evm-defi-architect

The Skill runs a phased audit: scope and threat model first, then Slither for fast static analysis, Mythril for deeper symbolic execution on money-handling contracts, and a manual OWASP-based checklist review. Critical and High findings require an executable Foundry test demonstrating the exploit before being reported as confirmed.

Use Foundry testFuzz_ functions with vm.assume and bound() for parametric fuzzing, and invariant_ functions with a handler contract and ghost variables for stateful properties like solvency. The Skill generates both, targeting the specific risks identified in the threat model rather than generic fuzzing.

Yes, any EVM chain is supported by supplying a docs URL or markdown file with chain parameters. The Skill resolves chain ID, RPC, gas token, explorer verification API, and EVM-version quirks (such as missing Cancun opcodes on some L2s) before writing code.

Yes, a dedicated economic and game-theoretic review covers MEV exposure, flash-loan-funded price or governance manipulation, and cost-of-attack versus value-at-risk. Composed multi-step exploit chains across external dependencies are explicitly traced, per the OWASP 2026 incident pattern.

The Skill enforces a validation gate requiring executable proof-of-concept tests for Critical and High findings to reduce false positives, but it does not replace a human audit. The suite's own documentation states it has not been validated end-to-end against real deployed contracts and recommends comparison with professional audit firms.

Wallet handling is never assumed because key management is a major real-world loss category. The Skill asks each time whether to use a cast encrypted keystore, environment variable keys (local only), a hardware wallet for mainnet, or Anvil's public test accounts, and flags unsafe choices explicitly.