asserting-contract-from-code-size

Name: asserting-contract-from-code-size
Availability: InStock
Author: Apeguru

Detect insecure EOA checks using extcodesize or address.code.length in Solidity.

1|1|Updated Feb 18, 2026

Search Tags:#security #vulnerability #access control #smart contracts #solidity #eoa

Ready to run

npx skills add https://github.com/Apegurus/solidity-argus --skill asserting-contract-from-code-size

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: asserting-contract-from-code-size
Source: https://github.com/Apegurus/solidity-argus/tree/main/skills/vulnerability-patterns/asserting-contract-from-code-size
Command: npx skills add https://github.com/Apegurus/solidity-argus --skill asserting-contract-from-code-size

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses a common security vulnerability in Solidity smart contracts where checks for Externally Owned Accounts (EOAs) based on code size can be bypassed, leading to unauthorized access or actions.

Core Features & Use Cases

Vulnerability Identification: Detects the use of extcodesize or address.code.length for EOA checks.
Security Risk Assessment: Flags instances where this check gates critical operations like minting or access control.
Use Case: An auditor can use this Skill to quickly identify and flag contracts that incorrectly assume code size is a reliable indicator of an EOA, potentially exposing minting functions to contract callers.

Quick Start

Analyze the provided Solidity code for insecure EOA checks.

Frequently Asked Questions about asserting-contract-from-code-size

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why is using extcodesize for EOA checks insecure in Solidity smart contracts?▼

This Skill identifies and analyzes the use of `extcodesize` or `address.code.length` for distinguishing between Externally Owned Accounts (EOAs) and contracts. It detects vulnerabilities where this check gates access control, anti-bot logic, or security-sensitive operations, flagging potential bypasses during constructor execution and assessing security implications.

How do I detect if a smart contract is vulnerable to code size bypass attacks?▼

This Skill detects the use of `extcodesize` or `address.code.length` for EOA enforcement and flags instances where this check gates critical operations like minting or access control. It assesses the security implications of relying on code size and identifies potential bypasses during constructor execution.

Does checking address.code.length work with account abstraction in Solidity?▼

Checking `address.code.length` is incompatible with account abstraction. This Skill assesses security implications of relying on code size for EOA enforcement and explicitly checks for incompatible EOA checks like `tx.origin == msg.sender` when used alongside account abstraction.

Can I use address.code.length to prevent smart contracts from calling a minting function?▼

Using `address.code.length` to prevent contracts from calling a minting function is unsafe. This Skill flags contracts that incorrectly assume code size is a reliable indicator of an EOA, exposing minting functions to contract callers executing during their constructor phase.

What are the limitations of relying on extcodesize for anti-bot logic in smart contracts?▼

The limitation of relying on `extcodesize` for anti-bot logic is that it fails during constructor execution, allowing malicious contracts to bypass restrictions. This Skill analyzes such anti-bot logic, flagging potential security bypasses when code size is used to gate sensitive operations.