Solidity Security

by wshobson46891e7e60daNo licenseListed Oct 8, 2026Updated Oct 8, 2026

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Instructions onlySecurity Software Development

AI-generated overview

Guides secure Solidity smart contract development, covering common vulnerabilities, secure patterns and audit preparation.

What it does: This skill provides guidance on smart contract security best practices, vulnerability prevention and secure Solidity development patterns. It covers topics such as reentrancy, integer overflow and access control, and includes example Hardhat security tests and an audit-ready contract example. It also points to a reference file with detailed patterns and worked examples.
When to use it: Use it when writing secure smart contracts, auditing existing contracts for vulnerabilities, or implementing security measures for blockchain applications. It is also relevant when preparing contracts for professional audits or studying common attack vectors.
Requirements: No scripts are shipped; it is instructions only. The examples reference Hardhat, Chai and ethers for testing, but no installation or credentials are specified.

Solidity Security

Master smart contract security best practices, vulnerability prevention, and secure Solidity development patterns.

When to Use This Skill

Writing secure smart contracts
Auditing existing contracts for vulnerabilities
Implementing secure DeFi protocols
Preventing reentrancy, overflow, and access control issues
Optimizing gas usage while maintaining security
Preparing contracts for professional audits
Understanding common attack vectors

Detailed patterns and worked examples

Detailed pattern documentation lives in references/details.md. Read that file when the navigation tier above is insufficient.

Testing for Security

javascript

// Hardhat test exampleconst { expect } = require("chai");const { ethers } = require("hardhat");
describe("Security Tests", function () {  it("Should prevent reentrancy attack", async function () {    const [attacker] = await ethers.getSigners();
    const VictimBank = await ethers.getContractFactory("SecureBank");    const bank = await VictimBank.deploy();
    const Attacker = await ethers.getContractFactory("ReentrancyAttacker");    const attackerContract = await Attacker.deploy(bank.address);
    // Deposit funds    await bank.deposit({ value: ethers.utils.parseEther("10") });
    // Attempt reentrancy attack    await expect(      attackerContract.attack({ value: ethers.utils.parseEther("1") }),    ).to.be.revertedWith("ReentrancyGuard: reentrant call");  });
  it("Should prevent integer overflow", async function () {    const Token = await ethers.getContractFactory("SecureToken");    const token = await Token.deploy();
    // Attempt overflow    await expect(token.transfer(attacker.address, ethers.constants.MaxUint256))      .to.be.reverted;  });
  it("Should enforce access control", async function () {    const [owner, attacker] = await ethers.getSigners();
    const Contract = await ethers.getContractFactory("SecureContract");    const contract = await Contract.deploy();
    // Attempt unauthorized withdrawal    await expect(contract.connect(attacker).withdraw(100)).to.be.revertedWith(      "Ownable: caller is not the owner",    );  });});

// Hardhat test exampleconst { expect } = require("chai");const { ethers } = require("hardhat");
describe("Security Tests", function () {  it("Should prevent reentrancy attack", async function () {    const [attacker] = await ethers.getSigners();
    const VictimBank = await ethers.getContractFactory("SecureBank");    const bank = await VictimBank.deploy();
    const Attacker = await ethers.getContractFactory("ReentrancyAttacker");    const attackerContract = await Attacker.deploy(bank.address);
    // Deposit funds    await bank.deposit({ value: ethers.utils.parseEther("10") });
    // Attempt reentrancy attack    await expect(      attackerContract.attack({ value: ethers.utils.parseEther("1") }),    ).to.be.revertedWith("ReentrancyGuard: reentrant call");  });
  it("Should prevent integer overflow", async function () {    const Token = await ethers.getContractFactory("SecureToken");    const token = await Token.deploy();
    // Attempt overflow    await expect(token.transfer(attacker.address, ethers.constants.MaxUint256))      .to.be.reverted;  });
  it("Should enforce access control", async function () {    const [owner, attacker] = await ethers.getSigners();
    const Contract = await ethers.getContractFactory("SecureContract");    const contract = await Contract.deploy();
    // Attempt unauthorized withdrawal    await expect(contract.connect(attacker).withdraw(100)).to.be.revertedWith(      "Ownable: caller is not the owner",    );  });});

Audit Preparation

solidity

contract WellDocumentedContract {    /**     * @title Well Documented Contract     * @dev Example of proper documentation for audits     * @notice This contract handles user deposits and withdrawals     */
    /// @notice Mapping of user balances    mapping(address => uint256) public balances;
    /**     * @dev Deposits ETH into the contract     * @notice Anyone can deposit funds     */    function deposit() public payable {        require(msg.value > 0, "Must send ETH");        balances[msg.sender] += msg.value;    }
    /**     * @dev Withdraws user's balance     * @notice Follows CEI pattern to prevent reentrancy     * @param amount Amount to withdraw in wei     */    function withdraw(uint256 amount) public {        // CHECKS        require(amount <= balances[msg.sender], "Insufficient balance");
        // EFFECTS        balances[msg.sender] -= amount;
        // INTERACTIONS        (bool success, ) = msg.sender.call{value: amount}("");        require(success, "Transfer failed");    }}

contract WellDocumentedContract {    /**     * @title Well Documented Contract     * @dev Example of proper documentation for audits     * @notice This contract handles user deposits and withdrawals     */
    /// @notice Mapping of user balances    mapping(address => uint256) public balances;
    /**     * @dev Deposits ETH into the contract     * @notice Anyone can deposit funds     */    function deposit() public payable {        require(msg.value > 0, "Must send ETH");        balances[msg.sender] += msg.value;    }
    /**     * @dev Withdraws user's balance     * @notice Follows CEI pattern to prevent reentrancy     * @param amount Amount to withdraw in wei     */    function withdraw(uint256 amount) public {        // CHECKS        require(amount <= balances[msg.sender], "Insufficient balance");
        // EFFECTS        balances[msg.sender] -= amount;
        // INTERACTIONS        (bool success, ) = msg.sender.call{value: amount}("");        require(success, "Transfer failed");    }}

Source and attribution

Source:wshobson/agentsinplugins/blockchain-web3/skills/solidity-securityat commit46891e7

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Solidity Security

Solidity Security

When to Use This Skill

Detailed patterns and worked examples

Testing for Security

Audit Preparation

Source and attribution

More from wshobson/agents

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

More in Security

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases

Iam Helper For Privileged Access Management