solidity-auditor
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseSolidity Smart Contract Auditor
Solidity智能合约审计工具
A professional-grade smart contract audit skill covering security vulnerabilities, gas optimization, storage patterns, and code architecture. Adapted to Solidity version specifics.
一款专业级智能合约审计工具，涵盖安全漏洞排查、Gas优化、存储模式分析及代码架构审查，适配不同Solidity版本的特性。
Audit Types
审计类型
Determine the audit type based on user request:
| User Request | Audit Type | Primary Reference |
|---|---|---|
| "Full audit", "comprehensive review" | Full Audit | All references |
| "Security audit", "vulnerability scan" | Security Focused | |
| "Gas optimization", "reduce gas costs" | Gas Optimization | |
| "Storage optimization", "storage patterns" | Storage Optimization | |
| "Code review", "architecture review" | Architecture Review | |
| "DeFi audit", "protocol review" | DeFi Protocol | Security + Architecture references |
根据用户需求确定审计类型：
| 用户需求 | 审计类型 | 主要参考文档 |
|---|---|---|
| "全面审计"、"综合审查" | 全面审计 | 所有参考文档 |
| "安全审计"、"漏洞扫描" | 安全聚焦审计 | |
| "Gas优化"、"降低Gas成本" | Gas优化审计 | |
| "存储优化"、"存储模式" | 存储优化审计 | |
| "代码审查"、"架构审查" | 架构审查 | |
| "DeFi审计"、"协议审查" | DeFi协议审计 | 安全+架构参考文档 |
Core Audit Workflow
核心审计流程
Phase 1: Preparation
阶段1：准备工作
-
Identify Solidity Version: Check pragma statement. Readfor version-specific considerations:
references/version-specific.md- Pre-0.8.0: Check for SafeMath usage, arithmetic vulnerabilities
- 0.8.0+: Review blocks, check custom errors usage
unchecked
-
Understand Scope:
- List all contracts, interfaces, libraries
- Identify external dependencies (OpenZeppelin, etc.)
- Note inheritance hierarchy
- Document entry points (external/public functions)
-
Gather Context: Ask if not provided:
- Protocol purpose and intended behavior
- Deployment chain(s)
- Expected user flows
- Admin roles and privileges
-
识别Solidity版本：检查pragma声明。阅读了解版本特定注意事项：
references/version-specific.md- 0.8.0之前版本：检查SafeMath使用情况、算术漏洞
- 0.8.0及以上版本：审查代码块、检查自定义错误的使用
unchecked
-
明确审计范围：
- 列出所有合约、接口、库
- 识别外部依赖（如OpenZeppelin等）
- 记录继承层级
- 文档化入口点（外部/公共函数）
-
收集上下文信息：若用户未提供，需询问：
- 协议用途与预期行为
- 部署链
- 预期用户流程
- 管理员角色与权限
Phase 2: Static Analysis
阶段2：静态分析
-
Run automated checks mentally using patterns from the security checklist:
- Access control patterns
- State-changing operations flow (checks-effects-interactions)
- External call patterns
- Arithmetic operations (especially in blocks)
unchecked
-
Map attack surface:
- External/public functions
- Functions handling ETH/tokens
- Functions with access control
- Upgrade mechanisms
-
基于安全检查表中的模式，进行自动化检查：
- 访问控制模式
- 状态变更操作流程（检查-效应-交互原则）
- 外部调用模式
- 算术运算（尤其是块中的运算）
unchecked
-
梳理攻击面：
- 外部/公共函数
- 处理ETH/代币的函数
- 带有访问控制的函数
- 升级机制
Phase 3: Vulnerability Assessment
阶段3：漏洞评估
Read and evaluate each category:
references/security-checklist.mdCritical Priority (check first):
- Access Control Vulnerabilities (OWASP SC-01) - $953M+ in losses
- Logic Errors (OWASP SC-02) - $64M+ in losses
- Reentrancy (OWASP SC-03) - $36M+ in losses
High Priority:
4. Flash Loan Attack Vectors (OWASP SC-04)
5. Input Validation (OWASP SC-05)
6. Oracle Manipulation (OWASP SC-06)
7. Unchecked External Calls (OWASP SC-07)
Medium Priority:
8. Integer Overflow/Underflow (version-dependent)
9. Denial of Service vectors
10. Front-running vulnerabilities
阅读并评估每个类别：
references/security-checklist.md最高优先级（优先检查）：
- 访问控制漏洞（OWASP SC-01）- 已造成超9.53亿美元损失
- 逻辑错误（OWASP SC-02）- 已造成超6400万美元损失
- 重入漏洞（OWASP SC-03）- 已造成超3600万美元损失
高优先级：
4. 闪电贷攻击向量（OWASP SC-04）
5. 输入验证（OWASP SC-05）
6. 预言机操纵（OWASP SC-06）
7. 未检查的外部调用（OWASP SC-07）
中优先级：
8. 整数溢出/下溢（依赖版本）
9. 拒绝服务攻击向量
10. 抢先交易漏洞
Phase 4: Optimization Analysis (if requested)
阶段4：优化分析（若用户要求）
For gas optimization: Read
For storage optimization: Read
references/gas-optimization.mdreferences/storage-optimization.mdGas优化：阅读
存储优化：阅读
references/gas-optimization.mdreferences/storage-optimization.mdPhase 5: Report Generation
阶段5：报告生成
Use the template in to structure findings.
