Smart Contract Security Analysis & Code Review
Detect smart contract vulnerabilities and optimize security instantly
What You Can Do
Analyze Solidity and other smart contract code for security vulnerabilities, gas inefficiencies, and best practice violations. Get detailed reports with risk scoring, remediation suggestions, and optimization recommendations. Whether you're auditing before deployment or reviewing third-party contracts, this skill identifies critical issues faster than manual review.
Features
Identifies reentrancy, integer overflow/underflow, unchecked call returns, timestamp dependency, and 50+ known attack vectors
Finds inefficient patterns and suggests storage layout improvements, loop optimization, and calldata vs memory tradeoffs
Checks for proper access control, input validation, state management, and ERC-20/721/1155 standard compliance
Detects suspicious patterns like delegatecall usage, proxy vulnerabilities, and initialization issues
Rates each finding as critical, high, medium, or low with detailed justification and impact assessment
Provides code examples and step-by-step fixes for every vulnerability found
Visualizes external calls, dependencies, and potential attack surfaces across contract interactions
Produces professional security audit reports suitable for stakeholders and deployment teams
Example Output
Vulnerability Report for TokenMint.sol:
- 🔴 CRITICAL — Reentrancy Vulnerability (Line 42)
// Vulnerable
(bool success, ) = recipient.call{value: amount}("");
require(success, "Transfer failed");
balances[recipient] -= amount; // State change after call
Risk: Attacker can drain contract during callback Fix: Update state before external call using checks-effects-interactions pattern
- ⚠️ HIGH — Unchecked Integer Overflow (Line 18)
uint8 price = 100;
price += user_input; // No validation
Recommendation: Use Solidity 0.8.0+ (automatic checks) or OpenZeppelin SafeMath
- 💡 MEDIUM — Gas Inefficiency (Line 35)
for (uint i = 0; i < array.length; i++) { // Reads length each iteration
// ...
}
Optimization: Cache array.length in local variable (saves ~3 gas per iteration)
Summary: 8 issues found (1 critical, 2 high, 3 medium, 2 low). Estimated severity: High. Recommend: Deploy blocklist contract, audit reentrancy fixes, optimize loops before mainnet.
What's Included
- SKILL.md: Complete smart contract security analysis workflow with decision trees and verification checklists
- Vulnerability checklist template: 50+ known vulnerabilities organized by category (reentrancy, overflow, access control, etc.)
- Security audit report template: Professional format suitable for stakeholder review and deployment teams
- Gas optimization guide: Common patterns and their gas costs with before/after comparisons
- Remediation code examples: Copy-paste fixes for common vulnerabilities (SafeMath, ReentrancyGuard, etc.)
- Contract interaction mapper: Workflow for analyzing call chains and dependency graphs
- ERC standard compliance checklist: Verification for ERC-20, ERC-721, ERC-1155, and ERC-4626
Who It's For
- Smart contract developers — Review your own code before deployment or during development iterations
- Blockchain security auditors — Streamline manual audits with automated vulnerability detection and reporting
- DeFi protocol teams — Pre-launch security review for staking, yield farming, and lending contracts
- Smart contract reviewers — Code review specialists evaluating third-party contracts or community contributions
- Web3 startup teams — Quick security assessments when you need results faster than hiring external auditors
Best For
- Pre-deployment security audits — Run before testnet/mainnet launch
- Vulnerability detection — Identify reentrancy, overflow, and access control issues automatically
- Gas optimization — Reduce transaction costs by identifying inefficient patterns
- Code review preparation — Audit third-party contracts or contributions quickly
- Compliance checking — Verify ERC token standards and security best practices
- Post-incident analysis — Investigate exploited contracts and understand attack vectors
You might also like
Rapidly analyze production incidents by correlating observability signals—logs, metrics, traces, and events—to identify the true root cause instead of symptoms. You'll reconstruct incident timelines, quantify impact scope, and generate both immediate remediation steps and long-term prevention measures.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You'll transform high-level feature requirements into a complete development plan covering API design, frontend implementation, testing strategy, and documentation. The skill helps you identify dependencies, parallelize work across frontend and backend teams, and establish quality gates that ensure features ship bug-free with proper error handling and logging.
Transform schema and data changes into production-ready migration packages that protect data integrity and minimize downtime. You can handle column additions, renames, type conversions, and backfills using proven patterns like expand-contract and shadow tables. The skill generates explicit rollback scripts, validation checklists, and phased execution plans that keep applications stable throughout the migration.
You can create comprehensive performance testing strategies tailored to your application's architecture, analyze test results to identify bottlenecks, and generate prioritized recommendations for optimization. The skill helps you design load tests, interpret metrics like latency and throughput, and create action plans for performance improvements.
You can design comprehensive performance test strategies tailored to your application architecture, analyze performance metrics and logs to identify bottlenecks, and receive specific optimization recommendations. The skill guides you through creating realistic load scenarios, interpreting performance data, and prioritizing fixes based on impact analysis.
You can submit your Solidity smart contracts for comprehensive security analysis, vulnerability detection, and gas optimization recommendations. Claude reviews your code against known attack vectors, design patterns, and best practices—identifying reentrancy risks, overflow/underflow issues, access control flaws, and inefficient operations. You receive actionable fix recommendations with explanations of the security implications and gas savings potential.
You can accelerate your entire antenna design workflow—from initial concept to optimized specifications—by leveraging Claude's knowledge of electromagnetic theory, antenna types, and design trade-offs. Claude helps you parameterize designs, identify optimal configurations for your frequency band and application, and prepare detailed briefs for simulation and manufacturing. You'll generate design reviews, impedance-matching solutions, and validation checklists without context-switching to multiple tools.