⚠️

重要前提

安装AI Skills的关键前提是：必须科学上网，且开启TUN模式，这一点至关重要，直接决定安装能否顺利完成，在此郑重提醒三遍：科学上网，科学上网，科学上网。查看完整安装教程 →

DeFi安全防护指南：智能合约安全原则、漏洞防护与上线检查清单

defi-security by 0xlayerghost/solidity-agent-kit

75 周安装量

1 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/0xlayerghost/solidity-agent-kit --skill defi-security

区块链 DeFi 安全

🇨🇳中文介绍

DeFi 安全原则

语言规则

始终使用用户使用的语言进行回应。 如果用户使用中文提问，则用中文回应。如果使用英文，则用英文回应。

适用范围：仅适用于 DeFi 项目（DEX、借贷、质押、流动性提供、收益）。非 DeFi 项目可忽略此技能。

防护决策规则

威胁	所需防护措施
巨鲸操纵	每日交易上限 + 单笔交易金额限制 + 冷却窗口
MEV / 三明治攻击	仅限外部账户检查（`msg.sender == tx.origin`），或使用提交-揭示模式
套利	推荐绑定 + 流动性分配 + 固定收益模型 + 锁定期
重入攻击	在所有外部调用函数上使用 `ReentrancyGuard`（参见 solidity-security 技能）
闪电贷攻击	检查操作之间的 `block.number` 变化，或使用 TWAP 定价

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

相关 Skills

Azure RBAC 权限管理工具：查找最小角色、创建自定义角色与自动化分配

162,100 周安装

OpenClaw 安全 Linux 云部署指南：私有优先、SSH隧道、Podman容器化

56,300 周安装

Linux云主机安全托管指南：从SSH加固到HTTPS部署

56,100 周安装

xdrop 文件传输脚本：Bun 环境下安全上传下载工具，支持加密分享

50,300 周安装

最大单笔交易金额：可通过 onlyOwner setter 函数配置
每个地址每日累计限额：使用 mapping(address => mapping(uint256 => uint256)) 跟踪（地址 → 天数 → 金额）
交易间冷却时间：使用 block.timestamp 检查强制执行最小时间间隔
豁免地址白名单（部署者、流动性对、质押合约）

跨金库操作 [noya H-08]：Registry/Router 中继调用必须验证金库级别的授权；防止 keeper 使用闪电贷冒充其他金库
借贷抵押品 [benddao]：清算函数必须验证 msg.sender 实际拥有或有权操作目标抵押品
绑定曲线 [phi H-06]：在创建 + 自动购买操作中，ID 分配和定价参数必须在购买交易执行前完全确定；防止重入攻击修改它们
共享注册表 [noya H-08]：共享注册表中的权限传播链必须逐跳验证；切勿仅依赖"可信发送者"标志

所有 onlyOwner 函数已转移至多签钱包
时间锁合约已部署并配置（关键变更至少延迟 24 小时）
紧急暂停机制已测试 — 暂停和取消暂停功能均正常工作
每日限额参数已记录并设置为合理值
第三方安全审计已完成，所有严重/高危问题已解决
测试网部署已稳定运行至少 7 天且无问题
滑点、费用和锁定期参数已审核并记录
初始流动性计划已记录（金额、锁定持续时间、LP 代币处理）
模糊测试在所有 DeFi 关键函数上通过高迭代次数（10000+）

步骤	行动
1. 检测	监控警报触发（链上监控、社区报告）
2. 暂停	指定地址调用 `pause()` — 必须在几分钟内响应
3. 评估	技术负责人分析根本原因，估算资金影响
4. 沟通	向社区渠道（Discord、Twitter、Telegram）发布事件通知
5. 修复	部署修复程序或准备恢复计划
6. 恢复	在分叉网络上验证修复后调用 `unpause()` — 或迁移至新合约
7. 事后分析	48 小时内发布详细事件报告

测试场景	方法
模糊测试资金流	对质押/资金池合约运行高迭代次数（10000+）的模糊测试
分叉主网测试	使用 Foundry 分叉模式连接主网 RPC，在真实状态下进行测试
模拟巨鲸交易	使用 Foundry cast CLI 在分叉网络上模拟大额调用

🇺🇸English

DeFi Security Principles

Language Rule

Always respond in the same language the user is using. If the user asks in Chinese, respond in Chinese. If in English, respond in English.

Scope : Only applicable to DeFi projects (DEX, lending, staking, LP, yield). Non-DeFi projects can ignore this skill.

