skills.rest
Ayoub-ouederni
Ayoub-ouederniCOMMUNITY
Explore all skills by this author →
GitHub

algorand-vulnerability-scanner

Scans Algorand TEAL and PyTeal smart contracts for 11 platform-specific vulnerability patterns.

Updated Apr 3, 2026
Search Tags:#blockchain security#teal#algorand#pyteal#tealer#vulnerability scanner#smart contract audit
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill algorand-vulnerability-scanner-ayoub-ouederni
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: algorand-vulnerability-scanner
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/algorand-vulnerability-scanner
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill algorand-vulnerability-scanner-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires tealer, and includes references (resource) components.

What problem does it solve? Algorand smart contracts have unique attack surfaces like rekeying, unchecked CloseRemainderTo fields, and group transaction manipulation that generic Solidity-focused auditors miss, leaving contracts exposed to account takeover and fund drainage. ## Core Features & Use Cases - 11 Vulnerability Patterns: Detects rekeying attacks, unchecked transaction fees, missing group size validation, asset close-to issues, access control gaps, and more, each with severity ratings and fix recommendations. - Tealer Integration: Runs Trail of Bits' Tealer static analyzer alongside manual pattern sweeps for automated detection with CI/CD support. - Structured Audit Reports: Produces findings with file locations, vulnerable code snippets, attack scenarios, and remediation code. - Use Case: Before deploying a PyTeal DeFi application, run a scan to confirm every payment transaction validates RekeyTo and CloseRemainderTo, then export the Tealer report for your audit trail. ## Quick Start Scan the Algorand contracts in this project for rekeying, fee, and group transaction vulnerabilities and report any critical findings.

Frequently Asked Questions about algorand-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan Algorand smart contracts for vulnerabilities?▼

Scan TEAL and PyTeal files for the 11 documented vulnerability patterns such as missing RekeyTo validation and unchecked group size. You can also run Tealer with 'tealer contract.teal --detect all' for automated static analysis.

What vulnerabilities are unique to Algorand smart contracts?▼

Algorand-specific risks include rekeying attacks, CloseRemainderTo and AssetCloseTo drainage, group transaction manipulation, inner transaction fee drainage, and clear state program bypasses. These stem from Algorand's transaction field model rather than EVM-style execution.

Does Tealer work with PyTeal contracts?▼

Tealer analyzes compiled TEAL code, so PyTeal contracts must be compiled to TEAL first. Install it with 'pip3 install tealer' and run it against the generated .teal files with the --detect all flag.

How do I prevent rekeying attacks in PyTeal?▼

Add an explicit assertion that Txn.rekey_to() equals Global.zero_address() in every transaction approval path. For inner transactions in Teal v6+, never set the RekeyTo field from user-controlled input.

Can this scan run in a CI/CD pipeline?▼

Yes, Tealer supports JSON output and failure thresholds. Use 'tealer approval.teal --detect all --fail-on critical,high' to break the build when critical or high severity findings appear.

Related Skills

Explore More Software Engineering Skills→
DobricLilujunDobricLilujun

algorand-vulnerability-scanner

Scan Algorand TEAL/PyTeal contracts for 11 vulnerability patterns and generate structured reports.

Community
Advanced
AbdelrhmanUZakiAbdelrhmanUZaki
2

run-poc

Generates proof-of-concept exploit reasoning to verify security fix effectiveness.

Community
Intermediate
TravisLeeeeeeTravisLeeeeee
110

Blockchain Security Auditor

Detect smart contract vulnerabilities and produce severity-classified audit findings with PoC scenarios.

Community
Advanced
sc30gswsc30gsw
27

vcsdd-formal-hardening

Select verification tools and generate proof harnesses for Rust, Python, and TypeScript code.

Community
Advanced