asserting-contract-from-code-size

This Skill identifies and analyzes the use of `extcodesize` or `address.code.length` for distinguishing between Externally Owned Accounts (EOAs) and contracts. It detects vulnerabilities where this check gates access control, anti-bot logic, or security-sensitive operations, flagging potential bypasses during constructor execution and assessing security implications.

This Skill detects the use of `extcodesize` or `address.code.length` for EOA enforcement and flags instances where this check gates critical operations like minting or access control. It assesses the security implications of relying on code size and identifies potential bypasses during constructor execution.

Checking `address.code.length` is incompatible with account abstraction. This Skill assesses security implications of relying on code size for EOA enforcement and explicitly checks for incompatible EOA checks like `tx.origin == msg.sender` when used alongside account abstraction.

Using `address.code.length` to prevent contracts from calling a minting function is unsafe. This Skill flags contracts that incorrectly assume code size is a reliable indicator of an EOA, exposing minting functions to contract callers executing during their constructor phase.

The limitation of relying on `extcodesize` for anti-bot logic is that it fails during constructor execution, allowing malicious contracts to bypass restrictions. This Skill analyzes such anti-bot logic, flagging potential security bypasses when code size is used to gate sensitive operations.