How do I install the Code Review Solidity skill?

Run npx skillmds@latest add noorqureshi/code-review-solidity in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Review Solidity safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Review Solidity?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Review Solidity free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Code Review Solidity?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Review Solidity by noorqureshi

Name: Code Review Solidity
Author: NoorQureshi

Code Review Solidity

Security review of Solidity / EVM smart contracts — reentrancy, access control, arithmetic, and DeFi economic bugs. Load when reviewing a smart contract / web3 codebase or PR, on .sol source in scope, or "audit this contract". Signals: *.sol, foundry/hardhat, ERC-20/721, external calls, delegatecall, proxy patterns, price oracles.

NoorQureshi ffc4960 3.0 KB Updated Sep 17, 2026

File contents

Solidity / smart-contract review

When it applies

Reviewing on-chain code (a protocol, a token, a bridge). Smart-contract bugs are usually irreversible and directly financial, so the review bar is high and the classic patterns are well known — start there, then look for economic/logic flaws unique to the protocol.

Why it works

The EVM executes exactly as written with real money at stake: an external call can re-enter before state updates, arithmetic wraps, and a missing modifier means anyone can call a privileged function. Most losses trace to a small set of patterns a careful read (plus Slither/Mythril) will surface.

Sinks & patterns (read, then reason about ordering and trust)

Reentrancy: state changed after an external call/.call{value:}/token callback (ERC-777/721 hooks). Enforce checks-effects-interactions or a nonReentrant guard.
Access control: privileged functions missing onlyOwner/role modifiers; tx.origin used for auth (phishable); unprotected initialize() on upgradeable proxies.
Arithmetic: unchecked math (pre-0.8, or inside unchecked{}) → over/underflow; precision loss from divide-before-multiply; rounding that favors the attacker.
Unchecked calls: ignoring call/send return values; assuming an external call succeeded.
delegatecall: to attacker-influenced targets → storage/logic hijack; storage-layout mismatch in proxies.
Oracle / economics: spot-price from a manipulable AMM (flash-loan price manipulation), missing slippage/deadline, MEV/front-running of state-changing txs, first-depositor share inflation.
Other: selfdestruct/force-fed ether assumptions, weak randomness (block.timestamp/ blockhash), signature replay (missing nonce/chainId in EIP-712), DoS via unbounded loops.

Method

Run slither (fast, high-signal) and mythril; triage findings.
Read every external call and check state-update ordering (reentrancy) and return-value handling.
Map roles/modifiers to every state-changing and fund-moving function.
Model the economics: how does price/valuation get set, and can a flash loan move it within one tx?
Property-test invariants with echidna/Foundry fuzzing where feasible.

Gotchas

Solidity ≥0.8 checks arithmetic by default — the risk moves into unchecked{} blocks and casts.
A "reentrancy guard" doesn't help cross-function or cross-contract reentrancy — check the whole path.
Upgradeable proxies add initializer, storage-collision, and delegatecall risks absent in plain contracts.

References

SWC Registry; Slither/Mythril docs; Trail of Bits & OpenZeppelin audit guidance; rekt.news post-mortems.

---name: code-review-soliditydescription: Security review of Solidity / EVM smart contracts — reentrancy, access control, arithmetic, and DeFi economic bugs. Load when reviewing a smart contract / web3 codebase or PR, on .sol source in scope, or "audit this contract". Signals: *.sol, foundry/hardhat, ERC-20/721, external calls, delegatecall, proxy patterns, price oracles.---# Solidity / smart-contract review## When it appliesReviewing on-chain code (a protocol, a token, a bridge). Smart-contract bugs are usuallyirreversible and directly financial, so the review bar is high and the classic patterns arewell known — start there, then look for economic/logic flaws unique to the protocol.## Why it worksThe EVM executes exactly as written with real money at stake: an external call can re-enter beforestate updates, arithmetic wraps, and a missing modifier means anyone can call a privileged function.Most losses trace to a small set of patterns a careful read (plus Slither/Mythril) will surface.## Sinks & patterns (read, then reason about ordering and trust)- **Reentrancy**: state changed *after* an external call/`.call{value:}`/token callback (ERC-777/721 hooks). Enforce checks-effects-interactions or a `nonReentrant` guard.- **Access control**: privileged functions missing `onlyOwner`/role modifiers; `tx.origin` used for auth (phishable); unprotected `initialize()` on upgradeable proxies.- **Arithmetic**: unchecked math (pre-0.8, or inside `unchecked{}`) → over/underflow; precision loss from divide-before-multiply; rounding that favors the attacker.- **Unchecked calls**: ignoring `call`/`send` return values; assuming an external call succeeded.- **delegatecall**: to attacker-influenced targets → storage/logic hijack; storage-layout mismatch in proxies.- **Oracle / economics**: spot-price from a manipulable AMM (flash-loan price manipulation), missing slippage/deadline, MEV/front-running of state-changing txs, first-depositor share inflation.- **Other**: `selfdestruct`/force-fed ether assumptions, weak randomness (`block.timestamp`/ `blockhash`), signature replay (missing nonce/chainId in EIP-712), DoS via unbounded loops.## Method1. Run `slither` (fast, high-signal) and `mythril`; triage findings.2. Read every external call and check state-update ordering (reentrancy) and return-value handling.3. Map roles/modifiers to every state-changing and fund-moving function.4. Model the economics: how does price/valuation get set, and can a flash loan move it within one tx?5. Property-test invariants with `echidna`/Foundry fuzzing where feasible.## Gotchas- Solidity ≥0.8 checks arithmetic by default — the risk moves into `unchecked{}` blocks and casts.- A "reentrancy guard" doesn't help cross-function or cross-contract reentrancy — check the whole path.- Upgradeable proxies add initializer, storage-collision, and `delegatecall` risks absent in plain contracts.## ReferencesSWC Registry; Slither/Mythril docs; Trail of Bits & OpenZeppelin audit guidance; rekt.news post-mortems.

Frequently asked questions