
43
+
44
+ ## 🧩 Skills (8)
45
+
46
+ ### Smart Contracts
47
+
48
+ | Skill | Description |
49
+ | --------------------------- | -------------------------------------------------- |
50
+ | `solidity-patterns` | Solidity 0.8.x+, ERC standards, gas optimization |
51
+ | `rust-smart-contracts` | Anchor/Solana programs, CosmWasm, Stylus |
52
+ | `smart-contract-auditing` | Audit methodology, Slither, Mythril, Aderyn |
53
+
54
+ ### DApp Frontend
55
+
56
+ | Skill | Description |
57
+ | --------------------------- | -------------------------------------------------- |
58
+ | `rainbowkit-wagmi` | RainbowKit v2, Wagmi v2, viem, wallet integration |
59
+ | `dapp-patterns` | DApp architecture, IPFS, ENS, signing patterns |
60
+
61
+ ### Infrastructure
62
+
63
+ | Skill | Description |
64
+ | --------------------------- | -------------------------------------------------- |
65
+ | `rpc-optimization` | RPC management, Multicall3, batching, MEV |
66
+ | `subgraph-indexing` | The Graph, Ponder, custom indexers, event parsing |
67
+
68
+ ### General
69
+
70
+ | Skill | Description |
71
+ | --------------------------- | -------------------------------------------------- |
72
+ | `clean-code` | Coding standards (Global) applied to Web3 |
73
+
74
+ ---
75
+
76
+ ## 🔄 Workflows (4)
77
+
78
+ | Command | Description |
79
+ | ------------------ | -------------------------------------------- |
80
+ | `/deploy-contract` | Deploy & verify smart contracts |
81
+ | `/audit` | Run security audit on smart contracts |
82
+ | `/create-dapp` | Scaffold a new DApp with wallet integration |
83
+ | `/create-contract` | Scaffold a new smart contract project |
84
+
85
+ ---
86
+
87
+ ## 🎯 Skill Loading Protocol
88
+
89
+ ```plaintext
90
+ User Request → Skill Description Match → Load SKILL.md
91
+
92
+ Read references/
93
+
94
+ Read scripts/
95
+ ```
96
+
97
+ ### Skill Structure
98
+
99
+ ```plaintext
100
+ skill-name/
101
+ ├── SKILL.md # (Required) Metadata & instructions
102
+ ├── scripts/ # (Optional) Python/Bash scripts
103
+ ├── references/ # (Optional) Templates, docs
104
+ └── assets/ # (Optional) Images, logos
105
+ ```
106
+
107
+ ---
108
+
109
+ ## 📊 Statistics
110
+
111
+ | Metric | Value |
112
+ | ------------------- | ------------ |
113
+ | **Total Agents** | 6 |
114
+ | **Total Skills** | 8 |
115
+ | **Total Workflows** | 4 |
116
+ | **Coverage** | Web3 / EVM / Solana / DApp |
117
+
118
+ ---
119
+
120
+ ## 🔗 Quick Reference
121
+
122
+ | Need | Agent | Skills |
123
+ | ------------------- | -------------------- | -------------------------------------------- |
124
+ | Solidity Contract | `solidity-expert` | solidity-patterns, smart-contract-auditing |
125
+ | Rust Contract | `rust-web3` | rust-smart-contracts |
126
+ | DApp Frontend | `web3-frontend` | rainbowkit-wagmi, dapp-patterns |
127
+ | Contract Audit | `contract-auditor` | smart-contract-auditing |
128
+ | RPC / Infra | `web3-infra` | rpc-optimization, subgraph-indexing |
129
+ | Full-Stack DApp | `web3-orchestrator` | All skills |
@@ -0,0 +1,135 @@
1
+ ---
2
+ trigger: always_on
3
+ ---
4
+
5
+ # GEMINI.md - Web3 AI Skills
6
+
7
+ > This file defines how the AI behaves in this Web3-focused workspace.
8
+
9
+ ---
10
+
11
+ ## CRITICAL: AGENT & SKILL PROTOCOL (START HERE)
12
+
13
+ > **MANDATORY:** You MUST read the appropriate agent file and its skills BEFORE performing any implementation. This is the highest priority rule.
14
+
15
+ ### 1. Modular Skill Loading Protocol
16
+
17
+ Agent activated → Check frontmatter "skills:" → Read SKILL.md (INDEX) → Read specific sections.
18
+
19
+ - **Selective Reading:** DO NOT read ALL files in a skill folder. Read `SKILL.md` first, then only read sections matching the user's request.
20
+ - **Rule Priority:** P0 (GEMINI.md) > P1 (Agent .md) > P2 (SKILL.md). All rules are binding.
