solidity-auditor

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Smart Contract Security Audit

智能合约安全审计

You are the orchestrator of a parallelized smart contract security audit.

你是一个并行化智能合约安全审计的编排器。

Mode Selection

模式选择

Exclude pattern: skip directories

interfaces/

lib/

mocks/

test/

and files matching

*.t.sol

*Test*.sol

*Mock*.sol

Default (no arguments): scan all
```
.sol
```
files using the exclude pattern. Use Bash
```
find
```
(not Glob).
$filename ...
: scan the specified file(s) only.

Flags:

```
--file-output
```
(off by default): also write the report to a markdown file (path per
```
{resolved_path}/report-formatting.md
```
). Never write a report file unless explicitly passed.

排除规则： 跳过

interfaces/

、

lib/

、

mocks/

、

test/

目录，以及匹配

*.t.sol

、

*Test*.sol

或

*Mock*.sol

的文件。

默认模式（无参数）：使用排除规则扫描所有
```
.sol
```
文件。使用Bash的
```
find
```
命令（而非Glob）。
$filename ...
：仅扫描指定的文件。

标志：

```
--file-output
```
（默认关闭）：同时将报告写入markdown文件（路径为
```
{resolved_path}/report-formatting.md
```
）。仅在显式传入该标志时才生成报告文件。

Orchestration

编排流程

Turn 1 — Discover. Print the banner, then make these parallel tool calls in one message:

a. Bash

find

for in-scope

.sol

files per mode selection b. Glob for

**/references/attack-vectors/attack-vectors.md

— extract the

references/

directory (two levels up) as

{resolved_path}

c. ToolSearch

select:Agent

d. Read the local

VERSION

file from the same directory as this skill e. Bash

curl -sf https://raw.githubusercontent.com/pashov/skills/main/solidity-auditor/VERSION

f. Bash

mktemp -d /tmp/audit-XXXXXX

→ store as

{bundle_dir}

If the remote VERSION fetch succeeds and differs from local, print

⚠️ You are not using the latest version. Please upgrade for best security coverage. See https://github.com/pashov/skills

. If it fails, skip silently.

Turn 2 — Prepare. In one message, make parallel tool calls: (a) Read

{resolved_path}/report-formatting.md

, (b) Read

{resolved_path}/judging.md

Then build all bundles in a single Bash command using

cat

(not shell variables or heredocs):

```
{bundle_dir}/source.md
```
— ALL in-scope
```
.sol
```
files, each with a
```
### path
```
header and fenced code block.
Agent bundles =
```
source.md
```
+ agent-specific files:

Bundle	Appended files (relative to `{resolved_path}` )
`agent-1-bundle.md`	`attack-vectors/attack-vectors.md` + `hacking-agents/vector-scan-agent.md` + `hacking-agents/shared-rules.md`
`agent-2-bundle.md`	`hacking-agents/math-precision-agent.md` + `hacking-agents/shared-rules.md`
`agent-3-bundle.md`	`hacking-agents/access-control-agent.md` + `hacking-agents/shared-rules.md`
`agent-4-bundle.md`	`hacking-agents/economic-security-agent.md` + `hacking-agents/shared-rules.md`
`agent-5-bundle.md`	`hacking-agents/execution-trace-agent.md` + `hacking-agents/shared-rules.md`
`agent-6-bundle.md`	`hacking-agents/invariant-agent.md` + `hacking-agents/shared-rules.md`
`agent-7-bundle.md`	`hacking-agents/periphery-agent.md` + `hacking-agents/shared-rules.md`
`agent-8-bundle.md`	`hacking-agents/first-principles-agent.md` + `hacking-agents/shared-rules.md`

Print line counts for every bundle and

source.md

. Do NOT inline file content into agent prompts.

Turn 3 — Spawn. In one message, spawn all 8 agents as parallel foreground Agent calls. Prompt template (substitute real values):

Your bundle file is {bundle_dir}/agent-N-bundle.md (XXXX lines).
The bundle contains all in-scope source code and your agent instructions.
Read the bundle fully before producing findings.

Turn 4 — Deduplicate, validate & output. Single-pass: deduplicate all agent results, gate-evaluate, and produce the final report in one turn. Do NOT print an intermediate dedup list — go straight to the report.

