evm-audit-skills

A suite of 20 OpenClaw agent skills for deep EVM smart contract security audits.

Built by clawdbotatg — an AI agent that builds on Ethereum autonomously.

---

What This Is

Each skill is a dense, sourced checklist of non-obvious security vulnerabilities for a specific domain. These are the things that experienced auditors check that basic tools miss — precision loss patterns, AMM-specific attacks, oracle manipulation vectors, governance exploits, and more.

~1,900 lines of checklist content. 500+ individual findings. 20 specialized domains.

Sources include: Dacian (dacian.me), beirao.xyz, SigmaPrime, Decurity, RareSkills, weird-erc20, Spearbit, Hacken, LayerZero, Cyfrin, OpenZeppelin, and the SWC registry.

---

Skills

---

How To Use (OpenClaw)

Install a skill

openclaw skills install https://github.com/clawdbotatg/evm-audit-skills/raw/main/evm-audit-master/SKILL.md

Or clone the whole suite and install locally:

git clone https://github.com/clawdbotatg/evm-audit-skills
openclaw skills install ./evm-audit-skills/evm-audit-master

Run an audit

Just hand the agent a contract:

audit this contract and file issues: https://github.com/owner/repo/blob/main/contracts/MyContract.sol

The agent will:

1. Load evm-audit-master → read the contract → select relevant skills
2. Spawn parallel opus sub-agents, one per skill domain
3. Each agent walks its checklist and writes findings
4. Synthesize into a final AUDIT-REPORT.md
5. File GitHub issues for all Medium+ findings

The audit pipeline

Contract URL/path
      │
      ▼
  RECON (select 5-8 skills from routing table)
      │
      ▼
  PARALLEL AGENTS (one per skill, all run simultaneously)
  ├── agent: evm-audit-general     → findings-general.md
  ├── agent: evm-audit-precision-math → findings-math.md
  ├── agent: evm-audit-defi-amm   → findings-amm.md
  └── ...
      │
      ▼
  SYNTHESIS (deduplicate, rank, cross-cutting analysis)
      │
      ▼
  AUDIT-REPORT.md + GitHub Issues

---

How To Use (Any AI Agent)

These checklists are plain markdown — any agent can fetch and use them directly.

// Fetch a checklist in your agent
const checklist = await fetch(
  "https://raw.githubusercontent.com/clawdbotatg/evm-audit-skills/main/evm-audit-general/references/checklist.md"
).then(r => r.text())

Start with the master index to understand which checklists apply to your contract:

https://raw.githubusercontent.com/clawdbotatg/evm-audit-skills/main/evm-audit-master/SKILL.md

---

Standard Finding Format

All findings across all skills use this format:

## [X-N] Title
**Severity**: Critical / High / Medium / Low / Info
**Category**: [skill name]
**Location**: `functionName()` or file:line
**Description**: What the issue is and why it matters.
**Proof of Concept**: Exact steps to trigger or exploit.
**Recommendation**: Concrete fix with code snippet.

Severity definitions:

• Critical — Direct loss of funds by a third party, no preconditions
• High — Loss of funds requiring specific conditions, or permanent DoS
• Medium — Degraded behavior, trust model violation, incorrect accounting
• Low — Best practice violation, latent bug, no direct fund risk
• Info — Informational, no security impact

---

Example Audit

Full audit of LiquidityVesting.sol (Uniswap V3 liquidity vesting contract on Base): → audits/liquidity-vesting-2026-02-28/

27 findings across 3 parallel agents. 12 issues filed. Runtime ~10 minutes.

---

Attribution & Thanks

This skill suite stands entirely on the shoulders of researchers and auditors who published their knowledge openly. Every checklist item is sourced — if you want to go deeper on any topic, these are the primary sources:

🙏 People & Teams

Dacian — The single highest-signal source in this entire suite. Eight deep-dive articles covering liquidation vulnerabilities, CLM attacks, slippage, precision loss, signature replay, governance, inline assembly, and lending/borrowing. Essential reading for any serious auditor.

• DeFi Liquidation Vulnerabilities
• Concentrated Liquidity Manager Vulnerabilities
• DeFi Slippage Attacks
• Precision Loss Errors
• Signature Replay Attacks
• DAO Governance DeFi Attacks
• Solidity Inline Assembly Vulnerabilities
• Lending/Borrowing DeFi Attacks
• AI Auditor Primers (base.primer.md — 33KB of dense vulnerability patterns)

beirao.xyz — Comprehensive audit checklist covering 200+ non-obvious Solidity footguns, organized by category. The backbone of evm-audit-general.

Sigma Prime — Three excellent deep-dives on governance/DAOs, oracles/pricing, and liquid restaking security.

• Governance & DAOs
• Oracles & Pricing
• Liquid Restaking

RareSkills — Detailed articles on smart contract security and UUPS proxy vulnerabilities.

• Smart Contract Security
• UUPS Proxy

Cyfrin — Chainlink oracle security deep-dive by Dacian, published via Cyfrin.

• Chainlink Oracle DeFi Attacks

🔧 Checklists & Reference Repos

d-xo/weird-erc20 — The definitive catalog of non-standard ERC20 token behaviors. Essential for any protocol accepting arbitrary tokens.

0xJuancito/multichain-auditor — Cross-chain deployment pitfalls across Arbitrum, Optimism, zkSync, Polygon, and more.

Decurity — Protocol-specific security checklists for AMMs, CDPs, and liquid staking derivatives.

Hacken — Uniswap V4 hooks security guide.

OpenZeppelin — Uniswap V4 hooks audit guide and proxy security research.

Spearbit — Bridge security checklist.

MixBytes — CREATE2 security analysis.

Tamjid Audit Checklist — Community checklist with many practical Solidity footguns.

Nascent Audit Toolkit — Practical security toolkit for DeFi protocols.

📋 Standards

EEA EthTrust Security Levels — The current smart contract security standard (supersedes the SWC registry).

SWC Registry — Smart Contract Weakness Classification (archived, incorporated into EEA EthTrust).

Protocol Documentation

Uniswap V3/V4 docs, LayerZero V2 security checklist, Chainlink CCIP best practices, Wormhole integration security guide, Across Protocol integration guide, Arbitrum official documentation.

---

Contributing

Found a new non-obvious vulnerability pattern? The bar for inclusion is high:

• Must be non-obvious — if a junior auditor would catch it, it doesn’t belong
• Must be sourced — link to a real audit report, exploit postmortem, or research article
• Must include the Look for: pattern so an agent knows what code to scan for

Open a PR against the relevant references/checklist.md.

---

License

MIT. This covers the checklist text in this repo, which is written in our own words. The sources linked above keep their own licenses.

---

Built by clawd · @austingriffith · clawdbotatg