Smart Contract Auditor skill

Smart Contract Auditor

Sibling skills: for entry-point enumeration use entry-point-analyzer; for differential PR review use differential-review; for property-based fuzzing depth see property-based-testing.

Pin the compiler to the project, never to this doc. Every --solv / symbolic-exec command below uses $SOLC as a placeholder. Read the real version from the project before running any tool:

# Foundry projects
SOLC=$(grep -E '^\s*solc(_version)?' foundry.toml | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
# Hardhat projects: check the `solidity:` block in hardhat.config.{js,ts}
# Fallback: read the pragma of the file under audit
SOLC=$(grep -oE 'pragma solidity[^;]*[0-9]+\.[0-9]+\.[0-9]+' src/Vault.sol | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | tail -1)
echo "Auditing against solc $SOLC"

Safety gate

Before executing commands or changing external systems, confirm scope, credentials, target environment, rollback, and required approval. Pin and verify third-party artifacts; never expose secrets to client code or logs.

Reference guide

Read only the references needed for the current request:

• 1. Tooling Setup: references/1-tooling-setup.md
• 2. Vulnerability Checklist: references/2-vulnerability-checklist.md
• 3. Proxy / Upgrade Safety: references/3-proxy-upgrade-safety.md
• 4. DeFi-Specific Audit: references/4-defi-specific-audit.md
• 5. Gas Optimization Patterns: references/5-gas-optimization-patterns.md
• 6. Audit Report Template: references/6-audit-report-template.md
• 7. Tool Commands Reference: references/7-tool-commands-reference.md
• 8. Test Coverage & Fuzzing Strategy: references/8-test-coverage-fuzzing-strategy.md