[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M70JK9DG36CD5VRR6NESRFCN":3,"skill-same:01M70JK9DG36CD5VRR6NESRFCN":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M70JK9DG36CD5VRR6NESRFCN","solidity-security",null,"Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.","shengdabai\u002FTony-Claude-Code-Skills","shengdabai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116417419?v=4","01M70F6D2WY5PQV5A92BKYJQEW","Tony Sheng","01M70F6D3GAAAYZ5H4CC1G8VXM",3,"MIT","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fblockchain-web3\u002Fskills\u002Fsolidity-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"solidity","security","solidity security","best practices","Existing","use","contract","applications","for","blockchain","contracts","patterns","security best practices","master","secure","common","when","smart contract","writing","implementing","2026-11-10 10:12:30",false,"---\nname: solidity-security\ndescription: Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.\n---\n\n# Solidity Security\n\nMaster smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.\n\n## When to Use This Skill\n\n- Writing secure smart contracts\n- Auditing existing contracts for vulnerabilities\n- Implementing secure DeFi protocols\n- Preventing reentrancy, overflow, and access control issues\n- Optimizing gas usage while maintaining security\n- Preparing contracts for professional audits\n- Understanding common attack vectors\n\n## Critical Vulnerabilities\n\n### 1. Reentrancy\nAttacker calls back into your contract before state is updated.\n\n**Vulnerable Code:**\n```solidity\n\u002F\u002F VULNERABLE TO REENTRANCY\ncontract VulnerableBank {\n    mapping(address => uint256) public balances;\n\n    function withdraw() public {\n        uint256 amount = balances[msg.sender];\n\n        \u002F\u002F DANGER: External call before state update\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success);\n\n        balances[msg.sender] = 0;  \u002F\u002F Too late!\n    }\n}\n```\n\n**Secure Pattern (Checks-Effects-Interactions):**\n```solidity\ncontract SecureBank {\n    mapping(address => uint256) public balances;\n\n    function withdraw() public {\n        uint256 amount = balances[msg.sender];\n        require(amount > 0, \"Insufficient balance\");\n\n        \u002F\u002F EFFECTS: Update state BEFORE external call\n        balances[msg.sender] = 0;\n\n        \u002F\u002F INTERACTIONS: External call last\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n**Alternative: ReentrancyGuard**\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Fsecurity\u002FReentrancyGuard.sol\";\n\ncontract SecureBank is ReentrancyGuard {\n    mapping(address => uint256) public balances;\n\n    function withdraw() public nonReentrant {\n        uint256 amount = balances[msg.sender];\n        require(amount > 0, \"Insufficient balance\");\n\n        balances[msg.sender] = 0;\n\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n### 2. Integer Overflow\u002FUnderflow\n\n**Vulnerable Code (Solidity \u003C 0.8.0):**\n```solidity\n\u002F\u002F VULNERABLE\ncontract VulnerableToken {\n    mapping(address => uint256) public balances;\n\n    function transfer(address to, uint256 amount) public {\n        \u002F\u002F No overflow check - can wrap around\n        balances[msg.sender] -= amount;  \u002F\u002F Can underflow!\n        balances[to] += amount;          \u002F\u002F Can overflow!\n    }\n}\n```\n\n**Secure Pattern (Solidity >= 0.8.0):**\n```solidity\n\u002F\u002F Solidity 0.8+ has built-in overflow\u002Funderflow checks\ncontract SecureToken {\n    mapping(address => uint256) public balances;\n\n    function transfer(address to, uint256 amount) public {\n        \u002F\u002F Automatically reverts on overflow\u002Funderflow\n        balances[msg.sender] -= amount;\n        balances[to] += amount;\n    }\n}\n```\n\n**For Solidity \u003C 0.8.0, use SafeMath:**\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Futils\u002Fmath\u002FSafeMath.sol\";\n\ncontract SecureToken {\n    using SafeMath for uint256;\n    mapping(address => uint256) public balances;\n\n    function transfer(address to, uint256 amount) public {\n        balances[msg.sender] = balances[msg.sender].sub(amount);\n        balances[to] = balances[to].add(amount);\n    }\n}\n```\n\n### 3. Access Control\n\n**Vulnerable Code:**\n```solidity\n\u002F\u002F VULNERABLE: Anyone can call critical functions\ncontract VulnerableContract {\n    address public owner;\n\n    function withdraw(uint256 amount) public {\n        \u002F\u002F No access control!