EVM Smart Contract Audit
A full audit system for any EVM contract. Runs parallel specialist agents against domain-specific checklists, synthesizes findings, and files GitHub issues.
The Checklists
20 specialized skills covering every major vulnerability domain. Fetch the master index first:
https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md
The master index contains:
- Full routing table (which skills to load for which contract types)
- The complete audit methodology (recon → parallel agents → synthesis → issues)
- Standard finding format with severity definitions
All 20 skill checklists are at:
https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/<skill-name>/references/checklist.md
Skills Available
| Skill |
When to Load |
evm-audit-general |
Always |
evm-audit-precision-math |
Always |
evm-audit-erc20 |
Contract interacts with ERC20 tokens |
evm-audit-defi-amm |
AMM, DEX, Uniswap V3/V4, liquidity pools |
evm-audit-defi-lending |
Lending, borrowing, CDP, liquidations |
evm-audit-defi-staking |
Staking, liquid staking, restaking, EigenLayer |
evm-audit-erc4626 |
Vaults, share/asset conversion |
evm-audit-erc4337 |
Account abstraction, paymasters, session keys |
evm-audit-bridges |
Cross-chain, LayerZero, CCIP, Wormhole |
evm-audit-proxies |
Upgradeable contracts, UUPS, Transparent, Diamond |
evm-audit-signatures |
Off-chain signatures, EIP-712, permits |
evm-audit-governance |
DAO voting, timelocks, multi-sig |
evm-audit-oracles |
Chainlink, TWAP, Pyth, price feeds |
evm-audit-assembly |
Inline assembly, Yul, CREATE2 |
evm-audit-chain-specific |
Non-mainnet: Arbitrum, OP, zkSync, Blast, BSC |
evm-audit-flashloans |
Flash loan attack vectors |
evm-audit-erc721 |
NFTs, ERC721, ERC1155 |
evm-audit-dos |
DoS, unbounded loops, gas griefing |
evm-audit-access-control |
Ownership, roles, centralization risks |
How To Run An Audit
- Fetch the master skill (link above) — it has the full pipeline
- Read the contract(s)
- Select 5-8 skills using the routing table
- Spawn one opus sub-agent per skill (parallel)
- Each agent walks its checklist and writes
findings-<skill>.md
- Synthesize all findings into
AUDIT-REPORT.md
- File GitHub issues for Medium severity and above
Invocation
Audit this contract and file issues: https://github.com/owner/repo/blob/main/contracts/Foo.sol
Checklists: https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md
Sources
Built from research by Dacian, beirao.xyz, Sigma Prime, RareSkills, Decurity, weird-erc20, Spearbit, Hacken, OpenZeppelin, Cyfrin, and more.
Full attribution: https://github.com/austintgriffith/evm-audit-skills#attribution--thanks
1---2name: audit3description: Deep EVM smart contract security audit system. Use when asked to audit a contract, find vulnerabilities, review code for security issues, or file security issues on a GitHub repo. Covers 500+ non-obvious checklist items across 19 domains via parallel sub-agents. Different from the security skill (which teaches defensive coding) — this is for systematically auditing contracts you didn't write.4---56# EVM Smart Contract Audit78A full audit system for any EVM contract. Runs parallel specialist agents against domain-specific checklists, synthesizes findings, and files GitHub issues.910## The Checklists111220 specialized skills covering every major vulnerability domain. Fetch the master index first:1314```15https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md16```1718The master index contains:1920- Full routing table (which skills to load for which contract types)21- The complete audit methodology (recon → parallel agents → synthesis → issues)22- Standard finding format with severity definitions2324All 20 skill checklists are at:2526```27https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/<skill-name>/references/checklist.md28```2930## Skills Available3132| Skill | When to Load |33| -------------------------- | ------------------------------------------------- |34| `evm-audit-general` | Always |35| `evm-audit-precision-math` | Always |36| `evm-audit-erc20` | Contract interacts with ERC20 tokens |37| `evm-audit-defi-amm` | AMM, DEX, Uniswap V3/V4, liquidity pools |38| `evm-audit-defi-lending` | Lending, borrowing, CDP, liquidations |39| `evm-audit-defi-staking` | Staking, liquid staking, restaking, EigenLayer |40| `evm-audit-erc4626` | Vaults, share/asset conversion |41| `evm-audit-erc4337` | Account abstraction, paymasters, session keys |42| `evm-audit-bridges` | Cross-chain, LayerZero, CCIP, Wormhole |43| `evm-audit-proxies` | Upgradeable contracts, UUPS, Transparent, Diamond |44| `evm-audit-signatures` | Off-chain signatures, EIP-712, permits |45| `evm-audit-governance` | DAO voting, timelocks, multi-sig |46| `evm-audit-oracles` | Chainlink, TWAP, Pyth, price feeds |47| `evm-audit-assembly` | Inline assembly, Yul, CREATE2 |48| `evm-audit-chain-specific` | Non-mainnet: Arbitrum, OP, zkSync, Blast, BSC |49| `evm-audit-flashloans` | Flash loan attack vectors |50| `evm-audit-erc721` | NFTs, ERC721, ERC1155 |51| `evm-audit-dos` | DoS, unbounded loops, gas griefing |52| `evm-audit-access-control` | Ownership, roles, centralization risks |5354## How To Run An Audit55561. Fetch the master skill (link above) — it has the full pipeline572. Read the contract(s)583. Select 5-8 skills using the routing table594. Spawn one opus sub-agent per skill (parallel)605. Each agent walks its checklist and writes `findings-<skill>.md`616. Synthesize all findings into `AUDIT-REPORT.md`627. File GitHub issues for Medium severity and above6364## Invocation6566```67Audit this contract and file issues: https://github.com/owner/repo/blob/main/contracts/Foo.sol68Checklists: https://raw.githubusercontent.com/austintgriffith/evm-audit-skills/main/evm-audit-master/SKILL.md69```7071## Sources7273Built from research by Dacian, beirao.xyz, Sigma Prime, RareSkills, Decurity, weird-erc20, Spearbit, Hacken, OpenZeppelin, Cyfrin, and more.74Full attribution: https://github.com/austintgriffith/evm-audit-skills#attribution--thanks
involvex