1---2name: cyfrin-findings3description: Query the Cyfrin/Solodit findings database (50,530+ findings from 30+ audit firms) for vulnerability research, pattern extraction, and audit enhancement. Use when searching for historical findings by vulnerability type, protocol category, or severity, or when looking for similar bugs found in comparable protocols.4---56# Cyfrin/Solodit Findings Database Skill78## Purpose910Query and leverage the Cyfrin/Solodit findings database — the largest aggregated repository of smart contract audit findings — for vulnerability research, pattern extraction, and audit enhancement. This skill provides structured access to historical audit data across the entire Web3 ecosystem.1112## Database Statistics1314| Metric | Value |15|--------|-------|16| Total findings indexed | 50,530+ |17| Audit firms represented | 30+ (Code4rena, Sherlock, Spearbit, Trail of Bits, OpenZeppelin, ConsenSys Diligence, Cyfrin, Sigma Prime, MixBytes, Cantina, etc.) |18| Protocols covered | 2,844+ |19| Vulnerability categories/tags | 207 |20| Protocol categories | 33 (Lending, DEX, Bridge, Yield, Governance, NFT, Stablecoin, Derivatives, Insurance, etc.) |21| Chains covered | Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche, Solana, and more |2223## Severity Distribution (Approximate)2425Based on the indexed findings:2627| Severity | Percentage | Approximate Count |28|----------|------------|-------------------|29| Critical | ~5% | ~2,500 |30| High | ~25% | ~12,600 |31| Medium | ~40% | ~20,200 |32| Low | ~20% | ~10,100 |33| Informational/Gas | ~10% | ~5,050 |3435## Top Vulnerability Categories3637Ranked by frequency across the entire database:38391. **Access Control** — Unprotected functions, missing role checks, privilege escalation402. **Input Validation** — Unchecked parameters, missing bounds, zero-address checks413. **Reentrancy** — Cross-function, cross-contract, read-only reentrancy424. **Oracle Manipulation** — Price feed manipulation, stale prices, TWAP attacks435. **Rounding/Precision** — Integer division truncation, share price inflation, dust amounts446. **Flash Loan Attacks** — Governance manipulation, price oracle attacks, liquidity draining457. **Front-running/MEV** — Sandwich attacks, transaction ordering dependence468. **Denial of Service** — Gas griefing, unbounded loops, block stuffing479. **Logic Errors** — Incorrect state transitions, wrong comparison operators, off-by-one4810. **Token Integration** — Fee-on-transfer, rebasing tokens, non-standard ERC20 behavior4950## Capabilities5152### Core Query Operations53- **Search by vulnerability type**: Query findings by category tag (e.g., `reentrancy`, `oracle-manipulation`, `access-control`)54- **Search by protocol type**: Filter by protocol category (e.g., lending, DEX, bridge, yield aggregator)55- **Search by severity**: Filter Critical/High/Medium/Low findings56- **Search by chain**: Target chain-specific vulnerabilities (Ethereum, Arbitrum, Optimism, etc.)57- **Search by auditor**: Filter by specific audit firm (Code4rena, Sherlock, Spearbit, etc.)58- **Get specific finding**: Retrieve full details of a finding by its unique ID5960### Research Operations61- **Pattern extraction**: Group findings by category to identify recurring vulnerability patterns62- **Protocol benchmarking**: Compare finding density across similar protocols63- **Trend analysis**: Track vulnerability type frequency over time64- **Auditor comparison**: Compare finding distributions across audit firms65- **Historical research**: Study how specific vulnerability classes have evolved6667### Audit Enhancement68- **Pre-audit intelligence**: Build targeted checklists from historical findings for the protocol type under review69- **Live code review support**: Query relevant past findings when encountering suspicious patterns during review70- **Report enrichment**: Reference similar historical findings to add credibility and context to audit reports71- **Mitigation validation**: Check whether proposed fixes align with successful remediations in past findings7273## API Reference7475| Property | Value |76|----------|-------|77| Base URL | `https://api.solodit.xyz` |78| Auth | API key in `X-API-Key` header |79| Rate limit | 100 requests/minute, 10,000 requests/day |80| Response format | JSON |81| Pagination | `page` (default: 1), `per_page` (default: 50, max: 100) |8283### Endpoints8485| Method | Endpoint | Description |86|--------|----------|-------------|87| GET | `/findings` | Search findings with filters (severity, category, chain, protocol) |88| GET | `/findings/:id` | Get a specific finding by ID |89| GET | `/protocols` | List all audited protocols |90| GET | `/categories` | List all vulnerability categories |9192See [API Reference](resources/api-reference.md) for full parameter documentation and response schemas.9394## Workflows9596| Workflow | When to Use |97|----------|-------------|98| [Audit Preparation](workflows/audit-preparation.md) | Before starting an audit — build threat model from historical findings for the protocol type |99| [Code Review Enhancement](workflows/code-review-enhancement.md) | During code review — query past findings when encountering suspicious patterns |100| [Vulnerability Learning](workflows/vulnerability-learning.md) | Study sessions — deep-dive into a vulnerability category with 10+ real examples |101| [Pre-Development Research](workflows/pre-development-research.md) | Before writing smart contract code — learn what goes wrong in similar protocols |102103## Resources104105| Resource | Purpose |106|----------|---------|107| [API Reference](resources/api-reference.md) | Full endpoint documentation, parameters, response schemas, error codes |108| [Query Templates](resources/query-templates.md) | Ready-to-use query patterns for common research scenarios |109| [Rate Limiting](resources/rate-limiting.md) | Rate limit details, caching strategies, backoff implementation |110| [Response Parsing](resources/response-parsing.md) | How to extract, normalize, and categorize findings from API responses |111112## Integration with Other Skills113114This skill feeds data into multiple other skills in the system:115116| Skill | Integration |117|-------|-------------|118| `patterns/` | Findings data populates vulnerability pattern files (e.g., reentrancy-patterns.md, erc4626-patterns.md) |119| `exploit-forensics/` | Past findings provide forensic case studies for exploit analysis |120| `protocol-playbooks/` | Historical findings for specific protocol types inform playbook checklists |121| `attack-trees/` | Finding severity and frequency data shapes attack tree probability nodes |122| `checklists/` | Top vulnerability categories from findings become checklist items |123| `scoring/` | Finding density by category informs risk scoring weights |124125## Quick Start Example126127To research vulnerabilities for a **lending protocol** audit:1281291. Query: `GET /findings?category=lending&severity=critical&per_page=50`1302. Extract top attack vectors from results (oracle manipulation, liquidation logic, interest rate calculation)1313. Cross-reference with `patterns/oracle-patterns.md` and `patterns/lending-patterns.md`1324. Build targeted checklist using `checklists/` templates1335. During review, query specific patterns: `GET /findings?category=reentrancy&protocol_type=lending`1346. Reference relevant historical findings in audit report135136## Data Quality Notes137138- Findings are sourced from public audit reports and contest results139- Severity levels are preserved as assigned by the original auditor/judge140- Some findings may be marked as invalid or duplicate in contest platforms — filter accordingly141- Protocol names are normalized but may have variations across different audit firms142- Not all findings include code snippets — some only have descriptions and recommendations
0x-Shashi