\n        payable(msg.sender).transfer(amount);\n    }\n}\n```\n\n**Secure Pattern:**\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Faccess\u002FOwnable.sol\";\n\ncontract SecureContract is Ownable {\n    function withdraw(uint256 amount) public onlyOwner {\n        payable(owner()).transfer(amount);\n    }\n}\n\n\u002F\u002F Or implement custom role-based access\ncontract RoleBasedContract {\n    mapping(address => bool) public admins;\n\n    modifier onlyAdmin() {\n        require(admins[msg.sender], \"Not an admin\");\n        _;\n    }\n\n    function criticalFunction() public onlyAdmin {\n        \u002F\u002F Protected function\n    }\n}\n```\n\n### 4. Front-Running\n\n**Vulnerable:**\n```solidity\n\u002F\u002F VULNERABLE TO FRONT-RUNNING\ncontract VulnerableDEX {\n    function swap(uint256 amount, uint256 minOutput) public {\n        \u002F\u002F Attacker sees this in mempool and front-runs\n        uint256 output = calculateOutput(amount);\n        require(output >= minOutput, \"Slippage too high\");\n        \u002F\u002F Perform swap\n    }\n}\n```\n\n**Mitigation:**\n```solidity\ncontract SecureDEX {\n    mapping(bytes32 => bool) public usedCommitments;\n\n    \u002F\u002F Step 1: Commit to trade\n    function commitTrade(bytes32 commitment) public {\n        usedCommitments[commitment] = true;\n    }\n\n    \u002F\u002F Step 2: Reveal trade (next block)\n    function revealTrade(\n        uint256 amount,\n        uint256 minOutput,\n        bytes32 secret\n    ) public {\n        bytes32 commitment = keccak256(abi.encodePacked(\n            msg.sender, amount, minOutput, secret\n        ));\n        require(usedCommitments[commitment], \"Invalid commitment\");\n        \u002F\u002F Perform swap\n    }\n}\n```\n\n## Security Best Practices\n\n### Checks-Effects-Interactions Pattern\n```solidity\ncontract SecurePattern {\n    mapping(address => uint256) public balances;\n\n    function withdraw(uint256 amount) public {\n        \u002F\u002F 1. CHECKS: Validate conditions\n        require(amount \u003C= balances[msg.sender], \"Insufficient balance\");\n        require(amount > 0, \"Amount must be positive\");\n\n        \u002F\u002F 2. EFFECTS: Update state\n        balances[msg.sender] -= amount;\n\n        \u002F\u002F 3. INTERACTIONS: External calls last\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n### Pull Over Push Pattern\n```solidity\n\u002F\u002F Prefer this (pull)\ncontract SecurePayment {\n    mapping(address => uint256) public pendingWithdrawals;\n\n    function recordPayment(address recipient, uint256 amount) internal {\n        pendingWithdrawals[recipient] += amount;\n    }\n\n    function withdraw() public {\n        uint256 amount = pendingWithdrawals[msg.sender];\n        require(amount > 0, \"Nothing to withdraw\");\n\n        pendingWithdrawals[msg.sender] = 0;\n        payable(msg.sender).transfer(amount);\n    }\n}\n\n\u002F\u002F Over this (push)\ncontract RiskyPayment {\n    function distributePayments(address[] memory recipients, uint256[] memory amounts) public {\n        for (uint i = 0; i \u003C recipients.length; i++) {\n            \u002F\u002F If any transfer fails, entire batch fails\n            payable(recipients[i]).transfer(amounts[i]);\n        }\n    }\n}\n```\n\n### Input Validation\n```solidity\ncontract SecureContract {\n    function transfer(address to, uint256 amount) public {\n        \u002F\u002F Validate inputs\n        require(to != address(0), \"Invalid recipient\");\n        require(to != address(this), \"Cannot send to contract\");\n        require(amount > 0, \"Amount must be positive\");\n        require(amount \u003C= balances[msg.sender], \"Insufficient balance\");\n\n        \u002F\u002F Proceed with transfer\n        balances[msg.sender] -= amount;\n        balances[to] += amount;\n    }\n}\n```\n\n### Emergency Stop (Circuit Breaker)\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Fsecurity\u002FPausable.sol\";\n\ncontract EmergencyStop is Pausable, Ownable {\n    function criticalFunction() public whenNotPaused {\n        \u002F\u002F Function logic\n    }\n\n    function emergencyStop() public onlyOwner {\n        _pause();\n    }\n\n    function resume() public onlyOwner {\n        _unpause();\n    }\n}\n```\n\n## Gas Optimization\n\n### Use `uint256` Instead of Smaller Types\n```solidity\n\u002F\u002F More gas efficient\ncontract GasEfficient {\n    uint256 public value;  \u002F\u002F Optimal\n\n    function set(uint256 _value) public {\n        value = _value;\n    }\n}\n\n\u002F\u002F Less efficient\ncontract GasInefficient {\n    uint8 public value;  \u002F\u002F Still uses 256-bit slot\n\n    function set(uint8 _value) public {\n        value = _value;  \u002F\u002F Extra gas for type conversion\n    }\n}\n```\n\n### Pack Storage Variables\n```solidity\n\u002F\u002F Gas efficient (3 variables in 1 slot)\ncontract PackedStorage {\n    uint128 public a;  \u002F\u002F Slot 0\n    uint64 public b;   \u002F\u002F Slot 0\n    uint64 public c;   \u002F\u002F Slot 0\n    uint256 public d;  \u002F\u002F Slot 1\n}\n\n\u002F\u002F Gas inefficient (each variable in separate slot)\ncontract UnpackedStorage {\n    uint256 public a;  \u002F\u002F Slot 0\n    uint256 public b;  \u002F\u002F Slot 1\n    uint256 public c;  \u002F\u002F Slot 2\n    uint256 public d;  \u002F\u002F Slot 3\n}\n```\n\n### Use `calldata` Instead of `memory` for Function Arguments\n```solidity\ncontract GasOptimized {\n    \u002F\u002F More gas efficient\n    function processData(uint256[] calldata data) public pure returns (uint256) {\n        return data[0];\n    }\n\n    \u002F\u002F Less efficient\n    function processDataMemory(uint256[] memory data) public pure returns (uint256) {\n        return data[0];\n    }\n}\n```\n\n### Use Events for Data Storage (When Appropriate)\n```solidity\ncontract EventStorage {\n    \u002F\u002F Emitting events is cheaper than storage\n    event DataStored(address indexed user, uint256 indexed id, bytes data);\n\n    function storeData(uint256 id, bytes calldata data) public {\n        emit DataStored(msg.sender, id, data);\n        \u002F\u002F Don't store in contract storage unless needed\n    }\n}\n```\n\n## Common Vulnerabilities Checklist\n\n```solidity\n\u002F\u002F Security Checklist Contract\ncontract SecurityChecklist {\n    \u002F**\n     * [ ] Reentrancy protection (ReentrancyGuard or CEI pattern)\n     * [ ] Integer overflow\u002Funderflow (Solidity 0.8+ or SafeMath)\n     * [ ] Access control (Ownable, roles, modifiers)\n     * [ ] Input validation (require statements)\n     * [ ] Front-running mitigation (commit-reveal if applicable)\n     * [ ] Gas optimization (packed storage, calldata)\n     * [ ] Emergency stop mechanism (Pausable)\n     * [ ] Pull over push pattern for payments\n     * [ ] No delegatecall to untrusted contracts\n     * [ ] No tx.origin for authentication (use msg.sender)\n     * [ ] Proper event emission\n     * [ ] External calls at end of function\n     * [ ] Check return values of external calls\n     * [ ] No hardcoded addresses\n     * [ ] Upgrade mechanism (if proxy pattern)\n     *\u002F\n}\n```\n\n## Testing for Security\n\n```javascript\n\u002F\u002F Hardhat test example\nconst { expect } = require(\"chai\");\nconst { ethers } = require(\"hardhat\");\n\ndescribe(\"Security Tests\", function () {\n    it(\"Should prevent reentrancy attack\", async function () {\n        const [attacker] = await ethers.getSigners();\n\n        const VictimBank = await ethers.getContractFactory(\"SecureBank\");\n        const bank = await VictimBank.deploy();\n\n        const Attacker = await ethers.getContractFactory(\"ReentrancyAttacker\");\n        const attackerContract = await Attacker.deploy(bank.address);\n\n        \u002F\u002F Deposit funds\n        await bank.deposit({value: ethers.utils.parseEther(\"10\")});\n\n        \u002F\u002F Attempt reentrancy attack\n        await expect(\n            attackerContract.attack({value: ethers.utils.parseEther(\"1\")})\n        ).to.be.revertedWith(\"ReentrancyGuard: reentrant call\");\n    });\n\n    it(\"Should prevent integer overflow\", async function () {\n        const Token = await ethers.getContractFactory(\"SecureToken\");\n        const token = await Token.deploy();\n\n        \u002F\u002F Attempt overflow\n        await expect(\n            token.transfer(attacker.address, ethers.constants.MaxUint256)\n        ).to.be.reverted;\n    });\n\n    it(\"Should enforce access control\", async function () {\n        const [owner, attacker] = await ethers.getSigners();\n\n        const Contract = await ethers.getContractFactory(\"SecureContract\");\n        const contract = await Contract.deploy();\n\n        \u002F\u002F Attempt unauthorized withdrawal\n        await expect(\n            contract.connect(attacker).withdraw(100)\n        ).to.be.revertedWith(\"Ownable: caller is not the owner\");\n    });\n});\n```\n\n## Audit Preparation\n\n```solidity\ncontract WellDocumentedContract {\n    \u002F**\n     * @title Well Documented Contract\n     * @dev Example of proper documentation for audits\n     * @notice This contract handles user deposits and withdrawals\n     *\u002F\n\n    \u002F\u002F\u002F @notice Mapping of user balances\n    mapping(address => uint256) public balances;\n\n    \u002F**\n     * @dev Deposits ETH into the contract\n     * @notice Anyone can deposit funds\n     *\u002F\n    function deposit() public