omermaksutii/rugproof
34 skills
$npx skills add omermaksutii/rugproofSkillInstalls
access-controlDetect missing or incorrect access control — missing modifiers, wrong role checks, privileged function exposure, public initializers, and role-escalation…approval-issuesDetect ERC-20 approval pitfalls — approve race (front-run), missing safeApprove, infinite approvals, approval-without-revoke, Permit2 misuse, max-approval to…caching-and-incrementalAlways-on meta-skill — cache audit results per file by content hash so unchanged files aren't re-analyzed on subsequent runs.centralization-riskDetect centralization and trust-assumption risks — admin powers, single-key risk, missing timelocks, upgrade authority, treasury keys, pause permanence,…confidence-scoringAlways-on meta-skill — for every finding produced, attach a confidence level (HIGH/MEDIUM/LOW) and a reasoning trace.cosmwasmDetect bug classes specific to CosmWasm (Rust) contracts — missing info.sender authorization in execute handlers, unbounded map iteration → gas/DoS,…cross-chain-messagingDetect cross-chain messaging bugs — replay protection gaps, untrusted-remote acceptance, default-config inheritance, validator-set misconfig, force-include…cross-contract-stateDetect cross-contract state inconsistency — two or more contracts sharing a token, oracle, or price feed where one mutates and another reads stale, cached…delegatecall-risksDetect delegatecall risks — uninitialized proxies, malicious implementations, storage-slot collisions, delegatecall to user-controlled addresses, library…diamond-eip2535Detect Diamond (EIP-2535) bugs — facet selector collisions, init-vs-upgrade safety, storage-namespace collisions, facet selfdestruct paths, missing facet cuts.dos-vectorsDetect denial-of-service vectors — unbounded loops, gas griefing, push-payment chokepoints, block-stuffing exposure, revert-on-receive blocking.erc1271-contract-signaturesDetect ERC-1271 contract-signature bugs — magic-value handling, signature validation edge cases, smart-wallet interactions (Safe, Argent),…erc4337-account-abstractionDetect ERC-4337 account-abstraction bugs — validateUserOp storage-rule violations, paymaster postOp DoS, session-key scope bypasses, signature aggregation…erc4626-inflationDetect ERC-4626 inflation/donation attacks — first depositor share-price manipulation, naive convertToShares math, missing virtual-shares defense.example-fork-detectionfalse-positive-feedback-loopMeta-skill for managing user-dismissed findings. Before reporting any finding, check it against the project's .rugproof.yml ignore list and inline…fee-on-transferDetect fee-on-transfer / deflationary / rebasing token accounting bugs — crediting the *passed amount* instead of the measured balance delta.flash-loan-attacksDetect vulnerability to flash-loan-funded attacks — governance manipulation, price manipulation, collateral inflation, vault donation attacks.initializationDetect initialization bugs in upgradeable contracts — missing `_disableInitializers()`, re-init attacks, parent-init not chained, constructor-vs-initializer…inline-assemblyDetect bugs in inline Yul / assembly — manual memory mismanagement, free-memory-pointer corruption, return-data manipulation, missing return-data-size checks,…integer-issuesDetect integer over/underflow in `unchecked` blocks, downcasting losses, fixed-point precision errors, division-before-multiplication, signed/unsigned mixing.intents-erc7683Detect ERC-7683 / intent-based protocol bugs — solver griefing, intent expiration, settlement race conditions, surplus theft, cross-chain replay, allowance…known-good-comparisonWhen auditing a contract that resembles a canonical implementation (OpenZeppelin, Solady, Uniswap, Compound, etc.), compare against the reference.liquidation-cascadeDetect cascading liquidations and socialized bad debt — correlated collateral (multiple LSTs/stables), bad debt socialized across unrelated markets, oracle…mev-frontrunningDetect MEV exposure and front-running risks — sandwich attacks, missing commit-reveal, missing/manipulable deadlines, slippage absent, public mempool…mev-pbsDetect MEV and proposer-builder-separation exposure — sandwichable swaps with no minOut, JIT liquidity, oracle-update frontrunning, backrunnable state, false…multi-pass-self-critiqueMeta-skill for /audit-strict and high-stakes audits. Run two independent passes with different starting contexts, then keep only consensus findings.oracle-manipulationDetect oracle manipulation risks — spot-price reads from AMMs, stale Chainlink answers, single-source dependence, TWAP gaming.solady-erc20-permit2-assumptionsDetect unsafe assumptions about Solady's gas-optimized ERC20/ERC2612 permit and DN404 metadata.solady-ownable-init-frontrunDetect front-runnable ownership initialization in Solady Ownable / OwnableRoles.solady-safetransferlib-no-contract-checkDetect Solady SafeTransferLib calls that assume the token has code.v4-hook-delta-accountingDetect Uniswap V4 hooks that fail to settle currency deltas with the PoolManager.v4-hook-permission-flags-mismatchDetect Uniswap V4 hooks whose address-encoded permission flags don't match the callbacks the hook actually implements.v4-hook-reentrancy-via-unlockDetect reentrancy in Uniswap V4 hooks via the PoolManager unlock/lock callback.