auditsentry

Plugin auditsentry from marketplace auditsentry in iktok90-design/ai-smart-contract-auditor. Commands read from the repo's manifest — 1 month ago.

Skills (52)

• example-fork-detection

  TEMPLATE — replace with the description of your rule. Should activate on the specific code patterns your fork has. Activate on `<your trigger keywords or function names>`.

• solady-erc20-permit2-assumptions

  Detect unsafe assumptions about Solady's gas-optimized ERC20/ERC2612 permit and DN404 metadata. Solady's ERC20 uses custom storage slots, returns bools via assembly, exposes a virtual `_constantNameHash`/`_versionHash` for permit domain separation, and its DN404 mirror splits ERC20/ERC721 logic — in

• solady-ownable-init-frontrun

  Detect front-runnable ownership initialization in Solady Ownable / OwnableRoles. Solady's `_initializeOwner` is a guarded one-time setter (it reverts with `AlreadyInitialized` on a second call) but it is NOT access-controlled, so in constructor-less deployment paths (minimal-proxy clones, EIP-1167,

• solady-safetransferlib-no-contract-check

  Detect Solady SafeTransferLib calls that assume the token has code. SafeTransferLib.safeTransfer/safeTransferFrom/safeApprove deliberately skip the EXTCODESIZE check that OpenZeppelin's SafeERC20 performs, so a call to an EOA or a self-destructed/not-yet-deployed token address returns success with n

• v4-hook-delta-accounting

  Detect Uniswap V4 hooks that fail to settle currency deltas with the PoolManager. Every credit/debit a hook creates (BeforeSwapDelta, afterSwap hookDelta, take/mint, donate, settle/sync) is tracked in the manager's transient nonzeroDeltaCount; if the books aren't flat when unlock returns, the whole

• v4-hook-permission-flags-mismatch

  Detect Uniswap V4 hooks whose address-encoded permission flags don't match the callbacks the hook actually implements. In V4 the hook's permissions live in the low bits of its deployed address (mined via CREATE2 salt) and must agree with getHookPermissions(); a callback the hook implements but whose

• v4-hook-reentrancy-via-unlock

  Detect reentrancy in Uniswap V4 hooks via the PoolManager unlock/lock callback. V4 uses a singleton PoolManager with transient lock state; all pool mutations happen inside an unlockCallback. A hook that makes external calls during beforeSwap/afterSwap/before*Liquidity (to tokens with hooks, arbitrar

• access-control

  Detect missing or incorrect access control — missing modifiers, wrong role checks, privileged function exposure, public initializers, and role-escalation paths. Activate on any function that mutates state, transfers funds, mints tokens, sets admin parameters, upgrades implementations, or pauses/unpa

• approval-issues

  Detect ERC-20 approval pitfalls — approve race (front-run), missing safeApprove, infinite approvals, approval-without-revoke, Permit2 misuse, max-approval to untrusted contracts. Activate on `approve`, `safeApprove`, `permit`, `forceApprove`, `Permit2`, `IERC20.allowance`.

• caching-and-incremental

  Always-on meta-skill — cache audit results per file by content hash so unchanged files aren't re-analyzed on subsequent runs. Activate on every /audit, /quick-scan, /audit-changes invocation.

• centralization-risk

  Detect centralization and trust-assumption risks — admin powers, single-key risk, missing timelocks, upgrade authority, treasury keys, pause permanence, blacklisting authority, oracle authority. Activate on `onlyOwner`, `onlyRole`, `AccessControl`, upgrade authorizations, pause/unpause functions, mi

• confidence-scoring

  Always-on meta-skill — for every finding produced, attach a confidence level (HIGH/MEDIUM/LOW) and a reasoning trace. Activate on every /audit, /audit-deep, /audit-changes, /audit-live, /quick-scan invocation.

