VanaraVANARAagentsSubscribe — $10/mo
proskillv2.0.0✓ verified

smart-contract-security

Deep reference for securing Solidity/EVM smart contracts — reentrancy, access control, oracle/price manipulation, integer over/underflow, delegatecall, unchecked external calls, and front-running/MEV — with vulnerable-vs-fixed code, an audit checklist, fuzzing guidance, and a runnable vuln scanner.

$npx vanara install smart-contract-security

Included with Vanara Pro ($10/mo) — unlocks all 206 items. See pricing →

Overview

On-chain code is adversarial by default: it is public, immutable once deployed, and directly custodies value, so every bug is a standing bounty for an attacker. Billions have been lost to a short, well-known list of vulnerability classes. This skill is the deep reference for finding and defending them — the mental model, the concrete patterns, the trade-offs, and the mistakes that keep recurring.

What it covers

Details

Tier
Pro — $10/mo
Version
2.0.0
Depth
4 references · 2 examples · 1 runnable scripts
Verification
1/1 runnable checks passing ✓
Runs on
Your own Claude Code — no API keys
api-paginationImplement correct, fast API pagination — cursor vs offset trade-offs, opaque cursor encoding, stable sort keys, page-size limits, total-count costs, and consumer-side iteration that survives inserts, deletes, and retries. With runnable cursor checks.app-store-optimizationHow to optimize an app-store listing (ASO) for discovery and conversion — title, subtitle, keywords, screenshots, icon, ratings, and the metadata that drives installs. A deep reference with worked Apple and Google listings and a runnable listing linter.audit-loggingDesign tamper-evident audit logs that satisfy security and compliance — what to record (who/what/when/where/outcome), what to never log (secrets/PII), structured immutable events, hash-chaining for tamper-evidence, retention, and access control. A deep reference with runnable validation.background-jobsDesign background job systems that don't lose or double work — enqueue-after-commit, retry policies with jitter, idempotent handlers, visibility timeouts, priority lanes, scheduled and recurring jobs, worker scaling, and observability for async work. With a runnable retry-policy check.backup-and-recoveryDesign and operate a tested backup and disaster-recovery strategy — the 3-2-1 rule, RPO/RTO targets, full vs incremental vs differential, point-in-time recovery, encryption, offsite/immutable copies, retention, and the restore drills that prove a backup actually works.c4-diagrammingDocument software architecture with the C4 model (Context, Container, Component, Code) as text-based diagrams in version control. Covers the four abstraction levels, notation discipline, when to draw each level (and when to stop), supplementary diagrams, and Mermaid/Structurizr tooling.
← All skills