SkillsLib.ai

Move/Rust Smart Contract Audit Reviewer

Audit Move/Rust smart contracts for vulnerabilities and optimization gaps

3.9(34 reviews)
100+ downloads
Updated Oct 2026
Verified SafeSecurity VerifiedThis skill was analyzed by our AI security scanner for harmful content including data exfiltration, system manipulation, credential theft, and prompt injection. No threats were detected.
by oss-apps
Blockchain & Web3DevelopmentSmart Contract DeveloperRust/Move

What You Can Do

Conduct comprehensive security reviews of Move and Rust smart contract code to catch vulnerabilities before mainnet deployment. Claude analyzes resource handling, witness access patterns, input validation, privilege escalation vectors, memory safety concerns, and arithmetic operations—providing concrete code remediation examples and optimization recommendations tailored to Aptos, Solana, Substrate, and Cosmos ecosystems.

Features

Resource Model Validation

Detects improper resource handling, capability misuse, and unauthorized witness access patterns specific to Move's type system

Vulnerability Detection

Identifies reentrancy risks, arithmetic overflow/underflow, memory safety issues, and cross-program invocation (CPI) vulnerabilities in Rust contracts

Input Validation Audit

Flags insufficient parameter checking, type coercion risks, and boundary condition gaps that could enable exploitation

Gas & Computational Optimization

Pinpoints inefficient loops, unnecessary storage operations, and algorithmic improvements to reduce transaction costs

Privilege Escalation Analysis

Maps module initialization flows and capability distribution to uncover unauthorized access vectors

Code Remediation Examples

Generates corrected code snippets with explanations for each identified issue

Architecture Assessment

Reviews module dependencies, state management patterns, and cross-contract interactions for design weaknesses

Compliance Checking

Validates adherence to Move's resource constraints and Rust blockchain best practices

Example Output

Input: A Move contract's fund transfer function

Claude's Audit Output:

Finding #1: Insufficient Input Validation (MEDIUM)

Location: transfer() function, line 24 Issue: No validation that amount > 0; allows zero-value transfers that waste gas and pollute transaction history Remediation:

code
public fun transfer(from: &signer, to: address, amount: u64) {
    assert!(amount > 0, E_ZERO_AMOUNT); // Add this check
    // ... rest of function
}

Finding #2: Missing Access Control (HIGH)

Location: withdraw_reserve() function, line 42 Issue: Function lacks signer validation; any account can drain reserve funds Impact: Critical privilege escalation vulnerability Remediation: Require signer to be contract owner via capability pattern

Gas Optimization #1: Loop Inefficiency

Savings: ~15% reduction in transaction cost Move inner loop condition outside outer loop iteration

What's Included

  • SKILL.md instruction file with audit framework and prompting patterns:
  • Move Security Checklist: Resource model, capability, and privilege escalation audit points
  • Rust Contract Audit Template: Memory safety, arithmetic, and CPI vulnerability assessment matrix
  • Remediation Code Examples: Corrected patterns for common Move and Rust contract issues
  • Gas Optimization Benchmark: Refactoring suggestions with estimated efficiency gains

Who It's For

  • Rust/Move Smart Contract Developers — Conducting pre-deployment security reviews on own contracts
  • Blockchain DevOps & Release Engineers — Validating contract code before testnet and mainnet launches
  • DeFi Protocol Teams — Systematic auditing of core contract modules before institutional deployment
  • Solana/Substrate/Aptos Developers — Language-specific vulnerability detection for ecosystem contracts
  • Security-Conscious Founders — Risk assessment of contracts before raising capital or launching tokens

Best For

  • Pre-deployment security reviews of new Move and Rust smart contracts
  • Identifying resource handling and privilege escalation vulnerabilities in Move modules
  • Gas optimization and computational efficiency analysis of blockchain transactions
  • Auditing cross-program invocation (CPI) patterns in Solana contracts
  • Validating input sanitization and boundary condition handling across contract functions
  • Assessing module initialization security and capability distribution models

You might also like

Integration Spec
$30
Integration4.2(49)
Integration Spec

You'll generate detailed integration specifications that bridge business requirements and technical implementation. The skill documents API endpoints and contracts, defines field-by-field data transformations with business rules, specifies error handling and retry strategies, and establishes SLAs with monitoring criteria—giving development teams everything needed to build production-ready integrations between systems.

oss-appsby oss-apps
Find Docs
$35
Full-Stack4.5(51)
Find Docs

You can instantly access up-to-date documentation for any developer technology—from React and Next.js to Django and AWS SDKs. This skill resolves library names to their official documentation and pulls current API signatures, configuration options, and code examples, ensuring you're always working with the latest version information. Perfect for API syntax questions, version migration issues, setup instructions, and debugging library-specific behavior.

oss-appsby oss-apps
$35.00