Protection Decision Rules

Threat	Required Protection
Whale manipulation	Daily transaction caps + per-tx amount limits + cooldown window
MEV / sandwich attack	EOA-only checks (`msg.sender == tx.origin`), or use commit-reveal pattern
Arbitrage	Referral binding + liquidity distribution + fixed yield model + lock period
Reentrancy	`ReentrancyGuard` on all external-call functions (see solidity-security skill)
Flash loan attack	Check `block.number` change between operations, or use TWAP pricing
Price manipulation	Chainlink oracle or TWAP — never rely on spot AMM reserves for pricing
Approval exploit	Use `safeIncreaseAllowance` / `safeDecreaseAllowance`, never raw `approve` for user flows
Governance attack	Voting requires snapshot + minimum token holding period; timelock ≥ 48h on proposal execution
ERC4626 inflation attack	First deposit must enforce minimum amount or use virtual shares to prevent share dilution via rounding
Cross-vault trust bypass	Router/Registry relay must verify vault authorization; never trust caller identity inside flash loan callbacks — EVMbench/noya H-08
Collateral ownership exploit	Liquidation/staking operations must verify actual NFT/collateral ownership — EVMbench/benddao
Bonding curve manipulation	ID/pricing params in create operations must be fully determined before external calls — EVMbench/phi H-06
DEX pair `_transfer` TOCTOU	Never distinguish operation type by balance/reserve checks in `_transfer` — both directions are exploitable: buy vs removeLiquidity (`pair→user`) and sell vs addLiquidity (`user→pair`); use address whitelist only; new projects prefer Uniswap V4 Hook

Anti-Whale Implementation Rules

Maximum single transaction amount: configurable via onlyOwner setter
Daily cumulative limit per address: track with mapping(address => mapping(uint256 => uint256)) (address → day → amount)
Cooldown between transactions: enforce minimum time gap with block.timestamp check
Whitelist for exempt addresses (deployer, LP pair, staking contract)

Flash Loan Protection Rules

For price-sensitive operations: require that block.number has changed since last interaction
For oracle-dependent calculations: use time-weighted average (TWAP) over minimum 30 minutes
For critical state changes: add minimum holding period before action (e.g., must hold tokens for N blocks)

Protocol Composability Risks

Source: EVMbench (OpenAI/Paradigm, Feb 2026) — vulnerability patterns from Code4rena audits

Cross-vault operations [noya H-08]: Registry/Router relay calls must verify vault-level authorization; prevent keeper from using flash loan to impersonate other vaults
Lending collateral [benddao]: Liquidation functions must verify msg.sender actually owns or is authorized to operate on target collateral
Bonding curve [phi H-06]: In create + auto-buy operations, ID assignment and pricing params must be fully determined before the buy transaction executes; prevent reentrancy from modifying them
Shared registries [noya H-08]: Permission propagation chains in shared registries must be verified hop-by-hop; never rely solely on "trusted sender" flags

Launch Checklist

Before mainnet deployment, verify all items:

All onlyOwner functions transferred to multisig wallet
Timelock contract deployed and configured (minimum 24h delay for critical changes)
Emergency pause mechanism tested — both pause and unpause functions work correctly
Daily limit parameters documented and set to reasonable values
Third-party security audit completed and all critical/high findings resolved
Testnet deployment running for minimum 7 days with no issues
Slippage, fee, and lock period parameters reviewed and documented
Initial liquidity plan documented (amount, lock duration, LP token handling)
Fuzz testing passes with high iterations (10000+) on all DeFi-critical functions

Emergency Response Procedure

Step	Action
1. Detect	Monitor alerts trigger (on-chain monitoring, community reports)
2. Pause	Designated address calls `pause()` — must respond within minutes
3. Assess	Technical lead analyzes root cause, estimates fund impact
4. Communicate	Post incident notice to community channels (Discord, Twitter, Telegram)
5. Fix	Deploy fix or prepare recovery plan
6. Resume	Call `unpause()` after fix verified on fork — or migrate to new contract
7. Post-mortem	Publish detailed incident report within 48 hours

DeFi Testing Reference

Test Scenario	Approach
Fuzz test fund flows	Run fuzz tests on staking/pool contracts with high iterations (10000+)
Fork mainnet testing	Use Foundry fork mode against mainnet RPC to test with real state
Simulate whale transaction	Use Foundry cast CLI to simulate large-amount calls on a forked network

Weekly Installs

Repository

0xlayerghost/so…gent-kit

GitHub Stars

First Seen

Feb 9, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Installed on

claude-code33

opencode27

codex27

gemini-cli27

cursor27

github-copilot24

DeFi安全防护指南：智能合约安全原则、漏洞防护与上线检查清单

🇨🇳中文介绍

DeFi 安全原则

语言规则

防护决策规则

相关 Skills

反巨鲸实施规则

闪电贷防护规则

协议可组合性风险

上线检查清单

应急响应流程

DeFi 测试参考