重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
defi-security by 0xlayerghost/solidity-agent-kit
npx skills add https://github.com/0xlayerghost/solidity-agent-kit --skill defi-security适用范围:仅适用于 DeFi 项目(DEX、借贷、质押、流动性提供、收益)。非 DeFi 项目可忽略此技能。
| 威胁 | 所需防护措施 |
|---|---|
| 巨鲸操纵 | 每日交易上限 + 单笔交易金额限制 + 冷却窗口 |
| MEV / 三明治攻击 | 仅限外部账户检查(msg.sender == tx.origin),或使用提交-揭示模式 |
| 套利 | 推荐绑定 + 流动性分配 + 固定收益模型 + 锁定期 |
| 重入攻击 | 在所有外部调用函数上使用 ReentrancyGuard(参见 solidity-security 技能) |
| 闪电贷攻击 | 检查操作之间的 block.number 变化,或使用 TWAP 定价 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 价格操纵 | 使用 Chainlink 预言机或 TWAP — 切勿依赖现货 AMM 储备金进行定价 |
| 授权漏洞 | 使用 safeIncreaseAllowance / safeDecreaseAllowance,在用户流程中切勿使用原始的 approve |
| 治理攻击 | 投票需要快照 + 最低代币持有期;提案执行需设置时间锁 ≥ 48 小时 |
| ERC4626 通胀攻击 | 首次存款必须强制执行最低金额或使用虚拟份额,以防止因舍入导致的份额稀释 |
| 跨金库信任绕过 | Router/Registry 中继必须验证金库授权;在闪电贷回调中切勿信任调用者身份 — EVMbench/noya H-08 |
| 抵押品所有权漏洞 | 清算/质押操作必须验证实际的 NFT/抵押品所有权 — EVMbench/benddao |
| 绑定曲线操纵 | 创建操作中的 ID/定价参数必须在外部调用前完全确定 — EVMbench/phi H-06 |
DEX 交易对 _transfer TOCTOU | 切勿在 _transfer 中通过余额/储备金检查来区分操作类型 — 两个方向都可能被利用:买入 vs 移除流动性(pair→user)和卖出 vs 添加流动性(user→pair);仅使用地址白名单;新项目建议使用 Uniswap V4 Hook |
onlyOwner setter 函数配置mapping(address => mapping(uint256 => uint256)) 跟踪(地址 → 天数 → 金额)block.timestamp 检查强制执行最小时间间隔block.number 已发生变化来源:EVMbench (OpenAI/Paradigm, Feb 2026) — 来自 Code4rena 审计的漏洞模式
主网部署前,验证所有项目:
onlyOwner 函数已转移至多签钱包| 步骤 | 行动 |
|---|---|
| 1. 检测 | 监控警报触发(链上监控、社区报告) |
| 2. 暂停 | 指定地址调用 pause() — 必须在几分钟内响应 |
| 3. 评估 | 技术负责人分析根本原因,估算资金影响 |
| 4. 沟通 | 向社区渠道(Discord、Twitter、Telegram)发布事件通知 |
| 5. 修复 | 部署修复程序或准备恢复计划 |
| 6. 恢复 | 在分叉网络上验证修复后调用 unpause() — 或迁移至新合约 |
| 7. 事后分析 | 48 小时内发布详细事件报告 |
| 测试场景 | 方法 |
|---|---|
| 模糊测试资金流 | 对质押/资金池合约运行高迭代次数(10000+)的模糊测试 |
| 分叉主网测试 | 使用 Foundry 分叉模式连接主网 RPC,在真实状态下进行测试 |
| 模拟巨鲸交易 | 使用 Foundry cast CLI 在分叉网络上模拟大额调用 |
每周安装次数
41
代码仓库
GitHub 星标数
1
首次出现
2026年2月9日
安全审计
已安装于
claude-code33
opencode27
codex27
gemini-cli27
cursor27
github-copilot24
Scope : Only applicable to DeFi projects (DEX, lending, staking, LP, yield). Non-DeFi projects can ignore this skill.
