alt-research/solidityguard/openclaw-skill

SolidityGuard — Smart Contract Security Auditor

Advanced Solidity/EVM smart contract security audit skill with 104 vulnerability patterns covering reentrancy, access control, arithmetic, DeFi, proxy, oracle, transient storage (EIP-1153), account abstraction (ERC-4337), and EIP-7702/Pectra.

When to Use

Use this skill when:

• The user asks to audit, scan, or review a Solidity smart contract
• The user shares .sol or .vy files and asks about security
• The user mentions vulnerability, exploit, reentrancy, access control, or security audit
• The user asks about smart contract best practices or common attack vectors
• The user wants to generate a security report for their contracts
• The user wants fuzz tests (Foundry/Echidna) generated for their contracts
• The user asks about specific vulnerability patterns (e.g., "check for flash loan attacks")

Tools

• solidityguard_scan: Scans Solidity files for 104 vulnerability patterns using 50+ detectors
• solidityguard_report: Generates a professional audit report (Markdown/PDF) from scan findings
• solidityguard_fuzz: Generates Foundry invariant tests and Echidna property-based fuzz tests

Instructions

Quick Scan

To scan a single contract or directory for vulnerabilities:

python3 scripts/solidity_guard.py scan <path-to-contracts>

This runs the pattern scanner with 50+ detectors covering all 104 vulnerability patterns. Output is JSON with findings including severity, confidence, file:line location, and remediation.

Full Audit Workflow

For a comprehensive audit, follow this 7-phase workflow:

Phase 1 — Entry Point Analysis Enumerate all external/public functions to map the attack surface:

# Find all entry points
grep -rn "function.*external\|function.*public" contracts/

Phase 2 — Automated Scan Run available security tools, then the pattern scanner:

# Slither (if installed)
slither . --json slither-results.json 2>/dev/null || true
 
# Aderyn (if installed)
aderyn -s contracts/ -o aderyn-report.md 2>/dev/null || true
 
# Pattern scanner (always available)
python3 scripts/solidity_guard.py scan contracts/ --output findings.json

Phase 3 — Finding Verification Cross-reference tool outputs. Findings confirmed by 2+ tools get a confidence boost (+10%). Findings confirmed by 3+ tools are capped at 95% confidence.

Phase 4 — Deduplication Remove duplicate findings across tools. Keep the highest-confidence instance.

Phase 5 — Confidence Filtering Filter out findings below 0.70 confidence threshold.

Phase 6 — Report Generation Generate a professional audit report:

python3 scripts/report_generator.py --input findings.json --output audit-report.md

Phase 7 — Remediation For each finding, provide:

• Exact file:line location with vulnerable code snippet
• Step-by-step attack scenario
• Fixed Solidity code

Vulnerability Categories

The scanner detects 104 patterns organized into these categories:

Finding Format

Every finding MUST include:

## [SEVERITY] ETH-XXX: Vulnerability Name
 
**Location**: `contracts/File.sol:123` (functionName)
**Confidence**: 0.XX
**Category**: Category Name
 
### Description
What the vulnerability is and why it matters.
 
### Evidence

// Vulnerable code from contracts/File.sol:123 <exact code snippet>

 
### Attack Scenario
1. Attacker calls functionA()
2. During callback, attacker re-enters functionB()
3. State is inconsistent, allowing double withdrawal
 
### Recommendation

// Fixed code <secure implementation>

Anti-Hallucination Rules

CRITICAL — All findings MUST include:

• Exact file:line code location (not approximated)
• Vulnerable code snippet (verbatim from source, not generated)
• Specific attack scenario with numbered steps
• Remediation with working Solidity code
• Confidence score >= 0.70

REJECT any finding that:

• Says "this looks vulnerable" without exact pattern match
• Says "probably missing check" without verifying all code paths
• Has confidence below 0.70
• Cannot cite the exact line of vulnerable code

Tool Integration

The skill works best with these optional tools installed:

Benchmarks

Validated against real-world CTF challenges:

OWASP Smart Contract Top 10 (2025) Coverage

Examples

• "Audit my contracts for reentrancy" → Runs reentrancy-focused scan (ETH-001 to ETH-005)
• "Scan this DeFi protocol" → Full 104-pattern scan with all available tools
• "Check for flash loan vulnerabilities" → Targeted scan for ETH-024, ETH-025, ETH-057
• "Generate a security report" → Professional Markdown audit report
• "Write fuzz tests for this vault" → Foundry invariant tests + Echidna properties
• "Is this proxy upgradeable safely?" → Storage layout + proxy pattern analysis