web3-audit

Identify critical security vulnerabilities in Solidity and Rust smart contracts.

1.1k|191|Updated Jun 24, 2026
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill web3-audit-uphiago
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web3-audit
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/web3-audit
Command: npx skills add https://github.com/uphiago/recon-skills --skill web3-audit-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the risk of missing critical smart contract vulnerabilities in DeFi protocols that can lead to catastrophic financial losses, and helps security researchers identify high-impact bugs to earn legitimate bug bounties.

Core Features & Use Cases

  • 10 Core DeFi Bug Classes: Covers accounting desync, access control, reentrancy, flash loan attacks, oracle manipulation, and other high-severity vulnerability types with real Immunefi paid examples.
  • Pre-Dive Target Filtering: Kill signals and scoring rubric to skip low-value engagements (e.g., low TVL, already well-audited protocols) and focus on high-ROI targets.
  • Audit Tooling Templates: Includes Foundry proof-of-concept templates, grep patterns for automated bug detection, and 2026-specific operator notes for current DeFi attack surfaces.
  • Use Case: Ideal for authorized smart contract audits, DeFi bug bounty hunting on platforms like Immunefi, and triaging new protocol targets before committing to a full code review.

Quick Start

Use the web3-audit skill to review the target DeFi protocol's Solidity smart contracts for critical vulnerabilities and generate a compliant Foundry proof-of-concept for any confirmed findings.

Frequently Asked Questions about web3-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify critical vulnerabilities in Solidity smart contracts for DeFi protocols?

Identify critical vulnerabilities in Solidity smart contracts by applying grep patterns and Foundry proof-of-concept templates to detect 10 core DeFi bug classes like reentrancy, flash loan attacks, and oracle manipulation. This process filters low-value targets and generates compliant Immunefi reports.

What are the most common DeFi smart contract bug classes I should look for during an audit?

Common DeFi smart contract bug classes include accounting desync, access control flaws, reentrancy, flash loan attacks, and oracle manipulation. Reviewing documented real-world Immunefi examples helps understand these high-severity vulnerabilities before code review.

How do I generate a Foundry proof-of-concept for a smart contract vulnerability?

Generate a Foundry proof-of-concept for smart contract vulnerabilities by utilizing provided audit tooling templates. These templates help construct compliant exploits that confirm findings for authorized bug bounty reports on platforms like Immunefi.

How can I triage DeFi bug bounty targets to skip low-value engagements?

Triage DeFi bug bounty targets by applying a pre-dive scoring rubric and evaluating kill signals. This filters out low TVL or already well-audited protocols, allowing you to focus on high-ROI targets before committing to a full code review.

Does this smart contract audit approach work for Rust DeFi protocols?

Yes, this smart contract audit approach identifies critical security vulnerabilities in both Solidity and Rust smart contracts for DeFi protocols. It applies documented bug classes and automated detection patterns across both languages.

What is the best way to automate vulnerability scanning for DeFi smart contracts?

The best way to automate vulnerability scanning for DeFi smart contracts is using targeted grep patterns for automated bug detection. Combined with pre-dive target filtering, this efficiently surfaces critical flaws before manual code review.