skills.rest
Ed1s0nZ
Ed1s0nZCOMMUNITY
Explore all skills by this author →
GitHub

blockchain-contract-attack

Guides auditing of smart contracts and DeFi protocols for reentrancy, access control, oracle, and flash loan vulnerabilities.

6.2k|1.0k|Updated Nov 8, 2025
Search Tags:#penetration testing#reentrancy#blockchain security#Slither#smart contract audit#flash loan#deFi
One-click install
npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill blockchain-contract-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: blockchain-contract-attack
Source: https://github.com/Ed1s0nZ/CyberStrikeAI/tree/main/skills/blockchain-contract-attack
Command: npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill blockchain-contract-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security auditors and penetration testers need a structured checklist of blockchain and smart contract attack surfaces, covering source code retrieval, automated analysis tools, and manual vulnerability patterns, so they do not miss critical flaws during an engagement.

Core Features & Use Cases

  • Source Code & Automated Analysis: Retrieve contract source via the Etherscan getsourcecode API and run static analyzers such as slither, mythril, and manticore.
  • Manual Vulnerability Patterns: Check for reentrancy (violating checks-effects-interactions), missing onlyOwner access control, integer overflow on pre-0.8 Solidity without SafeMath, oracle manipulation, weak randomness from block.timestamp, unlimited approve/permit replay, and delegatecall proxy storage collisions.
  • DeFi & Infrastructure Attacks: Covers flash loan attacks, sandwich/front-running, governance attacks, signature replay, cross-chain bridge threshold bypass, and exposed RPC port 8545 allowing direct eth_sendTransaction.
  • Use Case: During an authorized audit of a DeFi lending protocol, use this Skill to systematically walk through reentrancy, oracle manipulation, and flash loan scenarios before reporting findings.

Quick Start

Ask the AI to audit a smart contract using the blockchain-contract-attack checklist, starting with slither analysis and a manual reentrancy review.

Frequently Asked Questions about blockchain-contract-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a smart contract for reentrancy vulnerabilities?▼

Reentrancy auditing checks whether a contract sends value via .call{value} before updating state, violating the checks-effects-interactions pattern. Combine manual review of external calls with static analyzers like slither to flag vulnerable functions.

What tools are used for smart contract static analysis?▼

Slither, mythril, and manticore are the standard tools for automated smart contract analysis. Slither performs fast static analysis, mythril uses symbolic execution, and manticore explores execution paths to detect deeper logic flaws.

How do I get verified contract source code from Etherscan?▼

Use the Etherscan getsourcecode API endpoint with the contract address to retrieve verified source code. This source can then be fed into slither or mythril for automated vulnerability scanning.

What is a flash loan oracle manipulation attack?▼

A flash loan attack borrows large capital with no collateral within one transaction to temporarily manipulate an AMM price that a protocol uses as its oracle. The attacker then exploits the distorted price for profit and repays the loan atomically.

Why is an exposed RPC port 8545 dangerous?▼

An exposed Ethereum RPC endpoint on port 8545 can allow attackers to call methods like eth_sendTransaction directly if accounts are unlocked. Nodes should restrict RPC access and never expose signing-capable endpoints publicly.

When should this blockchain attack checklist not be used?▼

This checklist should only be used on systems you own or are explicitly authorized to test. It is a reference of attack patterns for defensive auditing, not a substitute for a full professional audit of complex protocol logic.

Related Skills

Explore More Software Engineering Skills→
79yuuki79yuuki

smart-contract-audit

Audit Solidity smart contracts for high-severity loss-of-funds vulnerabilities.

Community
Advanced
commercetoolscommercetools
154

security-auditor

Audit code repositories for vulnerabilities and generate remediation reports.

Official
Advanced
Prohao42Prohao42
120

401-403-bypass-techniques

Bypass 401/403 access controls using path, method, header, and protocol techniques.

Community
Advanced
pashovpashov
1.1k

fizz

Generate and run fuzz tests for Solidity smart contracts using Echidna and Medusa.

Community
Advanced