Spec Compliance Skill
Verify smart contract implementations comply with EIP/ERC standards and protocol specifications. Non-compliant implementations cause integration failures, fund losses, and security vulnerabilities.
Why Compliance Matters
| Impact of Non-Compliance |
Example |
| Integration failure |
DEXs can't list non-standard ERC20 (missing decimals()) |
| Silent fund loss |
ERC721 safeTransferFrom not calling onERC721Received = NFTs lost |
| Security vulnerability |
EIP-712 without chainId = cross-chain signature replay |
| Accounting errors |
ERC4626 wrong rounding direction = vault inflation attack |
| Ecosystem rejection |
Bridges, wallets, indexers refuse non-standard tokens |
Supported Standards
Token Standards
| Standard |
Type |
Key Functions |
Common Issues |
| ERC-20 |
Fungible token |
transfer, approve, transferFrom |
Missing return values, approve race |
| ERC-721 |
Non-fungible token |
safeTransferFrom, approve, ownerOf |
Missing receiver callback |
| ERC-1155 |
Multi-token |
safeTransferFrom, safeBatchTransferFrom |
Batch operation atomicity |
| ERC-4626 |
Tokenized vault |
deposit, withdraw, convertToShares |
Rounding direction, first depositor attack |
| ERC-2612 |
Permit (gasless approve) |
permit, nonces, DOMAIN_SEPARATOR |
Signature replay, frontrunning |
Infrastructure Standards
| Standard |
Type |
Security Focus |
| EIP-712 |
Typed data signing |
Domain separator, chain ID |
| EIP-1967 |
Proxy storage slots |
Standard slot locations |
| EIP-2535 |
Diamond standard |
Selector collision, storage isolation |
| EIP-4337 |
Account abstraction |
UserOp validation, paymaster trust |
| EIP-1153 |
Transient storage |
TSTORE/TLOAD lifecycle |
| EIP-2981 |
Royalty info |
Not enforceable (informational only) |
Compliance Verification Approach
1. Interface Completeness
Does the contract implement ALL required functions with correct signatures?
// ERC-20 REQUIRED interface (IERC20)
function totalSupply() external view returns (uint256);
function balanceOf(address account) external view returns (uint256);
function transfer(address to, uint256 amount) external returns (bool);
function allowance(address owner, address spender) external view returns (uint256);
function approve(address spender, uint256 amount) external returns (bool);
function transferFrom(address from, address to, uint256 amount) external returns (bool);
// ERC-20 REQUIRED events
event Transfer(address indexed from, address indexed to, uint256 value);
event Approval(address indexed owner, address indexed spender, uint256 value);
// OPTIONAL but expected by most integrations
function name() external view returns (string memory);
function symbol() external view returns (string memory);
function decimals() external view returns (uint8);
2. Behavioral Compliance
Does each function behave as specified? (Not just exist with the right signature)
3. Edge Case Handling
Does the implementation handle boundary conditions specified in the standard?
Resources
- ERC Standards
- EIP Security
Workflows
1---2name: spec-compliance3description: Verify smart contract implementations comply with EIP/ERC standards and protocol specifications. Use when checking ERC-20, ERC-721, ERC-1155, ERC-4626, or EIP-712 compliance, or when identifying non-standard token behavior that causes integration failures.4---56# Spec Compliance Skill78Verify smart contract implementations comply with EIP/ERC standards and protocol specifications. Non-compliant implementations cause integration failures, fund losses, and security vulnerabilities.910---1112## Why Compliance Matters1314| Impact of Non-Compliance | Example |15|--------------------------|----------|16| Integration failure | DEXs can't list non-standard ERC20 (missing `decimals()`) |17| Silent fund loss | ERC721 `safeTransferFrom` not calling `onERC721Received` = NFTs lost |18| Security vulnerability | EIP-712 without `chainId` = cross-chain signature replay |19| Accounting errors | ERC4626 wrong rounding direction = vault inflation attack |20| Ecosystem rejection | Bridges, wallets, indexers refuse non-standard tokens |2122---2324## Supported Standards2526### Token Standards2728| Standard | Type | Key Functions | Common Issues |29|----------|------|---------------|---------------|30| ERC-20 | Fungible token | `transfer`, `approve`, `transferFrom` | Missing return values, approve race |31| ERC-721 | Non-fungible token | `safeTransferFrom`, `approve`, `ownerOf` | Missing receiver callback |32| ERC-1155 | Multi-token | `safeTransferFrom`, `safeBatchTransferFrom` | Batch operation atomicity |33| ERC-4626 | Tokenized vault | `deposit`, `withdraw`, `convertToShares` | Rounding direction, first depositor attack |34| ERC-2612 | Permit (gasless approve) | `permit`, `nonces`, `DOMAIN_SEPARATOR` | Signature replay, frontrunning |3536### Infrastructure Standards3738| Standard | Type | Security Focus |39|----------|------|----------------|40| EIP-712 | Typed data signing | Domain separator, chain ID |41| EIP-1967 | Proxy storage slots | Standard slot locations |42| EIP-2535 | Diamond standard | Selector collision, storage isolation |43| EIP-4337 | Account abstraction | UserOp validation, paymaster trust |44| EIP-1153 | Transient storage | TSTORE/TLOAD lifecycle |45| EIP-2981 | Royalty info | Not enforceable (informational only) |4647---4849## Compliance Verification Approach5051### 1. Interface Completeness5253Does the contract implement ALL required functions with correct signatures?5455```solidity56// ERC-20 REQUIRED interface (IERC20)57function totalSupply() external view returns (uint256);58function balanceOf(address account) external view returns (uint256);59function transfer(address to, uint256 amount) external returns (bool);60function allowance(address owner, address spender) external view returns (uint256);61function approve(address spender, uint256 amount) external returns (bool);62function transferFrom(address from, address to, uint256 amount) external returns (bool);6364// ERC-20 REQUIRED events65event Transfer(address indexed from, address indexed to, uint256 value);66event Approval(address indexed owner, address indexed spender, uint256 value);6768// OPTIONAL but expected by most integrations69function name() external view returns (string memory);70function symbol() external view returns (string memory);71function decimals() external view returns (uint8);72```7374### 2. Behavioral Compliance7576Does each function behave as specified? (Not just exist with the right signature)7778### 3. Edge Case Handling7980Does the implementation handle boundary conditions specified in the standard?8182---8384## Resources85- [ERC Standards](resources/erc-standards.md)86- [EIP Security](resources/eip-security.md)8788## Workflows89- [Compliance Audit](workflows/compliance-audit.md)
0x-Shashi