DeFi Protocol Security Audit Framework
Systematic DeFi security audits identifying vulnerabilities, economic attacks, and composability ...
What You Can Do
You can conduct comprehensive security audits of DeFi protocols by analyzing smart contract code for technical vulnerabilities (reentrancy, integer overflow, authorization flaws), simulating economic attacks (flash loan exploits, sandwich attacks, liquidation cascades), and identifying second-order composability risks that could lead to protocol failure. Claude acts as your interactive analysis partner, pattern-matching known vulnerabilities and helping you model attack scenarios before external audits or mainnet deployment.
Features
Identifies reentrancy, integer overflow/underflow, improper authorization, and access control flaws in smart contracts
Analyzes flash loan exploits, sandwich attacks, liquidation cascades, and other economic manipulation vectors
Maps protocol interactions with external contracts and identifies oracle dependency failures and integration vulnerabilities
Iteratively develop attack scenarios and test protocol resilience against multi-step exploit chains
Creates audit reports, vulnerability descriptions, and remediation recommendations for governance proposals
Recognizes common DeFi patterns (AMM mechanics, lending pool logic, yield strategies) and their associated risk vectors
Systematically deconstructs exploited protocols to understand attack surface and prevent future incidents
Example Output
Example 1: Reentrancy Vulnerability Detection
Vulnerability: Reentrancy in withdraw() function
Severity: CRITICAL
Location: contract/Vault.sol:142
Issue: External call to user contract before state update allows attacker to recursively call withdraw() and drain funds
Proof of Concept: [detailed attack scenario]
Remediation: Add nonReentrant modifier or update state before external call
Example 2: Economic Attack Analysis
Attack Type: Flash Loan Liquidation Cascade
Entry Point: Borrower takes flash loan on AAVE
Mechanism: Borrows 100M USDC, swaps for ETH on Uniswap (causes price slippage), triggers liquidation cascade in lending protocol
Impact: Protocol loses $5M+ in bad debt
Preventative Measures: Oracle circuit breakers, liquidation caps, time delays
Example 3: Composability Risk
Risk: Stale oracle prices in yield aggregator
Scenario: Aggregator pulls price from Chainlink without staleness checks, composing with another protocol that relies on fresh prices
Failure Mode: Price manipulation leads to incorrect yield calculations and fund loss
Mitigation: Implement staleness checks, add multiple oracle sources
What's Included
- SKILL.md: Complete security audit framework with methodology and phase definitions
- DeFi Vulnerability Checklist: Technical, economic, and composability risk categories with specific vulnerability types to test for each
- Code Analysis Template: Structured prompts for analyzing smart contracts, identifying patterns, and flagging risk areas
- Threat Modeling Worksheet: Attack tree framework for modeling multi-step exploits and cascade scenarios
- Audit Report Generator: Template for documenting findings, severity levels, and remediation steps for governance or external auditors
Who It's For
- DeFi protocol developers — Build security into smart contract development before mainnet deployment
- Smart contract security engineers — Conduct internal audits and identify vulnerabilities at scale
- Protocol architects — Assess composability risks and design safer DeFi primitives
- Governance token holders — Understand security findings in audit reports and make informed voting decisions
- Web3 risk managers — Evaluate protocol safety before allocating capital or integrating into yield strategies
Best For
- Pre-deployment security reviews of new DeFi protocols and smart contracts
- Analyzing economic attack vectors and simulating multi-step exploit scenarios
- Identifying composability failures and oracle dependency risks
- Post-mortem investigation of exploited protocols and incident analysis
- Creating audit documentation and remediation recommendations for governance proposals
You might also like
You can conduct comprehensive security audits of Solidity smart contracts by submitting code for systematic analysis across vulnerability categories, gas optimization, and best practice compliance. Claude identifies critical issues like reentrancy attacks, integer overflow/underflow, improper access controls, and unoptimized patterns—providing actionable findings with severity levels and remediation guidance. This skill works best as a pre-audit screening tool to catch issues before engaging professional auditors.
by autoclaw-cc
You can conduct comprehensive security audits of Solidity smart contracts by identifying common vulnerabilities like reentrancy bugs, overflow/underflow issues, and access control gaps. The skill applies OWASP Smart Contract Top 10 patterns and ERC token standards compliance checks to catch critical flaws before deployment, helping you optimize gas usage and strengthen contract architecture.
by autoclaw-cc
You can conduct comprehensive security assessments of smart contracts by feeding Claude modular contract code with explicit vulnerability analysis frameworks. Claude traces execution paths, identifies state management issues, evaluates cryptographic implementations, and spots economic model exploits. This structured approach catches interdependencies and subtle design flaws that surface-level reviews miss, making it ideal for pre-deployment audits and incident investigations.
by autoclaw-cc
You can comprehensively analyze bridge architectures across multiple dimensions—from transfer models and custody mechanisms to validator infrastructure and liquidity strategies. This skill guides you through systematic security evaluation, protocol comparison, and vulnerability identification to design resilient cross-chain solutions aligned with your risk tolerance and technical constraints.
by autoclaw-cc
This skill audits support interactions using customer support-specific evaluation frameworks that assess tone, empathy, technical accuracy, resolution quality, and compliance adherence. You receive detailed scoring against rubrics, identification of coaching opportunities with actionable feedback, compliance verification against regulatory requirements, and quality trend analysis to improve overall team performance.
by autoclaw-cc
You can design novel consensus mechanisms or modify existing protocols (PoW variants, PoS schemes, hybrid models) while systematically evaluating their security, economic incentives, and attack resistance. The framework guides you through specification, formal verification, threat modeling, economic security simulation, and production-readiness assessment—identifying vulnerabilities in consensus logic, incentive structures, and Byzantine fault tolerance guarantees before mainnet launch.
by autoclaw-cc
This skill runs rigorous financial analysis on your specific situation, calculating break-even points, NPV, IRR, and long-term wealth impact while factoring in behavioral and lifestyle considerations that pure math misses. You get a clear recommendation backed by numbers, scenario comparisons showing what happens if markets shift, and a detailed breakdown of when buying becomes better than renting.
by autoclaw-cc
You can design, validate, and document cross-chain protocols by evaluating bridge architectures (lock-and-mint, liquidity networks, light clients, relayers), modeling transaction flows with failure scenarios, identifying atomic swap vulnerabilities, and creating implementation roadmaps. This skill helps you make rigorous architectural decisions backed by security analysis and stakeholder alignment across your interoperability stack.
by autoclaw-cc