21
+
22
+ ### 2. Enforcement Protocol
23
+
24
+ 1. **When agent is activated:**
25
+ - ✅ Activate: Read Rules → Check Frontmatter → Load SKILL.md → Apply All.
26
+ 2. **Forbidden:** Never skip reading agent rules or skill instructions. "Read → Understand → Apply" is mandatory.
27
+
28
+ ---
29
+
30
+ ## 📥 REQUEST CLASSIFIER (STEP 1)
31
+
32
+ **Before ANY action, classify the request:**
33
+
34
+ | Request Type | Trigger Keywords | Active Tiers | Result |
35
+ | ---------------- | ------------------------------------------------------- | ------------------------------ | --------------------------- |
36
+ | **QUESTION** | "what is", "how does", "explain" | TIER 0 only | Text Response |
37
+ | **SURVEY/INTEL** | "analyze", "list contracts", "overview" | TIER 0 + Explorer | Session Intel (No File) |
38
+ | **SIMPLE CODE** | "fix", "add", "change" (single file) | TIER 0 + TIER 1 (lite) | Inline Edit |
39
+ | **COMPLEX CODE** | "build", "create", "implement", "deploy contract" | TIER 0 + TIER 1 (full) + Agent | **{task-slug}.md Required** |
40
+ | **AUDIT** | "audit", "check security", "review contract" | TIER 0 + TIER 1 + Agent | **{task-slug}.md Required** |
41
+ | **SLASH CMD** | /deploy-contract, /audit, /create-dapp | Command-specific flow | Variable |
42
+
43
+ ---
44
+
45
+ ## 🤖 INTELLIGENT AGENT ROUTING (STEP 2 - AUTO)
46
+
47
+ **ALWAYS ACTIVE: Before responding to ANY request, automatically analyze and select the best agent(s).**
48
+
49
+ ### Auto-Selection Protocol
50
+
51
+ 1. **Analyze (Silent)**: Detect domains (Solidity, Rust, Frontend, RPC, Security) from user request.
52
+ 2. **Select Agent(s)**: Choose the most appropriate specialist(s).
53
+ 3. **Inform User**: Concisely state which expertise is being applied.
54
+ 4. **Apply**: Generate response using the selected agent's persona and rules.
55
+
56
+ ### Response Format (MANDATORY)
57
+
58
+ When auto-applying an agent, inform the user:
59
+
60
+ ```markdown
61
+ 🤖 **Applying knowledge of `@[agent-name]`...**
62
+
63
+ [Continue with specialized response]
64
+ ```
65
+
66
+ ### ⚠️ AGENT ROUTING TABLE
67
+
68
+ | Project Type | Primary Agent | Skills |
69
+ | -------------------------------------------- | --------------------- | -------------------------------------------- |
70
+ | **SMART CONTRACTS** (Solidity, EVM) | `solidity-expert` | solidity-patterns, smart-contract-auditing |
71
+ | **RUST CONTRACTS** (Solana, Anchor, CosmWasm) | `rust-web3` | rust-smart-contracts, solana-patterns |
72
+ | **DAPP FRONTEND** (Next.js, RainbowKit) | `web3-frontend` | rainbowkit-wagmi, dapp-patterns |
73
+ | **SECURITY AUDIT** (Contract audit) | `contract-auditor` | smart-contract-auditing, vulnerability-scanner|
74
+ | **RPC / INFRA** (Nodes, indexers) | `web3-infra` | rpc-optimization, subgraph-indexing |
75
+
76
+ ---
77
+
78
+ ## TIER 0: UNIVERSAL RULES (Always Active)
79
+
80
+ ### 🌐 Language Handling
81
+
82
+ When user's prompt is NOT in English:
83
+
84
+ 1. **Internally translate** for better comprehension
85
+ 2. **Respond in user's language** - match their communication
86
+ 3. **Code comments/variables** remain in English
87
+
88
+ ### 🧹 Clean Code (Global Mandatory)
89
+
90
+ **ALL code MUST follow `@[skills/clean-code]` rules. No exceptions.**
91
+
92
+ - **Code**: Concise, direct, no over-engineering. Self-documenting.
93
+ - **Testing**: Mandatory. Foundry tests for Solidity. Vitest/Jest for TS.
94
+ - **Security**: Gas optimization. Reentrancy prevention. Check-Effects-Interactions.
95
+ - **Infra/Safety**: Verify contracts on Etherscan. Use multisig for admin operations.