• cosmwasm
• cross-chain-messaging
• cross-contract-state
• delegatecall-risks
• diamond-eip2535
• dos-vectors
• erc1271-contract-signatures
• erc4337-account-abstraction
• erc4626-inflation
• false-positive-feedback-loop
• fee-on-transfer
• flash-loan-attacks
• initialization
• inline-assembly
• integer-issues
• intents-erc7683
• known-good-comparison
• liquidation-cascade
• mev-frontrunning
• mev-pbs
• multi-pass-self-critique
• oracle-manipulation
• oracle-redundancy
• permit2-patterns
• pragma-and-addresses
• progress-and-streaming
• reentrancy
• restaking-eigenlayer
• selfdestruct-eip6780
• signature-malleability
• signature-replay
• solana-anchor
• storage-layout
• stylus-rust
• token-compatibility
• tx-context-misuse
• unchecked-calls
• ve-lock-governance
• vyper-specific
• zk-verifier-bugs

Slash commands (45)

• /auditsentry:audit-changes

  Audit only the git diff vs main (or specified base). Optimized for PR review.

• /auditsentry:audit-deep

  Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.

• /auditsentry:audit-deps

  Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code that has diverged from upstream.

• /auditsentry:audit-diff

  Diff two AuditSentry audit reports (before vs after) to track regressions — what's new, what's fixed, and whether the grade moved.

• /auditsentry:audit-history

  Pull past public audits (Code4rena, Sherlock, Spearbit, etc.) for a deployed contract or known protocol.

• /auditsentry:audit-live

  Audit a deployed contract on a live chain. Pulls verified source from the block explorer, optionally forks the chain for live-state simulation.

• /auditsentry:audit-multi-chain

  Diff the on-chain configuration of one contract deployed across multiple chains — owner, oracle, fees, timelock, pause state, proxy impl — and flag the chain that drifted.

• /auditsentry:audit-strict

  Multi-pass consensus audit — runs the audit twice with different prompts, only reports consensus findings. Aggressively cuts false positives.

• /auditsentry:audit

  Full security audit of a Solidity/Vyper/Rust contract or directory. Runs the entire vuln-skills library and dispatches DeFi specialist subagents based on detected protocol type.

• /auditsentry:bounty-submit

  Submit a finding to a bug-bounty platform (Immunefi, Cantina) automatically.

• /auditsentry:bounty

  Generate a responsible-disclosure bounty submission from a confirmed finding — Immunefi / protocol bounty / SEAL 911 formats.

• /auditsentry:card

  Generate a shareable PNG audit card from the latest /audit. Optimized for social media.

• /auditsentry:coverage

  Run forge coverage, identify untested branches, generate tests to close gaps.

• /auditsentry:demo

  Run AuditSentry against the bundled vulnerable example contracts — first-run "wow moment".

• /auditsentry:diff-audit

  Diff the contract against a canonical reference implementation (OZ, Solady, Uniswap V3, etc.) and flag suspicious deltas.

• /auditsentry:dismiss

  Mark a finding as a false positive (or accepted risk). Future audits won't re-report it.

• /auditsentry:explain

  Explain a finding in plain English, with examples. Optionally tailored to a beginner audience.

• /auditsentry:exploit-chain

  Chain multiple findings into a single multi-step exploit. Produces a Foundry test that proves the chain works.

• /auditsentry:exploit-live

  Generate an exploit against a *deployed* contract on a fork. Validates the exploit works on live state.

• /auditsentry:exploit

  Generate a working Foundry PoC that exploits a specific finding. Compiles and passes.

• /auditsentry:fuzz

  Generate property-based fuzz tests for a specific function.

• /auditsentry:gas

  Gas profile — find expensive operations and suggest optimizations with before/after numbers.

• /auditsentry:invariant

  Generate Foundry invariant tests for property-based fuzzing. The high-value command for serious teams.

• /auditsentry:mint-cert

  Mint a soulbound Audit Certificate NFT on Berachain (or other supported chain) for a completed audit.

• /auditsentry:monitor

  Set up post-deployment monitoring — recommend which on-chain events to alert on and scan recent activity for high-severity changes.

• /auditsentry:mythril

  Run Mythril (symbolic execution) and have Claude triage its findings — turn symbolic counter-examples into Foundry PoCs.

• /auditsentry:notify-discord

  Post the latest /audit results to a Discord channel via webhook.

• /auditsentry:notify-slack

  Post the latest /audit results to a Slack channel via incoming webhook.

• /auditsentry:pre-deploy

  Interactive pre-launch security checklist — walk the operational and code-safety gates and produce a final GO / NO-GO with each item PASS / FAIL / N-A.

