cosmwasm-defi-architect

Designs, codes, tests, audits, and deploys CosmWasm DeFi smart contracts on Cosmos chains.

Updated Aug 25, 2026
One-click install
npx skills add https://github.com/Shahnilsharma/smart-contracts-auditor-skill --skill cosmwasm-defi-architect-shahnilsharma
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cosmwasm-defi-architect
Source: https://github.com/Shahnilsharma/smart-contracts-auditor-skill/tree/main/plugins/cosmwasm-defi-architect/skills
Command: npx skills add https://github.com/Shahnilsharma/smart-contracts-auditor-skill --skill cosmwasm-defi-architect-shahnilsharma

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @cosmjs/proto-signing, @cosmjs/cosmwasm-stargate, and includes scripts (resource) and references (resource) components.

What problem does it solve? Building a DeFi protocol on a Cosmos chain requires expertise across contract architecture, Rust/CosmWasm coding, adversarial testing, security auditing, and chain-specific deployment — a workflow most teams handle with fragmented tools and expensive external audits. This Skill runs the full pipeline from threat modeling through deployment verification in one guided process. ## Core Features & Use Cases - Full-lifecycle pipeline: scope and threat model with an impact×likelihood risk matrix, architecture design, production Rust CosmWasm code with checked arithmetic, cw-multitest Rust tests plus a role-based Node/CosmJS QA runner, an agency-grade audit (static analysis, manual checklist, economic review, PoC validation gate), fix-review, and CLI deployment with verification. - Chain-flexible targeting: defaults to ZIGChain with documented chain-id, RPC, denom, and whitelisting parameters, and accepts any other Cosmos chain via a docs URL or markdown file. - Professional deliverables: generates audit reports with severity-rated findings, an OWASP SC Top 10 coverage traceability matrix, and an optional formatted .docx report; supports a multi-agent team mode with architect/engineer/QA/auditor roles. - Use Case: Ask it to design and audit a lending protocol on ZIGChain — it produces the contract source, Rust and Node test suites, an audit report with validated findings, and a testnet deployment script. ## Quick Start Ask the assistant to design, test, and audit a CosmWasm staking contract for deployment on the ZIGChain testnet.

Frequently Asked Questions about cosmwasm-defi-architect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a CosmWasm smart contract for security vulnerabilities?

Run the audit pass, which combines cargo clippy and cargo audit with a manual checklist covering access control, checked arithmetic, reentrancy via submessages, oracle staleness, and governance bypass. Critical and High findings require an executable proof-of-concept test before being reported as confirmed.

How do I deploy a CosmWasm contract to ZIGChain testnet?

Use the included deploy.sh script, which stores the wasm, instantiates it, runs a smoke execute, and verifies via query against the zig-test-2 chain. Note that ZIGChain whitelist-gates contract uploads, so your address must be whitelisted before the store step.

Can I use this with Cosmos chains other than ZIGChain?

Yes, supply a chain documentation URL or markdown file and the skill extracts the chain-id, RPC endpoints, denom, gas price, and CosmWasm version for that target. The snapshot is written to your project workspace rather than the skill's own folder.

What testing frameworks does it use for CosmWasm contracts?

It generates Rust integration tests with cw-multitest covering happy paths and adversarial cases per execute branch, plus a sequential Node QA runner using CosmJS against a live testnet with role-based wallets. A final invariant check compares contract balance against the internal ledger.

Does it support mainnet deployment?

Mainnet deployment requires an explicit user request and a CONFIRM_MAINNET=yes flag in the deploy script, which otherwise hard-stops. It also warns if the contract admin defaults to a single deployer key instead of a multisig or governance address.

What are the limitations of an AI-generated smart contract audit?

The suite's own documentation states it has been statically reviewed but not validated end-to-end against real deployed contracts, and that AI-only scanning has documented false-positive and false-negative rates. It should not be treated as a substitute for a human audit of high-value contracts.