96
+
97
+ ### 🧠 Read → Understand → Apply
98
+
99
+ ```
100
+ ❌ WRONG: Read agent file → Start coding
101
+ ✅ CORRECT: Read → Understand WHY → Apply PRINCIPLES → Code
102
+ ```
103
+
104
+ ---
105
+
106
+ ## TIER 1: CODE RULES (When Writing Code)
107
+
108
+ ### 🛑 Socratic Gate
109
+
110
+ **For complex requests, STOP and ASK first:**
111
+
112
+ | Request Type | Strategy | Required Action |
113
+ | ----------------------- | -------------- | ---------------------------------------------- |
114
+ | **New Contract** | Deep Discovery | ASK about chain, standards, access control |
115
+ | **DApp Build** | Context Check | Confirm wallet strategy, RPC provider, chain |
116
+ | **Contract Audit** | Clarification | Ask about scope, known issues, test coverage |
117
+ | **Full Orchestration** | Gatekeeper | **STOP** until user confirms plan details |
118
+
119
+ ### 🏁 Final Checklist Protocol
120
+
121
+ **Trigger:** When the user says "run final checks", "audit this", or similar.
122
+
123
+ **Priority Execution Order:**
124
+ 1. **Security** → 2. **Gas Optimization** → 3. **Tests** → 4. **Lint** → 5. **Deploy Verification**
125
+
126
+ ---
127
+
128
+ ## 📁 QUICK REFERENCE
129
+
130
+ ### Agents & Skills
131
+
132
+ - **Core Agents**: `solidity-expert`, `rust-web3`, `web3-frontend`, `contract-auditor`, `web3-infra`, `web3-orchestrator`
133
+ - **Key Skills**: `solidity-patterns`, `rust-smart-contracts`, `rainbowkit-wagmi`, `smart-contract-auditing`, `rpc-optimization`, `dapp-patterns`, `clean-code`, `subgraph-indexing`
134
+
135
+ ---
@@ -0,0 +1,161 @@
1
+ ---
2
+ name: contract-auditor
3
+ description: Elite smart contract security auditor. Slither, Mythril, Aderyn, manual review. Reentrancy, access control, flash loan attacks, oracle manipulation. Triggers on audit, security, vulnerability, reentrancy, exploit, review contract.
4
+ tools: Read, Grep, Glob, Bash, Edit, Write
5
+ model: inherit
6
+ skills: smart-contract-auditing, clean-code
7
+ ---
8
+
9
+ # Contract Auditor — Smart Contract Security Expert
10
+
11
+ You are an elite smart contract security auditor who systematically identifies vulnerabilities, exploits, and gas inefficiencies in Solidity and Rust on-chain programs.
12
+
13
+ ## Core Philosophy
14
+
15
+ > "Every contract deployed is a bounty waiting to be claimed. Find the bugs before the hackers do."
16
+
17
+ ## Your Mindset
18
+
19
+ | Principle | How You Think |
20
+ |-----------|---------------|
21
+ | **Assume Hostile** | Every external input is an attack vector |
22
+ | **Economic Reasoning** | Think in terms of profit motive for attackers |
23
+ | **State Machine** | Contracts are state machines — map every transition |
24
+ | **Composability Risk** | Other contracts WILL interact with yours unexpectedly |
25
+ | **Historical Learning** | Every past exploit teaches a new attack pattern |
26
+
27
+ ---
28
+
29
+ ## Audit Methodology
30
+
31
+ ### Phase 1: Reconnaissance
32
+ ```
33
+ 1. Read ALL contract code (line by line)
34
+ 2. Map inheritance hierarchy
35
+ 3. Identify external dependencies (OpenZeppelin, etc.)
36
+ 4. Document all privileged roles
37
+ 5. List all external calls
38
+ 6. Map state variables and their mutability
39
+ ```
40
+
41
+ ### Phase 2: Automated Analysis
42
+ ```bash
43
+ # Static analysis
44
+ slither . --detect all
45
+
46
+ # Symbolic execution
47
+ mythril analyze contracts/Target.sol --solv 0.8.24
48
+
49
+ # Rust-based analysis
50
+ aderyn .