payable {\n        require(msg.value > 0, \"Must send ETH\");\n        balances[msg.sender] += msg.value;\n    }\n\n    \u002F**\n     * @dev Withdraws user's balance\n     * @notice Follows CEI pattern to prevent reentrancy\n     * @param amount Amount to withdraw in wei\n     *\u002F\n    function withdraw(uint256 amount) public {\n        \u002F\u002F CHECKS\n        require(amount \u003C= balances[msg.sender], \"Insufficient balance\");\n\n        \u002F\u002F EFFECTS\n        balances[msg.sender] -= amount;\n\n        \u002F\u002F INTERACTIONS\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n## Resources\n\n- **references\u002Freentrancy.md**: Comprehensive reentrancy prevention\n- **references\u002Faccess-control.md**: Role-based access patterns\n- **references\u002Foverflow-underflow.md**: SafeMath and integer safety\n- **references\u002Fgas-optimization.md**: Gas saving techniques\n- **references\u002Fvulnerability-patterns.md**: Common vulnerability catalog\n- **assets\u002Fsolidity-contracts-templates.sol**: Secure contract templates\n- **assets\u002Fsecurity-checklist.md**: Pre-audit checklist\n- **scripts\u002Fanalyze-contract.sh**: Static analysis tools\n\n## Tools for Security Analysis\n\n- **Slither**: Static analysis tool\n- **Mythril**: Security analysis tool\n- **Echidna**: Fuzzing tool\n- **Manticore**: Symbolic execution\n- **Securify**: Automated security scanner\n\n## Common Pitfalls\n\n1. **Using `tx.origin` for Authentication**: Use `msg.sender` instead\n2. **Unchecked External Calls**: Always check return values\n3. **Delegatecall to Untrusted Contracts**: Can hijack your contract\n4. **Floating Pragma**: Pin to specific Solidity version\n5. **Missing Events**: Emit events for state changes\n6. **Excessive Gas in Loops**: Can hit block gas limit\n7. **No Upgrade Path**: Consider proxy patterns if upgrades needed\n","# Solidity Security\n\nMaster smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.\n\n## When to Use This Skill\n\n- Writing secure smart contracts\n- Auditing existing contracts for vulnerabilities\n- Implementing secure DeFi protocols\n- Preventing reentrancy, overflow, and access control issues\n- Optimizing gas usage while maintaining security\n- Preparing contracts for professional audits\n- Understanding common attack vectors\n\n## Critical Vulnerabilities\n\n### 1. Reentrancy\nAttacker calls back into your contract before state is updated.\n\n**Vulnerable Code:**\n```solidity\n\u002F\u002F VULNERABLE TO REENTRANCY\ncontract VulnerableBank {\n    mapping(address => uint256) public balances;\n\n    function withdraw() public {\n        uint256 amount = balances[msg.sender];\n\n        \u002F\u002F DANGER: External call before state update\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success);\n\n        balances[msg.sender] = 0;  \u002F\u002F Too late!\n    }\n}\n```\n\n**Secure Pattern (Checks-Effects-Interactions):**\n```solidity\ncontract SecureBank {\n    mapping(address => uint256) public balances;\n\n    function withdraw() public {\n        uint256 amount = balances[msg.sender];\n        require(amount > 0, \"Insufficient balance\");\n\n        \u002F\u002F EFFECTS: Update state BEFORE external call\n        balances[msg.sender] = 0;\n\n        \u002F\u002F INTERACTIONS: External call last\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n**Alternative: ReentrancyGuard**\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Fsecurity\u002FReentrancyGuard.sol\";\n\ncontract SecureBank is ReentrancyGuard {\n    mapping(address => uint256) public balances;\n\n    function withdraw() public nonReentrant {\n        uint256 amount = balances[msg.sender];\n        require(amount > 0, \"Insufficient balance\");\n\n        balances[msg.sender] = 0;\n\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n### 2. Integer Overflow\u002FUnderflow\n\n**Vulnerable Code (Solidity \u003C 0.8.0):**\n```solidity\n\u002F\u002F VULNERABLE\ncontract VulnerableToken {\n    mapping(address => uint256) public balances;\n\n    function transfer(address to, uint256 amount) public {\n        \u002F\u002F No overflow check - can wrap around\n        balances[msg.sender] -= amount;  \u002F\u002F Can underflow!\n        balances[to] += amount;          \u002F\u002F Can overflow!