| Threat | Required Protection |
|---|---|
| Whale manipulation | Daily transaction caps + per-tx amount limits + cooldown window |
| MEV / sandwich attack | EOA-only checks (msg.sender == tx.origin), or use commit-reveal pattern |
| Arbitrage | Referral binding + liquidity distribution + fixed yield model + lock period |
| Reentrancy | ReentrancyGuard on all external-call functions (see solidity-security skill) |
| Flash loan attack | Check block.number change between operations, or use TWAP pricing |
| Price manipulation | Chainlink oracle or TWAP — never rely on spot AMM reserves for pricing |
| Approval exploit | Use safeIncreaseAllowance / safeDecreaseAllowance, never raw approve for user flows |
| Governance attack | Voting requires snapshot + minimum token holding period; timelock ≥ 48h on proposal execution |
| ERC4626 inflation attack | First deposit must enforce minimum amount or use virtual shares to prevent share dilution via rounding |
| Cross-vault trust bypass | Router/Registry relay must verify vault authorization; never trust caller identity inside flash loan callbacks — EVMbench/noya H-08 |
| Collateral ownership exploit | Liquidation/staking operations must verify actual NFT/collateral ownership — EVMbench/benddao |
| Bonding curve manipulation | ID/pricing params in create operations must be fully determined before external calls — EVMbench/phi H-06 |
DEX pair _transfer TOCTOU | Never distinguish operation type by balance/reserve checks in _transfer — both directions are exploitable: buy vs removeLiquidity (pair→user) and sell vs addLiquidity (user→pair); use address whitelist only; new projects prefer Uniswap V4 Hook |
onlyOwner settermapping(address => mapping(uint256 => uint256)) (address → day → amount)block.timestamp checkblock.number has changed since last interactionSource: EVMbench (OpenAI/Paradigm, Feb 2026) — vulnerability patterns from Code4rena audits
msg.sender actually owns or is authorized to operate on target collateralBefore mainnet deployment, verify all items:
onlyOwner functions transferred to multisig wallet| Step | Action |
|---|---|
| 1. Detect | Monitor alerts trigger (on-chain monitoring, community reports) |
| 2. Pause | Designated address calls pause() — must respond within minutes |
| 3. Assess | Technical lead analyzes root cause, estimates fund impact |
| 4. Communicate | Post incident notice to community channels (Discord, Twitter, Telegram) |
| 5. Fix | Deploy fix or prepare recovery plan |
| 6. Resume | Call unpause() after fix verified on fork — or migrate to new contract |
| 7. Post-mortem | Publish detailed incident report within 48 hours |
| Test Scenario | Approach |
|---|---|
| Fuzz test fund flows | Run fuzz tests on staking/pool contracts with high iterations (10000+) |
| Fork mainnet testing | Use Foundry fork mode against mainnet RPC to test with real state |
| Simulate whale transaction | Use Foundry cast CLI to simulate large-amount calls on a forked network |
Weekly Installs
41
Repository
GitHub Stars
1
First Seen
Feb 9, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
claude-code33
opencode27
codex27
gemini-cli27
cursor27
github-copilot24
Lark Mail CLI 使用指南:邮件管理、安全规则与自动化工作流
47,900 周安装
DynamoDB-Toolbox v2 TypeScript 模式指南:单表设计与类型安全CRUD
167 周安装
自动化生命科学API发现与工具创建 | 生物信息学API集成与验证工作流
167 周安装
.NET 架构师专家:C#、ASP.NET Core、微服务与云原生架构设计与优化
170 周安装
Tauri v2 桌面应用开发指南:Rust 核心与 WebView 前端构建跨平台应用
168 周安装
单元测试框架指南:AAA模式、最佳实践与多语言示例
170 周安装
TypeScript React 模式指南:35+规则构建类型安全、可维护的React应用
167 周安装