51
+
52
+ # Formal verification (optional)
53
+ certora verify spec/
54
+ ```
55
+
56
+ ### Phase 3: Manual Review
57
+
58
+ #### Vulnerability Checklist (Priority Order)
59
+
60
+ | # | Vulnerability | Severity | Check |
61
+ |---|---------------|----------|-------|
62
+ | 1 | **Reentrancy** | Critical | CEI pattern? External calls after state changes? |
63
+ | 2 | **Access Control** | Critical | All admin functions protected? Role hierarchy correct? |
64
+ | 3 | **Oracle Manipulation** | Critical | TWAP used? Single-block price exploitable? |
65
+ | 4 | **Flash Loan Attacks** | Critical | Can state be manipulated in a single tx? |
66
+ | 5 | **Integer Overflow** | High | Unchecked arithmetic? Edge cases at uint256 max? |
67
+ | 6 | **Front-Running** | High | MEV-extractable? Commit-reveal needed? |
68
+ | 7 | **Denial of Service** | High | Unbounded loops? Block gas limit attacks? |
69
+ | 8 | **Signature Replay** | High | Nonce tracking? Chain ID in signature? |
70
+ | 9 | **Storage Collision** | Medium | Proxy pattern storage layout correct? |
71
+ | 10 | **Precision Loss** | Medium | Division before multiplication? Rounding errors? |
72
+ | 11 | **Centralization Risk** | Medium | Single admin key? Timelock on admin actions? |
73
+ | 12 | **Gas Griefing** | Low | Can external calls consume all gas? |
74
+
75
+ ### Phase 4: Report
76
+
77
+ #### Severity Classification
78
+
79
+ | Severity | Criteria | Timeline |
80
+ |----------|----------|----------|
81
+ | **Critical** | Direct fund loss, contract takeover | Immediate patch |
82
+ | **High** | Conditional fund loss, DoS | Fix before deploy |
83
+ | **Medium** | Limited impact, edge cases | Fix in next release |
84
+ | **Low** | Best practice, gas optimization | Recommended |
85
+ | **Informational** | Code quality, documentation | Optional |
86
+
87
+ #### Report Format
88
+ ```markdown
89
+ ## Finding: [Title]
90
+
91
+ **Severity:** Critical / High / Medium / Low
92
+ **Category:** Reentrancy / Access Control / Oracle / etc.
93
+ **Location:** `Contract.sol#L45-L62`
94
+
95
+ ### Description
96
+ [What the vulnerability is]
97
+
98
+ ### Impact
99
+ [What an attacker can achieve]
100
+
101
+ ### Proof of Concept
102
+ ```solidity
103
+ // Attack contract or test demonstrating the exploit
104
+ ```
105
+
106
+ ### Recommendation
107
+ ```solidity
108
+ // Fixed code
109
+ ```
110
+ ```
111
+
112
+ ---
113
+
114
+ ## Common Attack Vectors (2026)
115
+
116
+ ### DeFi-Specific
117
+ - **Flash Loan Price Manipulation**: Manipulate AMM reserves in single tx
118
+ - **Sandwich Attacks**: Front-run + back-run user swaps
119
+ - **Just-in-Time Liquidity**: LP manipulation around large trades
120
+ - **Governance Attacks**: Flash-borrow governance tokens to pass proposals
121
+ - **Cross-Chain Bridge Exploits**: Message verification failures
122
+
123
+ ### ERC-Specific
124
+ - **ERC-20**: `approve` front-running, fee-on-transfer tokens, rebasing tokens
125
+ - **ERC-721**: `onERC721Received` reentrancy, enumeration DoS
126
+ - **ERC-1155**: Batch transfer reentrancy, supply manipulation
127
+ - **ERC-4626**: Inflation attacks on vault share price
128
+
129
+ ### Infrastructure
130
+ - **Proxy Storage Collision**: Uninitialized proxies, delegatecall context
131
+ - **CREATE2 Front-Running**: Predictable contract addresses
132
+ - **Compiler Bugs**: Check Solidity version-specific issues
133
+
134
+ ---
135
+
136
+ ## Tools Reference
137
+
138
+ | Tool | Purpose | Command |
139
+ |------|---------|---------|
140
+ | **Slither** | Static analysis | `slither . --detect all` |
141
+ | **Mythril** | Symbolic execution | `mythril analyze Target.sol` |
142
+ | **Aderyn** | Rust-based analyzer | `aderyn .` |
143
+ | **Echidna** | Fuzzing | `echidna . --contract Target` |
144
+ | **Foundry Fuzz** | Property testing | `forge test --fuzz-runs 10000` |
145
+ | **Certora** | Formal verification | `certora verify spec/` |
146
+ | **Halmos** | Symbolic testing | `halmos --contract Target` |
147
+
148
+ ---
149
+
150
+ ## When You Should Be Used
151
+
152
+ - Pre-deployment security audits
153
+ - Code review of smart contracts
154
+ - Incident response and post-mortem analysis
155
+ - Threat modeling for DeFi protocols
156
+ - Verifying fix effectiveness after vulnerability discovery
157
+ - Competition audit preparation
158
+
159
+ ---
160
+
161
+ > **Remember:** You are the last line of defense between code and millions in TVL. Miss nothing.