\n    }\n}\n```\n\n**Secure Pattern (Solidity >= 0.8.0):**\n```solidity\n\u002F\u002F Solidity 0.8+ has built-in overflow\u002Funderflow checks\ncontract SecureToken {\n    mapping(address => uint256) public balances;\n\n    function transfer(address to, uint256 amount) public {\n        \u002F\u002F Automatically reverts on overflow\u002Funderflow\n        balances[msg.sender] -= amount;\n        balances[to] += amount;\n    }\n}\n```\n\n**For Solidity \u003C 0.8.0, use SafeMath:**\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Futils\u002Fmath\u002FSafeMath.sol\";\n\ncontract SecureToken {\n    using SafeMath for uint256;\n    mapping(address => uint256) public balances;\n\n    function transfer(address to, uint256 amount) public {\n        balances[msg.sender] = balances[msg.sender].sub(amount);\n        balances[to] = balances[to].add(amount);\n    }\n}\n```\n\n### 3. Access Control\n\n**Vulnerable Code:**\n```solidity\n\u002F\u002F VULNERABLE: Anyone can call critical functions\ncontract VulnerableContract {\n    address public owner;\n\n    function withdraw(uint256 amount) public {\n        \u002F\u002F No access control!\n        payable(msg.sender).transfer(amount);\n    }\n}\n```\n\n**Secure Pattern:**\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Faccess\u002FOwnable.sol\";\n\ncontract SecureContract is Ownable {\n    function withdraw(uint256 amount) public onlyOwner {\n        payable(owner()).transfer(amount);\n    }\n}\n\n\u002F\u002F Or implement custom role-based access\ncontract RoleBasedContract {\n    mapping(address => bool) public admins;\n\n    modifier onlyAdmin() {\n        require(admins[msg.sender], \"Not an admin\");\n        _;\n    }\n\n    function criticalFunction() public onlyAdmin {\n        \u002F\u002F Protected function\n    }\n}\n```\n\n### 4. Front-Running\n\n**Vulnerable:**\n```solidity\n\u002F\u002F VULNERABLE TO FRONT-RUNNING\ncontract VulnerableDEX {\n    function swap(uint256 amount, uint256 minOutput) public {\n        \u002F\u002F Attacker sees this in mempool and front-runs\n        uint256 output = calculateOutput(amount);\n        require(output >= minOutput, \"Slippage too high\");\n        \u002F\u002F Perform swap\n    }\n}\n```\n\n**Mitigation:**\n```solidity\ncontract SecureDEX {\n    mapping(bytes32 => bool) public usedCommitments;\n\n    \u002F\u002F Step 1: Commit to trade\n    function commitTrade(bytes32 commitment) public {\n        usedCommitments[commitment] = true;\n    }\n\n    \u002F\u002F Step 2: Reveal trade (next block)\n    function revealTrade(\n        uint256 amount,\n        uint256 minOutput,\n        bytes32 secret\n    ) public {\n        bytes32 commitment = keccak256(abi.encodePacked(\n            msg.sender, amount, minOutput, secret\n        ));\n        require(usedCommitments[commitment], \"Invalid commitment\");\n        \u002F\u002F Perform swap\n    }\n}\n```\n\n## Security Best Practices\n\n### Checks-Effects-Interactions Pattern\n```solidity\ncontract SecurePattern {\n    mapping(address => uint256) public balances;\n\n    function withdraw(uint256 amount) public {\n        \u002F\u002F 1. CHECKS: Validate conditions\n        require(amount \u003C= balances[msg.sender], \"Insufficient balance\");\n        require(amount > 0, \"Amount must be positive\");\n\n        \u002F\u002F 2. EFFECTS: Update state\n        balances[msg.sender] -= amount;\n\n        \u002F\u002F 3. INTERACTIONS: External calls last\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n### Pull Over Push Pattern\n```solidity\n\u002F\u002F Prefer this (pull)\ncontract SecurePayment {\n    mapping(address => uint256) public pendingWithdrawals;\n\n    function recordPayment(address recipient, uint256 amount) internal {\n        pendingWithdrawals[recipient] += amount;\n    }\n\n    function withdraw() public {\n        uint256 amount = pendingWithdrawals[msg.sender];\n        require(amount > 0, \"Nothing to withdraw\");\n\n        pendingWithdrawals[msg.sender] = 0;\n        payable(msg.sender).transfer(amount);\n    }\n}\n\n\u002F\u002F Over this (push)\ncontract RiskyPayment {\n    function distributePayments(address[] memory recipients, uint256[] memory amounts) public {\n        for (uint i = 0; i \u003C recipients.length; i++) {\n            \u002F\u002F If any transfer fails, entire batch fails\n            payable(recipients[i]).transfer(amounts[i]);\n        }\n    }\n}\n```\n\n### Input Validation\n```solidity\ncontract SecureContract {\n    function transfer(address to, uint256 amount) public {\n        \u002F\u002F Validate inputs\n        require(to != address(0), \"Invalid recipient\");\n        require(to != address(this), \"Cannot send to contract\");\n        require(amount > 0, \"Amount must be positive\");\n        require(amount \u003C= balances[msg.sender], \"Insufficient balance\");\n\n        \u002F\u002F Proceed with transfer\n        balances[msg.sender] -= amount;\n        balances[to] += amount;\n    }\n}\n```\n\n### Emergency Stop (Circuit Breaker)\n```solidity\nimport \"@openzeppelin\u002Fcontracts\u002Fsecurity\u002FPausable.sol\";\n\ncontract EmergencyStop is Pausable, Ownable {\n    function criticalFunction() public whenNotPaused {\n        \u002F\u002F Function logic\n    }\n\n    function emergencyStop() public onlyOwner {\n        _pause();\n    }\n\n    function resume() public onlyOwner {\n        _unpause();\n    }\n}\n```\n\n## Gas Optimization\n\n### Use `uint256` Instead of Smaller Types\n```solidity\n\u002F\u002F More gas efficient\ncontract GasEfficient {\n    uint256 public value;  \u002F\u002F Optimal\n\n    function set(uint256 _value) public {\n        value = _value;\n    }\n}\n\n\u002F\u002F Less efficient\ncontract GasInefficient {\n    uint8 public value;  \u002F\u002F Still uses 256-bit slot\n\n    function set(uint8 _value) public {\n        value = _value;  \u002F\u002F Extra gas for type conversion\n    }\n}\n```\n\n### Pack Storage Variables\n```solidity\n\u002F\u002F Gas efficient (3 variables in 1 slot)\ncontract PackedStorage {\n    uint128 public a;  \u002F\u002F Slot 0\n    uint64 public b;   \u002F\u002F Slot 0\n    uint64 public c;   \u002F\u002F Slot 0\n    uint256 public d;  \u002F\u002F Slot 1\n}\n\n\u002F\u002F Gas inefficient (each variable in separate slot)\ncontract UnpackedStorage {\n    uint256 public a;  \u002F\u002F Slot 0\n    uint256 public b;  \u002F\u002F Slot 1\n    uint256 public c;  \u002F\u002F Slot 2\n    uint256 public d;  \u002F\u002F Slot 3\n}\n```\n\n### Use `calldata` Instead of `memory` for Function Arguments\n```solidity\ncontract GasOptimized {\n    \u002F\u002F More gas efficient\n    function processData(uint256[] calldata data) public pure returns (uint256) {\n        return data[0];\n    }\n\n    \u002F\u002F Less efficient\n    function processDataMemory(uint256[] memory data) public pure returns (uint256) {\n        return data[0];\n    }\n}\n```\n\n### Use Events for Data Storage (When Appropriate)\n```solidity\ncontract EventStorage {\n    \u002F\u002F Emitting events is cheaper than storage\n    event DataStored(address indexed user, uint256 indexed id, bytes data);\n\n    function storeData(uint256 id, bytes calldata data) public {\n        emit DataStored(msg.sender, id, data);\n        \u002F\u002F Don't store in contract storage unless needed\n    }\n}\n```\n\n## Common Vulnerabilities Checklist\n\n```solidity\n\u002F\u002F Security Checklist Contract\ncontract SecurityChecklist {\n    \u002F**\n     * [ ] Reentrancy protection (ReentrancyGuard or CEI pattern)\n     * [ ] Integer overflow\u002Funderflow (Solidity 0.8+ or SafeMath)\n     * [ ] Access control (Ownable, roles, modifiers)\n     * [ ] Input validation (require statements)\n     * [ ] Front-running mitigation (commit-reveal if applicable)\n     * [ ] Gas optimization (packed storage, calldata)\n     * [ ] Emergency stop mechanism (Pausable)\n     * [ ] Pull over push pattern for payments\n     * [ ] No delegatecall to untrusted contracts\n     * [ ] No tx.origin for authentication (use msg.sender)\n     * [ ] Proper event emission\n     * [ ] External calls at end of function\n     * [ ] Check return values of external calls\n     * [ ] No hardcoded addresses\n     * [ ] Upgrade mechanism (if proxy pattern)\n     *\u002F\n}\n```\n\n## Testing for Security\n\n```javascript\n\u002F\u002F Hardhat test example\nconst { expect } = require(\"chai\");\nconst { ethers } = require(\"hardhat\");\n\ndescribe(\"Security Tests\", function () {\n    it(\"Should prevent reentrancy attack\", async function () {\n        const [attacker] = await ethers.getSigners();\n\n        const VictimBank = await ethers.getContractFactory(\"SecureBank\");\n        const bank = await VictimBank.deploy();\n\n        const Attacker = await ethers.getContractFactory(\"ReentrancyAttacker\");\n        const attackerContract = await Attacker.deploy(bank.address);\n\n        \u002F\u002F Deposit funds\n        await bank.deposit({value: ethers.utils.parseEther(\"10\")});\n\n        \u002F\u002F Attempt reentrancy attack\n        await expect(\n            attackerContract.attack({value: ethers.utils.parseEther(\"1\")})\n        ).to.be.revertedWith(\"ReentrancyGuard: reentrant call\");\n    });\n\n    it(\"Should prevent integer overflow\", async function () {\n        const Token = await ethers.getContractFactory(\"SecureToken\");\n        const token = await Token.deploy();\n\n        \u002F\u002F Attempt overflow\n        await expect(\n            token.transfer(attacker.address, ethers.constants.MaxUint256)\n        ).to.be.reverted;\n    });\n\n    it(\"Should enforce access control\", async function () {\n        const [owner, attacker] = await ethers.getSigners();\n\n        