• /auditsentry:prover

  Formal verification entrypoint — prove a property holds for all inputs with Halmos (symbolic, offline) or Certora (CVL) using ready-made property templates.

• /auditsentry:quick-scan

  Fast pre-commit-grade scan. Only catches Critical and High. Optimized for hooks.

• /auditsentry:remediate

  Generate code patches that fix one or more findings. Outputs as a unified diff and (optionally) applies it.

• /auditsentry:replay-incident

  Replay a historical exploit tx (by tx hash) on a fork. Explains step-by-step what the attacker did.

• /auditsentry:report

  Render the latest audit as a deliverable report in Markdown / HTML / PDF / JSON / PNG.

• /auditsentry:rug-check

  Fast owner-power / rugability scan — score how much unilateral control the deployer holds and return a 0-100 rug-risk verdict.

• /auditsentry:rugproof-init

  60-second onboarding — set up .auditsentry.yml, choose severity profile, configure hooks, pick supported chains.

• /auditsentry:score

  Compute a AuditSentry grade (A+ → F) for the contract or repo based on findings from /audit.

• /auditsentry:simulate

  Multi-actor, multi-block simulation against a live fork. Stateful attack sequences across many txs.

• /auditsentry:slither

  Run Slither and have Claude triage its findings — separate true positives from false positives, write PoCs for real bugs.

• /auditsentry:symbolic

  Symbolic execution via Halmos. For paths that fuzzing cannot reach.

• /auditsentry:test-gen

  Generate a Foundry test suite — happy path + edge cases + adversarial tests — for a contract or function.

• /auditsentry:tweet

  Compose a tweet from the latest audit. Either auto-posts (if Twitter API creds set) or generates a one-click intent URL.

• /auditsentry:upgrade-safety

  Check storage compatibility, initializer changes, and admin-function deltas between two implementations of an upgradeable contract.

• /auditsentry:verify-deploy

  Verify deployed bytecode matches the source you have, with correct constructor args.

• /auditsentry:verify-finding

  Second-opinion mode — re-check a specific finding with deeper analysis. Triages true vs false positives.

Subagents (23)

• aa-specialist

  Account-Abstraction (ERC-4337) specialist. EntryPoint, Bundler, Paymaster, smart-wallet (SimpleAccount, Safe-AA, Kernel, Biconomy), session keys, EIP-7702 transitions. Use when target involves UserOperation, validateUserOp, paymaster validation, or AA wallet logic.

• amm-specialist

  AMM-specific audit specialist. Uniswap V2/V3/V4, Curve, Balancer, Berachain BEX, custom AMMs. Use when the target is an AMM, pool, router, or AMM fork. V4 hooks get special attention.

• assembly-auditor

  Specialist for inline assembly / Yul. Reviews memory layout, return-data handling, dirty-bits, opcode usage. Use whenever significant assembly is present.

• attacker

  Adversarial reviewer. Reads contract code with one goal — find a way to steal, brick, or grief. Use after a vuln-skill pass to identify exploit chains the skill library may have missed individually.

• bridge-specialist

  Bridge-specific specialist. Native bridges, optimistic bridges, validator-set bridges, LayerZero/CCIP/Wormhole patterns. Use whenever cross-chain message-passing is involved.

• crosschain-messaging-specialist

  Specialist for cross-chain messaging primitives — LayerZero V2, Chainlink CCIP, Hyperlane, Wormhole, Axelar, Polyhedra ZKBridge, native rollup messengers. Distinct from bridge-specialist (which focuses on asset bridges); this focuses on the underlying message passing layer.

• defender

  Blue team. Identifies missing defenses, weak invariants, and remediation gaps. Use alongside attacker for balanced review.

• economic-rug-specialist

  Rug-pull, tokenomics, and centralization deep-dive. Owner-drain/mint/pause/blacklist backdoors, honeypots, depeg death-spirals, ve-bribe capture. Emits a 0-100 rugability score. Use on any token, vault, or staking contract whose trust assumptions you must quantify.

• exploit-poc-writer

  Writes Foundry test files that prove an exploit. The test MUST compile and pass. Use from /exploit, /exploit-chain, /exploit-live.

