token-integration-analyzer

Analyzes ERC20 and ERC721 token implementations and integrations against Trail of Bits security checklists.

Updated Apr 3, 2026
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill token-integration-analyzer-ayoub-ouederni
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: token-integration-analyzer
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/token-integration-analyzer
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill token-integration-analyzer-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Smart contract protocols frequently break or get exploited when interacting with non-standard tokens like USDT, fee-on-transfer tokens, or rebasing tokens. This Skill systematically audits token implementations and token integrations against Trail of Bits' token integration checklist and a database of 24 known weird ERC20 patterns, catching issues that standard ERC conformity checks miss. ## Core Features & Use Cases - Weird Token Pattern Detection: Checks for 24 known non-standard behaviors including missing return values, fee-on-transfer, rebasing, blocklists, flash minting, and approval race protections. - ERC20/ERC721 Conformity Analysis: Runs Slither-based checks (slither-check-erc, slither-prop) plus manual review of return values, decimals, metadata, and race condition mitigations. - Integration Safety Assessment: Verifies SafeERC20 usage, balance-before/after verification, allowlists, and defensive patterns when your protocol handles external tokens. - On-chain Scarcity Analysis: Queries deployed contracts for holder distribution, supply concentration, and exchange listings when given an address and RPC endpoint. - Use Case: Before launching a vault that accepts USDT, USDC, and DAI deposits, run this analysis to discover that USDT's missing return value causes silent transfer failures and that fee-on-transfer tokens would break your share accounting. ## Quick Start Analyze my Solidity codebase for token integration security issues, checking both my ERC20 implementation and how my vault handles external tokens like USDT.

Frequently Asked Questions about token-integration-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if my protocol handles weird ERC20 tokens safely?

Run a systematic check against the 24 known weird token patterns including missing return values, fee-on-transfer, rebasing, and blocklists. Verify SafeERC20 usage, balance-before/after accounting, and return value checks on every external token call.

How to audit an ERC20 token implementation for security issues?

Combine automated Slither checks (slither-check-erc, slither-prop) with manual review of owner privileges, minting caps, pausability, and upgradeability. Then verify conformity of return values, decimals type, and approval race condition mitigations.

Why does my token transfer fail silently with USDT?

USDT does not return a boolean from transfer and transferFrom, so standard IERC20 interfaces misread the result. Wrap all external token calls with OpenZeppelin's SafeERC20 library to handle missing return values correctly.

Does this analysis work without Slither installed?

Yes, the analysis can proceed without Slither by manually verifying all slither-check-erc criteria, though automated ERC conformity checks are recommended for Solidity projects. Any skipped automated checks are documented in the report.

Can I analyze an already deployed token contract?

Yes, provide the contract address and an RPC endpoint to query on-chain data including total supply, holder concentration, exchange distribution, pause status, and upgrade configuration. On-chain analysis is skipped if no address is provided.

What are the limitations of automated token security analysis?

Slither detects some patterns but misses integration logic flaws like incorrect share accounting with fee-on-transfer tokens. Manual review of all integration criteria and weird token patterns is required alongside automated tooling.