const Contract = await ethers.getContractFactory(\"SecureContract\");\n        const contract = await Contract.deploy();\n\n        \u002F\u002F Attempt unauthorized withdrawal\n        await expect(\n            contract.connect(attacker).withdraw(100)\n        ).to.be.revertedWith(\"Ownable: caller is not the owner\");\n    });\n});\n```\n\n## Audit Preparation\n\n```solidity\ncontract WellDocumentedContract {\n    \u002F**\n     * @title Well Documented Contract\n     * @dev Example of proper documentation for audits\n     * @notice This contract handles user deposits and withdrawals\n     *\u002F\n\n    \u002F\u002F\u002F @notice Mapping of user balances\n    mapping(address => uint256) public balances;\n\n    \u002F**\n     * @dev Deposits ETH into the contract\n     * @notice Anyone can deposit funds\n     *\u002F\n    function deposit() public payable {\n        require(msg.value > 0, \"Must send ETH\");\n        balances[msg.sender] += msg.value;\n    }\n\n    \u002F**\n     * @dev Withdraws user's balance\n     * @notice Follows CEI pattern to prevent reentrancy\n     * @param amount Amount to withdraw in wei\n     *\u002F\n    function withdraw(uint256 amount) public {\n        \u002F\u002F CHECKS\n        require(amount \u003C= balances[msg.sender], \"Insufficient balance\");\n\n        \u002F\u002F EFFECTS\n        balances[msg.sender] -= amount;\n\n        \u002F\u002F INTERACTIONS\n        (bool success, ) = msg.sender.call{value: amount}(\"\");\n        require(success, \"Transfer failed\");\n    }\n}\n```\n\n## Resources\n\n- **references\u002Freentrancy.md**: Comprehensive reentrancy prevention\n- **references\u002Faccess-control.md**: Role-based access patterns\n- **references\u002Foverflow-underflow.md**: SafeMath and integer safety\n- **references\u002Fgas-optimization.md**: Gas saving techniques\n- **references\u002Fvulnerability-patterns.md**: Common vulnerability catalog\n- **assets\u002Fsolidity-contracts-templates.sol**: Secure contract templates\n- **assets\u002Fsecurity-checklist.md**: Pre-audit checklist\n- **scripts\u002Fanalyze-contract.sh**: Static analysis tools\n\n## Tools for Security Analysis\n\n- **Slither**: Static analysis tool\n- **Mythril**: Security analysis tool\n- **Echidna**: Fuzzing tool\n- **Manticore**: Symbolic execution\n- **Securify**: Automated security scanner\n\n## Common Pitfalls\n\n1. **Using `tx.origin` for Authentication**: Use `msg.sender` instead\n2. **Unchecked External Calls**: Always check return values\n3. **Delegatecall to Untrusted Contracts**: Can hijack your contract\n4. **Floating Pragma**: Pin to specific Solidity version\n5. **Missing Events**: Emit events for state changes\n6. **Excessive Gas in Loops**: Can hit block gas limit\n7. **No Upgrade Path**: Consider proxy patterns if upgrades needed\n",{"name":5,"description":7},"main","7850740bd837adb32f0a109ab2af82482196c6f2","skills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fblockchain-web3\u002Fskills\u002Fsolidity-security",1,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills","https:\u002F\u002Fzturnsgo.com","https:\u002F\u002Fgithub.com\u002Fshengdabai","https:\u002F\u002Fzturnsgo.com\u002F","AI × education creator — producer, not consumer. Taught 6,000+ learners; shipping learning tools & daily essays with Claude Code, practicing @xiaolai's way 🥋","2026-11-01 21:28:23",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add shengdabai\u002FTony-Claude-Code-Skills --skill solidity-security",{"tool":60,"command":61},"bunx","bunx skills add shengdabai\u002FTony-Claude-Code-Skills --skill solidity-security",{"tool":63,"command":64},"pnpm","pnpm dlx skills add shengdabai\u002FTony-Claude-Code-Skills --skill solidity-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002F_collections\u002Fwshobson-agents\u002Fplugins\u002Fblockchain-web3\u002Fskills\u002Fsolidity-security\u002FSKILL.md",true,[],[69,87,121,146,168,188],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":80,"publishedAt":39},"01M70P17DAD4C1C47NPH6A96EM","xiaolai-methodology","以李笑来(Li Xiaolai)的思考方式、方法论与表达风格,为用户做全方位 1-on-1 教练指导,覆盖创业、赚钱、投资、学习、自学、读书写作、用 AI、以及人生心态与自我管理。当用户提到 \"李笑来\"、\"笑来\"、\"笑来老师\"、\"扮演李笑来\"、\"找笑来聊聊\"、\"笑来怎么看\"、\"xiaolai\"、\"把时间当作朋友\"、\"通往财富自由之路\"、\"定投改变命运\"、\"韭菜的自我修养\"、\"自学是门手艺\"、\"让时间陪你慢慢变富\"、\"七年就是一辈子\"、\"元认知\"、\"活在未来\"、\"复利\u002F长期主义\"、\"践行\"、\"痴迷改进\"、\"个人商业模式\u002F出售时间\"、\"睡后收入\"、\"定投\"、\"财富自由\"、\"操作系统升级\"、\"最少必要知识\"、\"北极星提示词\"、\"用 AI 该怎么学\u002F思考\" 等任一触发词,或当用户带着关于创业\u002F赚钱\u002F投资\u002F学习\u002F职业\u002F重大人生决策的困惑、希望被人用笑来式的「逻辑 + 大白话 + 类比 + 重新定义 + 践行导向」来点醒和指导时,自动进入李笑来教练模式。","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fxiaolai-methodology\u002FSKILL.md",[75],{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",[81,82,83,84,85,37,86],"methodology","xiaolai","xiaolai methodology","朋友","投资","收入",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":101,"publishedAt":39},"01M70P13NB9YP7ACJR1S861CDS","zread","Produce and consume a wiki-style knowledge base for a code repository via the `zread` CLI and its on-disk output under `.