[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GS93740AYPVZSB8AVS29FN":3,"skill-same:01M6GS93740AYPVZSB8AVS29FN":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6GS93740AYPVZSB8AVS29FN","trailofbits-official-building-secure-contracts",null,"Brought to you by [Trail of Bits](https:\u002F\u002Fwww.trailofbits.com\u002F), this repository offers guidelines and best practices for developing secure smart contracts. Contributions are welcome, you can contribute by following our [contributing guidel","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Ftrailofbits-official-building-secure-contracts\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"secure","trailofbits official building secure contracts","building secure contracts","official","contracts","contribute","for","trail","can","you","offers","repository","https","contributing","best practices","guidelines","welcome","2026-11-10 10:12:30",false,"---\nname: trailofbits-official-building-secure-contracts\ndescription: \"Brought to you by [Trail of Bits](https:\u002F\u002Fwww.trailofbits.com\u002F), this repository offers guidelines and best practices for developing secure smart contracts. Contributions are welcome, you can contribute by following our [contributing guidel\"\n---\n\n# Building Secure Smart Contracts\n\n![](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Factions\u002Fworkflows\u002Fechidna.yml\u002Fbadge.svg) ![](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Factions\u002Fworkflows\u002Fmedusa.yml\u002Fbadge.svg)\n\nBrought to you by [Trail of Bits](https:\u002F\u002Fwww.trailofbits.com\u002F), this repository offers guidelines and best practices for developing secure smart contracts. Contributions are welcome, you can contribute by following our [contributing guidelines](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Fblob\u002Fmaster\u002FCONTRIBUTING.md).\n\n**Table of Contents:**\n\n- [Development Guidelines](.\u002Fdevelopment-guidelines)\n  - [Code Maturity](.\u002Fdevelopment-guidelines\u002Fcode_maturity.md): Criteria for developers and security engineers to use when evaluating a codebase’s maturity\n  - [High-Level Best Practices](.\u002Fdevelopment-guidelines\u002Fguidelines.md): Best practices for all smart contracts\n  - [Incident Response Recommendations](.\u002Fdevelopment-guidelines\u002Fincident_response.md): Guidelines for creating an incident response plan\n  - [Secure Development Workflow](.\u002Fdevelopment-guidelines\u002Fworkflow.md): A high-level process to follow during code development\n  - [Token Integration Checklist](.\u002Fdevelopment-guidelines\u002Ftoken_integration.md): What to check when interacting with arbitrary tokens\n- [Learn EVM](.\u002Flearn_evm): Technical knowledge about the EVM\n  - [EVM Opcodes](.\u002Flearn_evm\u002Fevm_opcodes.md): Information on all EVM opcodes\n  - [Transaction Tracing](.\u002Flearn_evm\u002Ftracing.md): Helper scripts and guidance for generating and navigating transaction traces\n  - [Arithmetic Checks](.\u002Flearn_evm\u002Farithmetic-checks.md): A guide to performing arithmetic checks in the EVM\n  - [Yellow Paper Guidance](.\u002Flearn_evm\u002Fyellow-paper.md): Symbol reference for easier reading of the Ethereum yellow paper\n  - [Forks \u003C> EIPs](.\u002Flearn_evm\u002Feips_forks.md): Summaries of the EIPs included in each Ethereum fork\n    - [Forks \u003C> CIPs](.\u002Flearn_evm\u002Fcips_forks.md): Summaries of the CIPs and EIPs included in each Celo fork _(EVM-compatible chain)_\n    - [Upgrades \u003C> TIPs](.\u002Flearn_evm\u002Ftips_upgrades.md): Summaries of the TIPs included in each TRON upgrade _(EVM-compatible chain)_\n    - [Forks \u003C> BEPs](.\u002Flearn_evm\u002Fbeps_forks.md): Summaries of the BEPs included in each BSC fork _(EVM-compatible chain)_\n- [Not So Smart Contracts](.\u002Fnot-so-smart-contracts): Examples of common smart contract issues, complete with descriptions, examples, and recommendations\n  - [Algorand](.\u002Fnot-so-smart-contracts\u002Falgorand)\n  - [Cairo](.\u002Fnot-so-smart-contracts\u002Fcairo)\n  - [Cosmos](.\u002Fnot-so-smart-contracts\u002Fcosmos)\n  - [Substrate](.\u002Fnot-so-smart-contracts\u002Fsubstrate)\n  - [Solana](.\u002Fnot-so-smart-contracts\u002Fsolana)\n  - [Sui](.