skills.rest
tawf-labs
tawf-labsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security

Mitigate smart contract risks with defensive Solidity patterns and a pre-deploy audit checklist.

1|Updated Jan 24, 2026
Search Tags:#solidity#reentrancy#smart contract security#upgradeable contracts#oracle safety#safeERC20#MEV protection
One-click install
npx skills add https://github.com/tawf-labs/zkt-hackathon --skill security-tawf-labs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/tawf-labs/zkt-hackathon/tree/main/.agents/skills/ethskills/security
Command: npx skills add https://github.com/tawf-labs/zkt-hackathon --skill security-tawf-labs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It reduces the risk of losing funds and getting hacked by teaching concrete Solidity security patterns, showing the most common vulnerabilities, and providing defensive implementations you can apply before deployment.

Core Features & Use Cases

  • Defensive implementations for common vulnerabilities: Reentrancy-safe withdrawal patterns (CEI + nonReentrant), safe token transfers/approvals via SafeERC20, and strict input validation to prevent zero-address/zero-amount and bounds issues.
  • Protocol-risk guidance for onchain integrations: Oracle safety (avoid DEX spot prices, use Chainlink/TWAP with staleness checks), MEV/sandwich defenses (explicit amountOutMinimum, private RPC routing), and ERC-4626 vault inflation mitigations (virtual offsets).
  • Pre-deploy audit checklist: A repeatable run-through covering access control, oracle safety, integer math correctness, event emission, proxy/upgrade safety (initializer usage, storage layout, multisig upgrade authority), signature replay safety (EIP-712), and delegatecall constraints.

Quick Start

Use the security skill to review a contract intended for value custody by going through the pre-deploy checklist and updating the identified weak spots before you deploy.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent reentrancy attacks in my Solidity smart contract?▼

Prevent reentrancy attacks in Solidity by applying the Checks-Effects-Interactions pattern and adding a nonReentrant modifier to functions handling ETH or ERC-20 transfers.

What is the best way to secure oracle price feeds against manipulation?▼

The best way to secure oracle price feeds is to avoid DEX spot prices and use Chainlink or TWAP oracles with strict staleness checks to prevent manipulation.

How do I run a pre-deploy audit checklist for upgradeable contracts?▼

Run a pre-deploy audit checklist for upgradeable contracts by verifying initializer usage, storage layout compatibility, multisig upgrade authority, proxy safety, and delegatecall constraints.

Does SafeERC20 protect against zero-address token transfer errors?▼

SafeERC20 protects against silent transfer failures, but you must implement strict input validation separately to prevent zero-address and zero-amount errors in Solidity.

How do I stop EIP-712 signature replay attacks in smart contracts?▼

Stop EIP-712 signature replay attacks in smart contracts by enforcing nonce tracking, verifying chain IDs, and applying strict replay controls within signature-based action logic.

Can I use specific amountOutMinimum parameters for MEV sandwich protection?▼

Yes, you can use explicit amountOutMinimum parameters to defend against MEV sandwich attacks and route transactions through private RPCs to prevent front-running.

Related Skills

Explore More Software Engineering Skills→
hopefulobjecthopefulobject

erc-20

Integrate ERC-20 token contracts into Scaffold-ETH 2 projects with deployment and frontend guidance.

Community
Advanced
bomberoxenviosdosruedasbomberoxenviosdosruedas

agency-blockchain-security-auditor

Identify Solidity smart contract vulnerabilities using Slither, Mythril, and Echidna for DeFi protocols.

Community
Advanced
cyoteecyotee

Euler Oracle System

Automate price quoting for base/quote pairs via a modular oracle router.

Community
Advanced
freeslugsfreeslugs

security

Review Solidity smart contracts for vulnerabilities and pre-deployment audit checks.

Community
Advanced