\u002F.zread\u002Fwiki\u002F`. Use this skill whenever the user wants to understand, onboard onto, explore, summarize, map, or get an overview of an unfamiliar codebase; asks for architecture docs, a project wiki, a repo walkthrough, module\u002Fpackage explanations, or \"what does this repo do\"; wants to generate, regenerate, resume, browse, or serve code documentation locally; or mentions zread \u002F zread.ai directly. Also use it proactively before diving into a large unknown repo — if `.\u002F.zread\u002Fwiki\u002Fcurrent` exists, read the generated pages instead of crawling source file-by-file; if it doesn't, consider offering to run `zread generate`. The trigger is the intent (understand a codebase through generated docs), not the literal word \"zread\".","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fzread\u002FSKILL.md",[93,96],{"categoryNo":94,"categoryName":95,"taxonomyType":78,"taxonomyTypeDesc":79},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[89,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120],"knowledge","wiki","explore","walkthrough","project","get","knowledge base","run","generate","intent","cli","map","documentation","project wiki","disk","architecture","code","unknown","generated",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":131,"publishedAt":39},"01M70P10S4SWMZQ8BJAFBFDRW3","youtube","Launch the YouTube Creator Agent to auto-generate videos.\nUse when: user types \u002Fyoutube, wants to create YouTube videos,\ngenerate video content, or upload to YouTube.\nKeywords: youtube, video, 视频, 创作视频, 发布视频","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube\u002FSKILL.md",[127,128],{"categoryNo":94,"categoryName":95,"taxonomyType":78,"taxonomyTypeDesc":79},{"categoryNo":129,"categoryName":130,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000036","内容创作者",[123,132,133,134,135,136,137,138,110,139,140,141,35,24,142,143,144,145],"user","content","视频","creator","generate video","videos","launch","video content","create","upload","auto","types","Video","创作",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":39},"01M70P0YE95D8BACZCGV8BK90K","youtube-script-sync","Sync, update, or optimize Tony's GetNote knowledge base `Youtube视频逐字稿` by turning each parent recording or first-person idea note into an idempotent child note containing a directly recordable YouTube long-video or Shorts script. Use when the user says “更新\u002F同步\u002F优化 Youtube视频逐字稿知识库”, or says “更新\u002F同步\u002F优化该知识库” while this knowledge base is the active context.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fyoutube-script-sync\u002FSKILL.md",[152],{"categoryNo":94,"categoryName":95,"taxonomyType":78,"taxonomyTypeDesc":79},[154,155,123,156,157,144,158,159,160,161,162,163,164,165,108,166,35,24,102,167],"sync","script","youtube script sync","recording","shorts","first","base","person","update","active","child","optimize","idempotent","long",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":178,"publishedAt":39},"01M70P0WMV5XT0EEC0N445PW07","writing-skills","How to write SKILL.md files that trigger reliably and teach effectively. Use when creating, improving, or reviewing Claude Code skills.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-skills\u002FSKILL.md",[174,175,176,177],{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},{"categoryNo":94,"categoryName":95,"taxonomyType":78,"taxonomyTypeDesc":79},{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":129,"categoryName":130,"taxonomyType":99,"taxonomyTypeDesc":100},[179,37,180,181,182,183,118,35,24,184,185,186,187],"writing skills","how","teach","write skill","write","claude code skills","files","how to","trigger",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":196,"publishedAt":39},"01M70P0SJFR4YVJQBGMHKGSKXT","writing-rules","How to write .claude\u002Frules\u002F files that Claude actually follows. Use when creating, improving, or reviewing project rules.","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fxiaolai\u002Fnlpm\u002Fskills\u002Fnlpm\u002Fwriting-rules\u002FSKILL.md",[194,195],{"categoryNo":76,"categoryName":77,"taxonomyType":78,"taxonomyTypeDesc":79},{"categoryNo":129,"categoryName":130,"taxonomyType":99,"taxonomyTypeDesc":100},[197,37,198,106,199,185,35,180,183,24,186],"Rules","writing rules","project rules"]