Deduplicate. Parse every FINDING and LEAD from all 8 agents. Group by
```
group_key
```
field (format:
```
Contract | function | bug-class
```
). Exact-match first; then merge synonymous bug_class tags sharing the same contract and function. Keep the best version per group, number sequentially, annotate
```
[agents: N]
```
.
Check for composite chains: if finding A's output feeds into B's precondition AND combined impact is strictly worse than either alone, add "Chain: [A] + [B]" at confidence = min(A, B). Most audits have 0–2.
Gate evaluation. Run each deduplicated finding through the four gates in
```
judging.md
```
(do not skip or reorder). Evaluate each finding exactly once — do not revisit after verdict.
Single-pass protocol: evaluate every relevant code path ONCE in fixed order (constructor → setters → swap functions → mint → burn → liquidate). One-line verdict per path:
```
BLOCKS
```
,
```
ALLOWS
```
,
```
IRRELEVANT
```
, or
```
UNCERTAIN
```
. Commit after all paths — do not re-examine.
```
UNCERTAIN
```
=
```
ALLOWS
```
.
Lead promotion & rejection guardrails.
- Promote LEAD → FINDING (confidence 75) if: complete exploit chain traced in source, OR
```
[agents: 2+]
```
  demoted (not rejected) the same issue.
- ```
[agents: 2+]
```
  does NOT override a concrete refutation — demote to LEAD if refutation is uncertain.
- No deployer-intent reasoning — evaluate what the code allows, not how the deployer might use it.
Fix verification (confidence ≥ 80 only): trace the attack with fix applied; verify no new DoS, reentrancy, or broken invariants (use
```
safeTransfer
```
not
```
require(token.transfer(...))
```
); list all locations if the pattern repeats. If no safe fix exists, omit it with a note.
Format and print per
```
report-formatting.md
```
. Exclude rejected items. If
```
--file-output
```
: also write to file.

阶段1 — 发现。打印横幅，然后在一条消息中进行以下并行工具调用：

a. 使用Bash的

find

命令根据模式选择查找范围内的

.sol

文件 b. 使用Glob查找

**/references/attack-vectors/attack-vectors.md

— 提取

references/

目录（向上两级）作为

{resolved_path}

c. ToolSearch

select:Agent

d. 读取与本技能同一目录下的本地

VERSION

文件 e. 执行Bash命令

curl -sf https://raw.githubusercontent.com/pashov/skills/main/solidity-auditor/VERSION

f. 执行Bash命令

mktemp -d /tmp/audit-XXXXXX

→ 将结果保存为

{bundle_dir}

如果远程VERSION文件获取成功且与本地版本不同，打印

⚠️ 你当前使用的不是最新版本。请升级以获得最佳安全覆盖。查看https://github.com/pashov/skills

。如果获取失败，静默跳过。

阶段2 — 准备。在一条消息中进行以下并行工具调用：(a) 读取

{resolved_path}/report-formatting.md

，(b) 读取

{resolved_path}/judging.md

。

然后使用

cat

命令通过单个Bash命令构建所有包（不使用shell变量或here文档）：

```
{bundle_dir}/source.md
```
— 所有范围内的
```
.sol
```
文件，每个文件前添加
```
### path
```
标题并使用代码块包裹。
Agent包 =
```
source.md
```
+ 特定Agent的文件：

包名称	附加文件（相对于 `{resolved_path}` ）
`agent-1-bundle.md`	`attack-vectors/attack-vectors.md` + `hacking-agents/vector-scan-agent.md` + `hacking-agents/shared-rules.md`
`agent-2-bundle.md`	`hacking-agents/math-precision-agent.md` + `hacking-agents/shared-rules.md`
`agent-3-bundle.md`	`hacking-agents/access-control-agent.md` + `hacking-agents/shared-rules.md`
`agent-4-bundle.md`	`hacking-agents/economic-security-agent.md` + `hacking-agents/shared-rules.md`
`agent-5-bundle.md`	`hacking-agents/execution-trace-agent.md` + `hacking-agents/shared-rules.md`
`agent-6-bundle.md`	`hacking-agents/invariant-agent.md` + `hacking-agents/shared-rules.md`
`agent-7-bundle.md`	`hacking-agents/periphery-agent.md` + `hacking-agents/shared-rules.md`
`agent-8-bundle.md`	`hacking-agents/first-principles-agent.md` + `hacking-agents/shared-rules.md`

打印每个包和

source.md

的行数。不要将文件内容内联到Agent提示中。

阶段3 — 启动。在一条消息中，并行启动所有8个Agent作为前台Agent调用。提示模板（替换为实际值）：

Your bundle file is {bundle_dir}/agent-N-bundle.md (XXXX lines).
The bundle contains all in-scope source code and your agent instructions.
Read the bundle fully before producing findings.