• gas-optimizer

  Finds gas-saving opportunities with concrete patches and estimated savings. Use from /gas.

• governance-specialist

  Governance specialist. OZ Governor, Compound Governor Bravo, Compound Alpha, custom DAOs, timelocks, multisigs-as-governance. Use when target involves voting, proposing, executing.

• intents-specialist

  Intent-based protocol specialist — ERC-7683 (cross-chain intents), CoW Protocol, UniswapX, Across, 1inch Fusion. Use when target involves intents, solvers, settlers, or any "user signs intent → solver fills" pattern.

• invariant-writer

  Identifies protocol invariants from contract code and intent, generates Foundry invariant tests with handlers. Use from /invariant and /audit-deep.

• l2-sequencer-specialist

  L2/rollup-risk specialist. Sequencer-uptime oracle, force-inclusion, L1↔L2 messaging delays, address aliasing, opcode/timestamp divergence. Use when the target deploys to Arbitrum, OP-stack, zkSync, Scroll, or Linea.

• lending-specialist

  Lending-protocol specialist. Aave V3, Compound V3, Morpho, Silo, Euler, custom lending. Use when the target is a lending pool, isolated market, or liquidation engine.

• nft-specialist

  NFT specialist — ERC-721, ERC-1155, royalties (ERC-2981, EIP-7585), metadata mutability, mint mechanics, marketplaces. Use when target is an NFT contract or NFT-adjacent.

• remediation-suggester

  Writes patches that fix specific findings. Validates via forge build + test. Use from /remediate.

• report-writer

  Writes the final audit report (Markdown + HTML + JSON) from raw findings. Used by /report. Produces polished prose without consuming main context.

• restaking-specialist

  Restaking and AVS specialist — EigenLayer, Symbiotic, Karak, Babylon, AVS implementations, operator slashing. Use when target involves restaking deposits, operator delegation, AVS registration, or slashing.

• staking-specialist

  Staking-protocol specialist. Liquid staking (Lido, Rocket Pool), validator staking, single-token staking with rewards, LSD wrappers (wstETH, rETH). Use when target is a staking contract.

• vyper-specialist

  Vyper-language specialist. Compiler-version bugs, decorator semantics, raw_call/create_from_blueprint, no-inheritance auth. Use when any contract is written in Vyper (.vy) — especially Curve-ecosystem pools.

• yield-aggregator-specialist

  Yield aggregator and ERC-4626 specialist. Yearn V3, Beefy, Sommelier, MetaMorpho, custom vaults with strategies. Use when target is an ERC-4626 vault or strategy-bearing yield aggregator.

• zk-verifier-specialist

  ZK proof-verifier contract specialist. Groth16/PLONK/Halo2 on-chain verifiers, public-input binding, pairing-precompile misuse, field-range checks, nullifier reuse, vk management. Use on any contract that calls ecPairing/ecAdd/ecMul to verify a SNARK.

MCP servers (13)

• block-explorer

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/block-explorer-mcp/dist/index.js

• forge-runner

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/forge-runner-mcp/dist/index.js

• hardhat-runner

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/hardhat-runner-mcp/dist/index.js

• anvil

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/anvil-mcp/dist/index.js

• tenderly

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/tenderly-mcp/dist/index.js

• c4-history

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/c4-history-mcp/dist/index.js

• sherlock-history

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/sherlock-history-mcp/dist/index.js

• gas-tracker

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/gas-tracker-mcp/dist/index.js

• token-metadata

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/token-metadata-mcp/dist/index.js

• slither-runner

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/slither-runner-mcp/dist/index.js

• mythril-runner

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/mythril-runner-mcp/dist/index.js

• fuzz-runner

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/fuzz-runner-mcp/dist/index.js

• monitoring

  runs: node ${CLAUDE_PLUGIN_ROOT}/mcp/monitoring-mcp/dist/index.js

Hooks (2)

• PreToolUse

  ${CLAUDE_PLUGIN_ROOT}/hooks/pre-deploy-check.sh

• PostToolUse

  ${CLAUDE_PLUGIN_ROOT}/hooks/post-test-coverage.sh

Similar plugins