Smart Contract Security Analysis & Code Review
Detect smart contract vulnerabilities and optimize security instantly
What You Can Do
Analyze Solidity and other smart contract code for security vulnerabilities, gas inefficiencies, and best practice violations. Get detailed reports with risk scoring, remediation suggestions, and optimization recommendations. Whether you're auditing before deployment or reviewing third-party contracts, this skill identifies critical issues faster than manual review.
Features
Identifies reentrancy, integer overflow/underflow, unchecked call returns, timestamp dependency, and 50+ known attack vectors
Finds inefficient patterns and suggests storage layout improvements, loop optimization, and calldata vs memory tradeoffs
Checks for proper access control, input validation, state management, and ERC-20/721/1155 standard compliance
Detects suspicious patterns like delegatecall usage, proxy vulnerabilities, and initialization issues
Rates each finding as critical, high, medium, or low with detailed justification and impact assessment
Provides code examples and step-by-step fixes for every vulnerability found
Visualizes external calls, dependencies, and potential attack surfaces across contract interactions
Produces professional security audit reports suitable for stakeholders and deployment teams
Example Output
Vulnerability Report for TokenMint.sol:
- 🔴 CRITICAL — Reentrancy Vulnerability (Line 42)
// Vulnerable
(bool success, ) = recipient.call{value: amount}("");
require(success, "Transfer failed");
balances[recipient] -= amount; // State change after call
Risk: Attacker can drain contract during callback Fix: Update state before external call using checks-effects-interactions pattern
- ⚠️ HIGH — Unchecked Integer Overflow (Line 18)
uint8 price = 100;
price += user_input; // No validation
Recommendation: Use Solidity 0.8.0+ (automatic checks) or OpenZeppelin SafeMath
- 💡 MEDIUM — Gas Inefficiency (Line 35)
for (uint i = 0; i < array.length; i++) { // Reads length each iteration
// ...
}
Optimization: Cache array.length in local variable (saves ~3 gas per iteration)
Summary: 8 issues found (1 critical, 2 high, 3 medium, 2 low). Estimated severity: High. Recommend: Deploy blocklist contract, audit reentrancy fixes, optimize loops before mainnet.
What's Included
- SKILL.md: Complete smart contract security analysis workflow with decision trees and verification checklists
- Vulnerability checklist template: 50+ known vulnerabilities organized by category (reentrancy, overflow, access control, etc.)
- Security audit report template: Professional format suitable for stakeholder review and deployment teams
- Gas optimization guide: Common patterns and their gas costs with before/after comparisons
- Remediation code examples: Copy-paste fixes for common vulnerabilities (SafeMath, ReentrancyGuard, etc.)
- Contract interaction mapper: Workflow for analyzing call chains and dependency graphs
- ERC standard compliance checklist: Verification for ERC-20, ERC-721, ERC-1155, and ERC-4626
Who It's For
- Smart contract developers — Review your own code before deployment or during development iterations
- Blockchain security auditors — Streamline manual audits with automated vulnerability detection and reporting
- DeFi protocol teams — Pre-launch security review for staking, yield farming, and lending contracts
- Smart contract reviewers — Code review specialists evaluating third-party contracts or community contributions
- Web3 startup teams — Quick security assessments when you need results faster than hiring external auditors
Best For
- Pre-deployment security audits — Run before testnet/mainnet launch
- Vulnerability detection — Identify reentrancy, overflow, and access control issues automatically
- Gas optimization — Reduce transaction costs by identifying inefficient patterns
- Code review preparation — Audit third-party contracts or contributions quickly
- Compliance checking — Verify ERC token standards and security best practices
- Post-incident analysis — Investigate exploited contracts and understand attack vectors
You might also like
You can accelerate your entire antenna design workflow—from initial concept to optimized specifications—by leveraging Claude's knowledge of electromagnetic theory, antenna types, and design trade-offs. Claude helps you parameterize designs, identify optimal configurations for your frequency band and application, and prepare detailed briefs for simulation and manufacturing. You'll generate design reviews, impedance-matching solutions, and validation checklists without context-switching to multiple tools.
You can convert raw API code, OpenAPI specs, GraphQL schemas, and implementation details into production-ready reference documentation. The skill generates systematically organized endpoint documentation with parameter tables, real request/response examples, error code catalogs, authentication details, rate limits, and SDK usage snippets in multiple programming languages—creating the authoritative developer reference for REST APIs, GraphQL APIs, WebSocket APIs, and webhook schemas.
Rapidly analyze production incidents by correlating observability signals—logs, metrics, traces, and events—to identify the true root cause instead of symptoms. You'll reconstruct incident timelines, quantify impact scope, and generate both immediate remediation steps and long-term prevention measures.
This skill guides you through designing Kalman filters for your specific state estimation and sensor fusion problems. You'll learn to diagnose filter divergence, tune covariance matrices (Q and R), and validate observability—turning mathematical theory into production-ready filters. The skill provides step-by-step workflows, diagnostic tools, and practical templates for common applications like GPS/IMU fusion, SLAM, and aircraft navigation.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You'll transform high-level feature requirements into a complete development plan covering API design, frontend implementation, testing strategy, and documentation. The skill helps you identify dependencies, parallelize work across frontend and backend teams, and establish quality gates that ensure features ship bug-free with proper error handling and logging.
You get a comprehensive security and gas optimization review of your Solidity smart contracts. The skill identifies common vulnerabilities like reentrancy attacks, overflow/underflow bugs, and unchecked external calls, while also pinpointing expensive operations and suggesting specific gas optimizations. Use this as a pre-audit screening to catch issues early and prepare your code for professional security review.
You can rapidly design, optimize, and validate chromatographic and LC-MS/MS methods for analyzing drugs and metabolites in biological matrices. This skill guides you through analytical method development workflows—including parameter selection, sensitivity optimization, and regulatory strategy—while ensuring ICH Q2(R2) and FDA compliance throughout the development process.