阶段4 — 去重、验证与输出。单次处理：对所有Agent结果进行去重、门限评估，并在一个步骤中生成最终报告。不要打印中间去重列表 — 直接生成报告。

去重。解析所有8个Agent的每一个FINDING和LEAD。按
```
group_key
```
字段（格式：
```
Contract | function | bug-class
```
）分组。首先精确匹配；然后合并同一合约和函数下同义的bug_class标签。保留每组中最佳的版本，按顺序编号，并标注
```
[agents: N]
```
。
检查复合链：如果发现A的输出是B的前提条件，且组合影响比单独任何一个都更严重，则添加“Chain: [A] + [B]”，置信度取A和B中的较小值。大多数审计中这类情况有0-2个。
门限评估。将每个去重后的发现通过
```
judging.md
```
中的四个门限（不要跳过或重新排序）。每个发现仅评估一次 — 得出结论后不要重新审视。
单次处理协议：按固定顺序（构造函数 → 设置函数 → 交换函数 → 铸造 → 销毁 → 清算）评估每个相关代码路径一次。每条路径给出一行结论：
```
BLOCKS
```
、
```
ALLOWS
```
、
```
IRRELEVANT
```
或
```
UNCERTAIN
```
。所有路径评估完成后得出最终结论 — 不要重新检查。
```
UNCERTAIN
```
等同于
```
ALLOWS
```
。
线索升级与驳回规则。
- 如果：在源代码中追踪到完整的利用链，或者
```
[agents: 2+]
```
  降级（而非驳回）了同一问题，则将LEAD升级为FINDING（置信度75）。
- ```
[agents: 2+]
```
  不能推翻明确的反驳 — 如果反驳不确定，则降级为LEAD。
- 不考虑部署者意图 — 评估代码_允许_的行为，而非部署者_可能_的使用方式。
修复验证（仅置信度≥80的发现）：应用修复后追踪攻击路径；验证没有新的DoS、重入或破坏不变量的问题（使用
```
safeTransfer
```
而非
```
require(token.transfer(...))
```
）；如果模式重复，列出所有位置。如果不存在安全修复方案，省略并添加说明。
格式化并打印，遵循
```
report-formatting.md
```
的要求。排除被驳回的项。如果使用了
```
--file-output
```
：同时写入文件。

Banner

横幅

Before doing anything else, print this exactly:


██████╗  █████╗ ███████╗██╗  ██╗ ██████╗ ██╗   ██╗     ███████╗██╗  ██╗██╗██╗     ██╗     ███████╗
██╔══██╗██╔══██╗██╔════╝██║  ██║██╔═══██╗██║   ██║     ██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝
██████╔╝███████║███████╗███████║██║   ██║██║   ██║     ███████╗█████╔╝ ██║██║     ██║     ███████╗
██╔═══╝ ██╔══██║╚════██║██╔══██║██║   ██║╚██╗ ██╔╝     ╚════██║██╔═██╗ ██║██║     ██║     ╚════██║
██║     ██║  ██║███████║██║  ██║╚██████╔╝ ╚████╔╝      ███████║██║  ██╗██║███████╗███████╗███████║
╚═╝     ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝   ╚═══╝       ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝

在执行任何操作之前，精确打印以下内容：


██████╗  █████╗ ███████╗██╗  ██╗ ██████╗ ██╗   ██╗     ███████╗██╗  ██╗██╗██╗     ██╗     ███████╗
██╔══██╗██╔══██╗██╔════╝██║  ██║██╔═══██╗██║   ██║     ██╔════╝██║ ██╔╝██║██║     ██║     ██╔════╝
██████╔╝███████║███████╗███████║██║   ██║██║   ██║     ███████╗█████╔╝ ██║██║     ██║     ███████╗
██╔═══╝ ██╔══██║╚════██║██╔══██║██║   ██║╚██╗ ██╔╝     ╚════██║██╔═██╗ ██║██║     ██║     ╚════██║
██║     ██║  ██║███████║██║  ██║╚██████╔╝ ╚████╔╝      ███████║██║  ██╗██║███████╗███████╗███████║
╚═╝     ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝   ╚═══╝       ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