All categories
Blockchain & Web3
Crypto, wallets, smart contracts, Web3, DeFi, NFTs, and decentralized apps
- 1,483
- 62
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse blockchain & web3 skills
Showing 1,225–1,248 of 1,483 skills
- Reentrancy AnalysisTrigger REENTRANCY flag detected (dynamic dispatch, closures, dispatchable FA, function values) - Used by Breadth agents, depth-state-traceVotes: 0GitHub stars: 281
- Oracle AnalysisTrigger Pattern ORACLE flag (required) - Inject Into Breadth agents, depth-external, depth-edge-caseVotes: 0GitHub stars: 281
- Move Safety Core DirectivesLightweight core directives for Aptos Move always-required skills — injected into every breadth agent. Full methodology lives in the dedicated Move-Safety Agent.Votes: 0GitHub stars: 281
- Migration AnalysisTrigger Protocol has migration patterns (reinitialize, V2/V3, deprecated, upgrade, legacy, Coin-to-FA) - Covers Token type mismatches, stranded assets, interface incompatibiliti...Votes: 0GitHub stars: 281
- Fungible Asset SecurityTrigger FA_STANDARD flag detected (protocol uses FungibleAsset standard) - Used by Breadth agents, depth-token-flowVotes: 0GitHub stars: 281
- Fork AncestryTrigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)Votes: 0GitHub stars: 281
- Flash Loan InteractionTrigger Pattern FLASH_LOAN flag (required) or BALANCE_DEPENDENT flag (optional complement) - Inject Into Breadth agents, depth-token-flow, depth-edge-caseVotes: 0GitHub stars: 281
- External Precondition AuditTrigger Pattern Any external module interaction detected in attack_surface.md - Inject Into Breadth agents (merged via M5 hierarchy)Votes: 0GitHub stars: 281
- Economic Design AuditTrigger Pattern MONETARY_PARAMETER flag (required) - Inject Into Breadth agents (merged via M4 hierarchy)Votes: 0GitHub stars: 281
- Dependency AuditTrigger EXTERNAL_LIB flag detected (protocol uses third-party Move dependencies) - Used by Breadth agents, depth-externalVotes: 0GitHub stars: 281
- Cross Chain TimingTrigger Pattern wormhole|layerzero|ccip|bridge|cross_chain|vaa|guardian|emitter|relay|remote_chain|payload|nonce.sequence - Inject Into Breadth agents, depth-externalVotes: 0GitHub stars: 281
- Centralization RiskTrigger Protocol has privileged roles (admin, operator, governance, resource account owner) - Covers Single points of failure, privilege escalation, external governance dependen...Votes: 0GitHub stars: 281
- Bit Shift SafetyTrigger Pattern Always (Aptos Move) - Move VM aborts on shift = bit width - Inject Into Breadth agents, depth-edge-caseVotes: 0GitHub stars: 281
- Ability AnalysisTrigger Pattern Always (Aptos Move) - foundational security check - Inject Into Breadth agents, depth agentsVotes: 0GitHub stars: 281
- Coinmarketcap`https://coinmarketcap.com` — crypto market data. Three access paths tested: internal JSON API (fastest, no auth required), `__NEXT_DATA__` from HTML pages, and browser DOM. All real-money price data confirmed accurate against displayed UI values.Votes: 0GitHub stars: 9
- Coingecko`https://api.coingecko.com/api/v3` — no API key needed for free tier. Pure JSON REST API, no browser required.Votes: 0GitHub stars: 9
- Vyper SpecificDetect Vyper-specific bug classes — compiler-version reentrancy bugs, raw_call return-value handling, send/raw_call gas defaults, immutables vs constants, default-bytes scope, msg.sender-based auth corner cases. Activate on any `.vy` file or `pragma version` directive.Votes: 0GitHub stars: 9
- Unchecked CallsDetect ignored external-call return values — silent failures from low-level call/delegatecall/staticcall, ignored ERC20 transfer return values, return-data length issues. Activate on `.call`, `.delegatecall`, `.staticcall`, `.send`, `transfer`/`transferFrom` (without SafeERC20), and any function returning `bool` whose return is discarded.Votes: 0GitHub stars: 9
- Tx Context MisuseDetect misuse of tx.origin, block.timestamp, block.number — phishing via tx.origin, timestamp dependence, L2-block-number assumptions. Activate on `tx.origin`, `block.timestamp`, `block.number`, `blockhash`, `block.prevrandao`, `block.coinbase`.Votes: 0GitHub stars: 9
- Token CompatibilityDetect ERC-20 token compatibility issues — fee-on-transfer, rebasing, non-standard return values, missing decimals(), low-decimal tokens, blacklistable tokens (USDC), pausable tokens. Activate on any ERC-20 integration, `transfer`/`transferFrom` use, balance-based accounting, decimal scaling.Votes: 0GitHub stars: 9
- Storage LayoutDetect storage-layout issues in upgradeable contracts — slot collisions, slot reuse, packing changes, missing gap. Activate when reviewing UUPS/Transparent proxies, OZ Upgradeable contracts, diamonds (EIP-2535), libraries with structs, or any contract using assembly to read storage slots.Votes: 0GitHub stars: 9
- Signature ReplayDetect signature-replay, EIP-712 / EIP-2612 mistakes, malleable signatures, cross-chain replay, missing nonces. Activate on `ecrecover`, `permit`, meta-transactions, signed orders, signed approvals, EIP-712 domain construction, gasless transaction relayers.Votes: 0GitHub stars: 9
- Selfdestruct Eip6780Detect selfdestruct misuse and EIP-6780 implications post-Cancun — bricked contracts, broken `assert(balance == X)` invariants, factory patterns relying on redeploy, deployment-tx-only selfdestruct corner cases. Activate on `selfdestruct`, `suicide`, `CREATE2` factories, contracts asserting on `address(this).balance`.Votes: 0GitHub stars: 9
- Restaking EigenlayerDetect restaking / AVS bugs — EigenLayer / Symbiotic / Karak operator slashing edge cases, withdrawal-queue gaming, cascading-slashing across AVSs, LST depeg solvency, AVS opt-in granularity. Activate on EigenLayer / Symbiotic / Karak imports, StrategyManager, DelegationManager, EigenPod, AVS registration, slasher contracts.Votes: 0GitHub stars: 9