\u002Fnot-so-smart-contracts\u002Fsui)\n  - [TON](.\u002Fnot-so-smart-contracts\u002Fton)\n- [Program Analysis](.\u002Fprogram-analysis): Using automated tools to secure contracts\n  - [Echidna](.\u002Fprogram-analysis\u002Fechidna): A fuzzer that checks your contract's properties\n  - [Medusa](.\u002Fprogram-analysis\u002Fmedusa\u002Fdocs\u002Fsrc): A next-gen fuzzer that checks your contract's properties\n  - [Slither](.\u002Fprogram-analysis\u002Fslither\u002Fdocs\u002Fsrc\u002F): A static analyzer with both CLI and scriptable interfaces\n  - [Manticore](.\u002Fprogram-analysis\u002Fmanticore): A symbolic execution engine that proves the correctness of properties\n  - For each tool, this training material provides:\n    - A theoretical introduction, an API walkthrough, and a set of exercises\n    - Exercises that take approximately two hours to gain practical understanding\n- [Resources](.\u002Fresources): Assorted online resources\n  - [Trail of Bits Blog Posts](.\u002Fresources\u002Ftob_blogposts.md): A list of blockchain-related blog posts created by Trail of Bits\n\n# License\n\nsecure-contracts and building-secure-contracts are licensed and distributed under the [AGPLv3 license](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Fblob\u002Fmaster\u002FLICENSE). Contact us if you're looking for an exception to the terms.\n","# Building Secure Smart Contracts\n\n![](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Factions\u002Fworkflows\u002Fechidna.yml\u002Fbadge.svg) ![](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Factions\u002Fworkflows\u002Fmedusa.yml\u002Fbadge.svg)\n\nBrought to you by [Trail of Bits](https:\u002F\u002Fwww.trailofbits.com\u002F), this repository offers guidelines and best practices for developing secure smart contracts. Contributions are welcome, you can contribute by following our [contributing guidelines](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Fblob\u002Fmaster\u002FCONTRIBUTING.md).\n\n**Table of Contents:**\n\n- [Development Guidelines](.\u002Fdevelopment-guidelines)\n  - [Code Maturity](.\u002Fdevelopment-guidelines\u002Fcode_maturity.md): Criteria for developers and security engineers to use when evaluating a codebase’s maturity\n  - [High-Level Best Practices](.\u002Fdevelopment-guidelines\u002Fguidelines.md): Best practices for all smart contracts\n  - [Incident Response Recommendations](.\u002Fdevelopment-guidelines\u002Fincident_response.md): Guidelines for creating an incident response plan\n  - [Secure Development Workflow](.\u002Fdevelopment-guidelines\u002Fworkflow.md): A high-level process to follow during code development\n  - [Token Integration Checklist](.\u002Fdevelopment-guidelines\u002Ftoken_integration.md): What to check when interacting with arbitrary tokens\n- [Learn EVM](.\u002Flearn_evm): Technical knowledge about the EVM\n  - [EVM Opcodes](.\u002Flearn_evm\u002Fevm_opcodes.md): Information on all EVM opcodes\n  - [Transaction Tracing](.\u002Flearn_evm\u002Ftracing.md): Helper scripts and guidance for generating and navigating transaction traces\n  - [Arithmetic Checks](.\u002Flearn_evm\u002Farithmetic-checks.md): A guide to performing arithmetic checks in the EVM\n  - [Yellow Paper Guidance](.\u002Flearn_evm\u002Fyellow-paper.md): Symbol reference for easier reading of the Ethereum yellow paper\n  - [Forks \u003C> EIPs](.\u002Flearn_evm\u002Feips_forks.md): Summaries of the EIPs included in each Ethereum fork\n    - [Forks \u003C> CIPs](.\u002Flearn_evm\u002Fcips_forks.md): Summaries of the CIPs and EIPs included in each Celo fork _(EVM-compatible chain)_\n    - [Upgrades \u003C> TIPs](.\u002Flearn_evm\u002Ftips_upgrades.md): Summaries of the TIPs included in each TRON upgrade _(EVM-compatible chain)_\n    - [Forks \u003C> BEPs](.\u002Flearn_evm\u002Fbeps_forks.md): Summaries of the BEPs included in each BSC fork _(EVM-compatible chain)_\n- [Not So Smart Contracts](.\u002Fnot-so-smart-contracts): Examples of common smart contract issues, complete with descriptions, examples, and recommendations\n  - [Algorand](.\u002Fnot-so-smart-contracts\u002Falgorand)\n  - [Cairo](.\u002Fnot-so-smart-contracts\u002Fcairo)\n  - [Cosmos](.\u002Fnot-so-smart-contracts\u002Fcosmos)\n  - [Substrate](.\u002Fnot-so-smart-contracts\u002Fsubstrate)\n  - [Solana](.