security

Enforce defensive patterns and audit checklists for Solidity smart contracts.

7|Updated Apr 4, 2026
One-click install
npx skills add https://github.com/Zodomo/DrandVerifier --skill security-zodomo
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/Zodomo/DrandVerifier/tree/main/.opencode/skills/ethskills/security
Command: npx skills add https://github.com/Zodomo/DrandVerifier --skill security-zodomo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Solidity projects often fail security reviews not because of one obvious bug, but due to common implementation mistakes that enable loss of funds, privilege escalation, replay attacks, or oracle/MEV exploitation.

Core Features & Use Cases

  • Critical vulnerability patterns covering decimals mistakes, unsafe math, reentrancy, token quirks, MEV/sandwich issues, and access control failures.
  • Defensive implementation guidance using established safe patterns like CEI + reentrancy guards, SafeERC20, bounded approvals, and strict input validation.
  • Deployment-grade checklist that helps teams run consistent static analysis, fuzzing, verification steps, and verify critical edge cases before going live.

Quick Start

Use this security guide to audit a Solidity contract you plan to deploy, then verify that each checklist item (especially reentrancy, oracle safety, approvals, access control, and upgrade/storage safety) is explicitly satisfied.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is a pre-deploy audit checklist for Solidity smart contracts?

A pre-deploy audit checklist for Solidity smart contracts codifies high-impact defensive patterns, verifying reentrancy protections, oracle safety, access control, and correct numeric handling before mainnet deployment to prevent loss of funds.

How do I prevent reentrancy and MEV exploitation in Solidity?

To prevent reentrancy and MEV exploitation in Solidity, enforce Checks-Effects-Interactions (CEI) patterns, apply reentrancy guards, and implement explicit MEV mitigation and oracle safety controls before contract deployment.

How do I secure ERC20 token interactions and proxy upgrades?

Secure ERC20 token interactions and proxy upgrades by using SafeERC20 for token quirks, enforcing bounded approvals, applying strict input validation, and verifying upgrade and storage safety for proxy patterns.

When do I need SafeERC20 and strict input validation in smart contracts?

You need SafeERC20 and strict input validation in smart contracts interacting with ERC20 tokens, signing schemes, or external dependencies like oracles and DEX swaps to prevent decimals mistakes and privilege escalation.

Does this security checklist cover static analysis and fuzzing steps?

Yes, this deployment-grade security checklist helps teams run consistent static analysis, fuzzing, and verification steps, ensuring critical edge cases and defensive patterns are explicitly satisfied before going live.

What are common Solidity security vulnerabilities to check before deployment?

Common Solidity security vulnerabilities include decimals mistakes, unsafe math, reentrancy, MEV sandwich issues, oracle exploitation, replay attacks, and access control failures that enable loss of funds.