smart-contract-vulnerabilities

Detect exploitable vulnerability patterns in Solidity/EVM smart contracts.

5|2|Updated May 16, 2026
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill smart-contract-vulnerabilities-doriangallo
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: smart-contract-vulnerabilities
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/smart-contract-vulnerabilities
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill smart-contract-vulnerabilities-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you audit Solidity/EVM smart contracts by systematically identifying high-impact vulnerability classes that commonly lead to lost funds, broken invariants, and exploitable control-flow.

Core Features & Use Cases

  • Reentrancy playbooks: Diagnose single-function, cross-function, cross-contract, and read-only reentrancy paths, including realistic DeFi callback scenarios.
  • Arithmetic & access control checks: Detect overflow/underflow risks (including unchecked blocks and casting/assembly pitfalls) plus authorization flaws like tx.origin misuse and unprotected critical functions.
  • Attack surface coverage for modern patterns: Review delegatecall/proxy storage collisions, randomness manipulation, signature replay, MEV/front-running exposure, CREATE2 deterministic exploitation, and flash-loan manipulation.

Quick Start

Ask an AI: "Use smart-contract-vulnerabilities to produce a prioritized audit checklist for a Solidity ERC-20 + proxy upgrade path, including reentrancy, delegatecall storage collisions, signature replay, and MEV considerations."

Frequently Asked Questions about smart-contract-vulnerabilities

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Solidity smart contract for reentrancy and delegatecall vulnerabilities?

To audit for reentrancy and delegatecall vulnerabilities, you systematically trace external calls and proxy storage collisions. This approach maps each exploit condition to concrete mitigations using decision-tree routing and hands-on tooling guidance for validation.

What is a signature replay attack and how does it affect EVM smart contracts?

A signature replay attack in EVM smart contracts occurs when an authorized signature is reused to execute unauthorized actions. Detecting this requires reviewing signature-based authorization flows against deterministic deployment and MEV-related execution ordering patterns.

How do I check my proxy contract for storage collisions during an upgrade path?

Checking proxy contracts for storage collisions involves reviewing delegatecall implementation patterns against your upgrade path. You generate a prioritized audit checklist covering reentrancy, delegatecall storage layouts, and MEV considerations to ensure invariant protection.

Can I detect MEV and front-running exposure in my DeFi smart contract?

You can detect MEV and front-running exposure by analyzing execution ordering and transaction simulation within your DeFi smart contract. The review identifies exploitable control-flow patterns across real-world DeFi workflows and deterministic deployment scenarios.

Does this smart contract security audit cover arithmetic overflow and access control flaws?

Yes, this smart contract security audit covers arithmetic overflow and access control flaws. It detects unchecked block risks, casting and assembly pitfalls, tx.origin misuse, and unprotected critical functions to prevent lost funds and broken invariants.

What are the limitations of using automated vulnerability detection for CREATE2 and flash-loan manipulation?

Automated vulnerability detection for CREATE2 and flash-loan manipulation requires mapping deterministic exploitation and execution ordering patterns. Limitations arise when complex cross-contract reentrancy paths need manual validation against realistic DeFi callback scenarios.