\u002Fnot-so-smart-contracts\u002Fsolana)\n  - [Sui](.\u002Fnot-so-smart-contracts\u002Fsui)\n  - [TON](.\u002Fnot-so-smart-contracts\u002Fton)\n- [Program Analysis](.\u002Fprogram-analysis): Using automated tools to secure contracts\n  - [Echidna](.\u002Fprogram-analysis\u002Fechidna): A fuzzer that checks your contract's properties\n  - [Medusa](.\u002Fprogram-analysis\u002Fmedusa\u002Fdocs\u002Fsrc): A next-gen fuzzer that checks your contract's properties\n  - [Slither](.\u002Fprogram-analysis\u002Fslither\u002Fdocs\u002Fsrc\u002F): A static analyzer with both CLI and scriptable interfaces\n  - [Manticore](.\u002Fprogram-analysis\u002Fmanticore): A symbolic execution engine that proves the correctness of properties\n  - For each tool, this training material provides:\n    - A theoretical introduction, an API walkthrough, and a set of exercises\n    - Exercises that take approximately two hours to gain practical understanding\n- [Resources](.\u002Fresources): Assorted online resources\n  - [Trail of Bits Blog Posts](.\u002Fresources\u002Ftob_blogposts.md): A list of blockchain-related blog posts created by Trail of Bits\n\n# License\n\nsecure-contracts and building-secure-contracts are licensed and distributed under the [AGPLv3 license](https:\u002F\u002Fgithub.com\u002Fcrytic\u002Fbuilding-secure-contracts\u002Fblob\u002Fmaster\u002FLICENSE). Contact us if you're looking for an exception to the terms.\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fdev-tools\u002Ftrailofbits-official-building-secure-contracts",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-12 02:28:42",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill trailofbits-official-building-secure-contracts",{"tool":56,"command":57},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill trailofbits-official-building-secure-contracts",{"tool":59,"command":60},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill trailofbits-official-building-secure-contracts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Ftrailofbits-official-building-secure-contracts\u002FSKILL.md",true,[64,70,74],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"_meta.json","REFERENCE","参考文档",510,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Ftrailofbits-official-building-secure-contracts\u002F_meta.json",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"SOURCE.md",346,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Ftrailofbits-official-building-secure-contracts\u002FSOURCE.md",{"path":75,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":76,"sourceHtmlUrl":77},"TRUST.auto.yaml",2217,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdev-tools\u002Ftrailofbits-official-building-secure-contracts\u002FTRUST.auto.yaml",[79,108,130,147,160,170],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":84,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":36},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":113,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":36},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[117,118,119,120,121,122,123,124,125,126,25,127,128,129],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","api keys","maintenance","protobuf",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":36},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[138,118,139,140,141,142,143,127,25,126,144,19,145,122,146,121,120],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","data","orders",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":151,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":36},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[155,156,119,157,158,128,25,159,125,124,122,121],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":161,"name":162,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":163,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":36},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[167,168,169],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":174,"sourceHtmlUrl":175,"categories":176,"keywords":177,"publishedAt":36},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[178,179,180,181,182,183,184,185,186,187,188],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","use","patch","code","share"]