# Hedera Smart Contract Audit

> Security audit playbook for Hedera EVM contracts — Slither and Mythril wiring, HIP-1195 hook/allowance abuse checks, HTS precompile reentrancy review, manual checklist distinct from vanilla Ethereum, structured findings report with CVSS scoring guidance for DLT quirks. Use when user mentions audit Hedera contract, Slither Hedera, Mythril, HIP-1195, HTS reentrancy, bug bounty prep Hedera.

- Skill: `evaluris-solutions/hedera-smart-contract-audit` (Agent Skill, multi-file: 8 files)
- Install (CLI): `npx skillmds@latest add evaluris-solutions/hedera-smart-contract-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/evaluris-solutions/hedera-smart-contract-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Evaluris-Solutions (https://skillmd.com/u/evaluris-solutions)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/evaluris-solutions/hedera-smart-contract-audit

---


## Overview

Auditing Hedera contracts combines **standard Ethereum tooling** with **network-specific invariants** (HTS precompile behavior, decimal quirks, hook-enabled ERC-20 flows).

## When to use this skill

- Preparing **bug bounty** submissions ([Bug bounty scope](https://hedera.com/bug-bounty)).
- Running static analysis in CI for Solidity repos targeting Hedera relays.

## Prerequisites

- Python 3.10+ for Slither/Mythril.
- Compiled artifacts (`artifacts/` + source maps).

## Workflow

1. **Static analysis** — run `./scripts/run-audit.sh` after customizing compiler version inside repo.

2. **Manual review** — walk checklist in [references/audit-checklist.md](references/audit-checklist.md).

3. **Hedera-specific classes** — investigate hook-enabled allowances per HIP-1195 & HTS interactions ([references/hedera-vuln-taxonomy.md](references/hedera-vuln-taxonomy.md)).

4. **Reporting** — populate [scripts/audit-template.md](scripts/audit-template.md).

5. **Scoring** — apply CVSS but annotate **network-layer exploitability** assumptions.

## Examples

**Example 1**

> “Slither on Hedera fork.”

Point Slither at flattened contracts + relay RPC if differential testing needed.

**Example 2**

> “Does reentrancy matter on HTS?”

Yes — treat HTS calls as external interactions possibly invoking hooks.

**Example 3**

> “Need bounty-ready write-up.”

Include reproducible testnet PoC + impacted contracts list.

## Troubleshooting

| Issue | Tip |
| --- | --- |
| Mythril timeouts | Narrow bytecode scope |

## References

- Local: [references/hedera-vuln-taxonomy.md](references/hedera-vuln-taxonomy.md), [references/audit-checklist.md](references/audit-checklist.md), [references/2023-hts-exploit.md](references/2023-hts-exploit.md), [references/bug-bounty-scope.md](references/bug-bounty-scope.md)