web3-audit

Identify smart contract vulnerabilities across Solidity and Rust DeFi targets.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/venkatas/obsidian --skill web3-audit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web3-audit
Source: https://github.com/venkatas/obsidian/tree/main/skills/web3-audit
Command: npx skills add https://github.com/venkatas/obsidian --skill web3-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Smart contracts in DeFi carry substantial risk due to a wide range of vulnerability classes. This Skill provides a structured, repeatable framework to identify, classify, and prioritize issues before deployment, using kill signals, templates, and practical patterns. It is intended for security engineers, auditors, and product teams evaluating Solidity/Rust targets for potential exploits.

Core Features & Use Cases

  • Covering 10 bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy)
  • Pre-dive kill signals to quickly assess engagement viability
  • Foundry PoC template to demonstrate exploits and validation steps
  • Grep patterns for rapid code search and triage
  • Real Immunefi paid examples for context and learning

Quick Start

Apply the Foundry PoC template to your Solidity targets and run the grep patterns to surface common vulnerability classes.

Frequently Asked Questions about web3-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit smart contracts for common DeFi vulnerabilities?

To audit smart contracts for DeFi vulnerabilities, you need a structured framework covering 10 bug classes like reentrancy, oracle manipulation, and access control. This Skill guides testers through these classes using kill signals and practical PoC templates to identify and remediate issues before deployment.

What grep patterns help find Solidity security bugs?

Specific grep patterns rapidly search and triage Solidity code for security bugs by targeting known vulnerability signatures. This Skill provides actionable grep patterns designed to surface issues across 10 DeFi bug classes, including accounting desync, incomplete path, and signature replay.

How do I write a Foundry PoC to validate a DeFi exploit?

Writing a Foundry PoC to validate a DeFi exploit requires templates that demonstrate the vulnerability execution and validation steps. This Skill provides a ready-to-use Foundry PoC template to map findings to real Immunefi-style examples for structured threat coverage.

Can I use this audit framework for Rust DeFi targets?

Yes, this audit framework supports Rust DeFi targets alongside Solidity for comprehensive protocol security testing. It guides security engineers through identifying and remediating vulnerabilities across both languages using pre-dive kill signals and production-ready checks.

What are pre-dive kill signals in a smart contract audit?

Pre-dive kill signals in a smart contract audit are indicators used to quickly assess engagement viability before committing deep testing resources. This Skill utilizes these signals to help auditors and product teams rapidly evaluate Solidity and Rust DeFi targets for potential exploits.

What bug classes should I check for in an ERC4626 vault audit?

An ERC4626 vault audit should check for specific bug classes including accounting desync, oracle manipulation, and flash loan attacks. This Skill structures threat coverage across 10 critical DeFi vulnerability classes to ensure production-ready checks and comprehensive security validation.