references/report-template.md使用中的模板构建审计结果报告。
references/report-template.mdSeverity Classification
严重程度分类
| Severity | Criteria | Action |
|---|---|---|
| Critical | Direct fund loss possible, no user interaction needed | Immediate fix required, do not deploy |
| High | Fund loss possible with specific conditions, significant impact | Must fix before deployment |
| Medium | Limited impact, unlikely exploitation, or governance issue | Should fix, assess risk |
| Low | Minor issue, best practice violation | Recommended fix |
| Informational | Code quality, gas optimization, suggestions | Optional improvement |
| 严重程度 | 判断标准 | 处理建议 |
|---|---|---|
| Critical（关键） | 无需用户交互即可直接造成资金损失 | 需立即修复，禁止部署 |
| High（高） | 在特定条件下可能造成资金损失，影响重大 | 部署前必须修复 |
| Medium（中） | 影响有限，被利用可能性低，或属于治理问题 | 应修复，评估风险 |
| Low（低） | 轻微问题，违反最佳实践 | 建议修复 |
| Informational（信息性） | 代码质量、Gas优化相关建议 | 可选改进项 |
Quick Reference: Top Attack Vectors (2024-2025)
快速参考：顶级攻击向量（2024-2025）
From OWASP Smart Contract Top 10 (2025) with real losses:
- Access Control ($953.2M): Missing/incorrect modifiers, exposed admin functions
- Logic Errors ($63.8M): Flawed business logic, incorrect calculations
- Reentrancy ($35.7M): State updates after external calls
- Flash Loans ($33.8M): Price manipulation, governance attacks
- Input Validation ($14.6M): Missing bounds checks, unchecked parameters
- Oracle Manipulation ($8.8M): TWAP manipulation, stale prices
基于OWASP智能合约十大风险（2025版）及真实损失数据：
- 访问控制（9.532亿美元）：缺失/错误的修饰器、暴露的管理员函数
- 逻辑错误（6380万美元）：有缺陷的业务逻辑、计算错误
- 重入（3570万美元）：外部调用后更新状态
- 闪电贷（3380万美元）：价格操纵、治理攻击
- 输入验证（1460万美元）：缺失边界检查、未校验参数
- 预言机操纵（880万美元）：TWAP操纵、价格过时
Output Guidelines
输出指南
Always provide:
- Clear finding title with severity
- Location: Contract name, function, line numbers
- Description: What the issue is
- Impact: Potential consequences
- Proof of Concept: How it could be exploited (when applicable)
- Recommendation: Specific fix with code example
Format recommendations as actionable code changes when possible.
始终提供以下内容：
- 清晰的发现标题，附带严重程度
- 位置：合约名称、函数、行号
- 描述：问题内容
- 影响：潜在后果
- 概念验证：漏洞可能的利用方式（适用时）
- 建议：具体修复方案，附带代码示例
尽可能将建议格式化为可执行的代码变更。
Reference Files
参考文件
Load these as needed based on audit type:
- - Complete vulnerability checklist with detection patterns
references/security-checklist.md - - Gas optimization techniques and patterns
references/gas-optimization.md - - Storage layout and optimization
references/storage-optimization.md - - Code architecture best practices
references/architecture-review.md - - Solidity version considerations
references/version-specific.md - - Professional audit report template
references/report-template.md
根据审计类型按需加载：
- - 完整漏洞检查表，含检测模式
references/security-checklist.md - - Gas优化技术与模式
references/gas-optimization.md - - 存储布局与优化
references/storage-optimization.md - - 代码架构最佳实践
references/architecture-review.md - - Solidity版本相关注意事项
references/version-specific.md - - 专业审计报告模板
references/report-template.md