evm-audit-master

name: evm-audit-master description: Master index for EVM smart contract security audit skills. Load this FIRST for every audit to determine which specialized skills to load. Contains routing table and audit methodology.

EVM Smart Contract Security Audit — Master Index

How To Use

1. Always load this skill first for any EVM smart contract audit
2. Read the contract(s) under audit
3. Use the routing table below to load relevant specialized skills
4. Walk through each loaded skill's checklist systematically

All 20 Skills — Definitive Index

Total: 500+ checklist items across 19 specialized skills + 1 master index

Routing Table — Which Skills To Load

Audit Methodology

Phase 1: Reconnaissance

1. Fetch all contract files (raw GitHub URL or local path)
2. Identify all contract files, entry points, and external dependencies
3. Map inheritance hierarchy and proxy relationships
4. Identify all external calls and token interactions
5. Note the target deployment chain(s)

Phase 2: Skill Selection

Load evm-audit-general + evm-audit-precision-math (always), then add skills based on the routing table above. For a typical DeFi protocol, expect to load 6-8 skills.

Phase 3: Spawn Parallel Sub-Agents

Spawn one opus sub-agent per selected skill. Do not run skills sequentially in the main session — parallel agents produce dramatically better results by keeping each agent's context focused.

Each agent receives:

• The full contract source
• Their one checklist (read from references/checklist.md)
• The standard finding format (below)
• Output path: audits/<repo>-<date>/findings-<skill>.md

Wait for all agents to complete, then proceed to Phase 4.

Phase 4: Synthesis

Read all findings-*.md files. Deduplicate findings that multiple agents flagged. Check for cross-cutting concerns:

• Interactions between finding categories (e.g., oracle manipulation + liquidation)
• State machine consistency across all state transitions
• Economic attack vectors combining multiple findings Write final AUDIT-REPORT.md with all findings ranked by severity.

Phase 5: File Issues (if repo provided)

Run gh issue create --repo <owner/repo> for every finding Medium severity and above. Skip Info and Low unless explicitly asked. Each issue title should be prefixed: [Critical], [High], or [Medium].

Standard Finding Format

Every sub-agent and the synthesis step MUST use this exact format. No deviations.

## [X-N] Title
**Severity**: Critical / High / Medium / Low / Info
**Category**: [skill name that caught this]
**Location**: `functionName()` or file:line
**Description**: What the issue is and why it matters. Be specific — name the variable, line, or pattern.
**Proof of Concept**: Exact steps to trigger or exploit. If not exploitable, explain the failure mode.
**Recommendation**: Concrete fix with code snippet where possible.

Severity definitions (use these, not your own judgment):

• Critical: Direct loss of funds by a third party, no preconditions
• High: Loss of funds requiring specific conditions, or permanent DoS
• Medium: Degraded behavior, trust model violation, incorrect accounting, or owner-only fund loss
• Low: Best practice violation, latent bug, or confusing behavior without direct fund risk
• Info: Informational, no security impact

Source Attribution Key

• [beirao] — beirao.xyz audit checklist
• [Dacian] — dacian.me security articles (8 deep-dive articles covering liquidation, CLM, slippage, precision, signatures, governance, assembly, lending)
• [Devdacian Primer] — devdacian/ai-auditor-primers GitHub (base.primer.md — comprehensive 33KB primer)
• [Decurity AMM/CDP/LSD] — Decurity protocol-specific checklists
• [weird-erc20] — d-xo/weird-erc20 repository
• [multichain-auditor] — 0xJuancito multichain auditor
• [SigmaPrime] — Sigma Prime security blog (governance, oracles, liquid restaking articles)
• [RareSkills] — RareSkills security articles (smart contract security, UUPS proxy)
• [Cyfrin] — Cyfrin/Dacian Chainlink oracle security article
• [ERC4626 checklist] — ERC4626 security checklist
• [ERC4626 primer] — ERC4626 vulnerability primer (85+ patterns)
• [ERC4337 checklist] — Account abstraction security checklist
• [Hacken UniV4] — Hacken Uniswap V4 hooks audit guide
• [LayerZeroV2 checklist] — LayerZero V2 security checklist
• [CCIP checklist] — Chainlink CCIP best practices
• [Wormhole checklist] — Wormhole integration security
• [Across checklist] — Across Protocol integration guide
• [Spearbit bridge] — Spearbit bridge security checklist
• [mixbytes CREATE2] — MixBytes CREATE2 security analysis
• [SWC-XXX] — Smart Contract Weakness Classification registry (superseded by EEA EthTrust)
• [Arbitrum docs] — Arbitrum official documentation
• [Blast docs] — Blast L2 documentation