J4flmao Agent Skills Blockchain Application

Blockchain Application

Purpose

Guide smart contract development across all major blockchain platforms. Covers language selection, contract architecture, security patterns, gas optimization, deployment, and cross-contract communication. Platform-agnostic at the protocol layer; chain-specific at the language and VM layer.

Agent Protocol

Trigger

"smart contract", "solidity", "vyper", "evm", "rust smart contract", "solana contract", "anchor framework", "cardano", "plutus", "haskell contract", "cairo", "starknet", "sierra", "hardhat", "foundry", "truffle", "dapp backend", "contract deployment", "gas optimization", "contract security", "cross-contract call", "chainlink", "oracle contract", "defi contract", "nft contract", "move language", "sui contract", "aptos contract"

Input Context

• Target blockchain and VM type (EVM/SVM/eUTxO/StarkNet/MoveVM)
• Contract purpose (token/DeFi/NFT/oracle/governance/bridge)
• Upgradeability requirements (proxy/non-upgradeable/beacon)
• Security requirements (audit level, formal verification need)
• Performance constraints (gas budget, compute units, TPS needs)
• Existing dependencies (OpenZeppelin, Anchor libraries, Plutus contracts)

Output Artifact

Complete contract architecture specification: platform selection, contract design, implementation approach, testing strategy, deployment plan, security analysis.

Response Format

1. Platform selection: chain type + VM + language + framework + toolchain
2. Contract architecture: entry points, storage layout, external dependencies, upgradeability
3. Implementation: key functions with gas considerations and security annotations
4. Testing strategy: unit, integration, fuzz, invariant, testnet deployment
5. Deployment: constructor args, verification, proxy setup, multi-sig ownership
6. Risk analysis: known vulnerabilities specific to this platform/pattern

Completion Criteria

• Contract architecture follows platform best practices (checks-effects-interactions, access control)
• Storage layout compatible with upgradeability pattern (if upgradeable)
• Gas optimization applied: storage reads minimized, calldata over memory where possible
• Security review covers platform-specific attack vectors (reentrancy, oracle manipulation, flash loans)
• Deployment plan includes verification, multi-sig ownership, and monitoring

Max Response Length

5000 tokens

Decision Trees

Platform Selection

Smart contract platform:
├── Need EVM compatibility?
│   ├── YES → Solidity or Vyper
│   │   ├── Solidity: EVM chains (Ethereum, Polygon, Arbitrum, Optimism, Base, BSC)
│   │   │   ├── Toolchain: Foundry (default), Hardhat (complex workflows)
│   │   │   └── Libraries: OpenZeppelin, Solady
│   │   └── Vyper: Simple contracts, audit-friendliness prioritized
│   │       └── Toolchain: ape, brownie
│   ├── NO → Evaluate non-EVM chains
│   │   ├── Solana → Rust + Anchor framework
│   │   │   └── Toolchain: Anchor CLI, Solana CLI
│   │   ├── Cardano → Haskell (Plutus) or Aiken
│   │   │   └── Toolchain: Plutus Tx, cardano-cli
│   │   ├── StarkNet → Cairo
│   │   │   └── Toolchain: Scarb, Starkli
│   │   ├── Sui/Aptos → Move
│   │   │   └── Toolchain: sui CLI / aptos CLI
│   │   └── NEAR/Polkadot → Rust (ink!)
│   │       └── Toolchain: cargo-contract
│   └── Cross-chain? → Consider platform-agnostic architecture
│       └── Abstract core logic, deploy adapters per chain

Upgradeability Decision

Need upgradeable contract?
├── YES:
│   ├── UUPS → Default for new projects (gas-efficient, clean storage)
│   ├── Transparent → Legacy projects, many upgrade functions
│   └── Beacon → Many child contracts (ERC-1167 clones)
├── NO → Immutable contract
│   └── Better security posture, no upgrade governance overhead
└── Hybrid → Immutable core + upgradeable periphery

Architecture Patterns

Checks-Effects-Interactions (Mandatory)

function withdraw(uint256 amount) external {
    // 1. CHECKS: validate conditions
    require(balanceOf[msg.sender] >= amount, "insufficient balance");

    // 2. EFFECTS: update state first
    balanceOf[msg.sender] -= amount;

    // 3. INTERACTIONS: external calls last
    (bool ok, ) = msg.sender.call{value: amount}("");
    require(ok, "transfer failed");
}

Access Control Patterns

• Ownable: Single owner, simplest model
• Roles (OpenZeppelin AccessControl): DEFAULT_ADMIN_ROLE + specific roles (MINTER_ROLE, PAUSER_ROLE)
• Timelock: All sensitive operations delayed by 48h-7d
• Multi-sig: M-of-N signers for admin operations

Solidity Gas Optimization Patterns

// BAD: reads storage repeatedly
function sum() external view returns (uint) {
    uint total = 0;
    for (uint i = 0; i < arr.length; i++) {
        total += arr[i]; // SLOAD every iteration
    }
    return total;
}

// GOOD: cache array length and use unchecked
function sum() external view returns (uint) {
    uint len = arr.length;
    uint total = 0;
    for (uint i = 0; i < len; i++) {
        unchecked { total += arr[i]; }
    }
    return total;
}

Cross-Contract Communication

EVM:
├── Direct call: Interface(target).function(args) — simple, synchronous
├── Delegatecall: Proxy pattern, upgradeable storage
├── Staticcall: Read-only external call (EIP-214)
└── Low-level: address.call{value, gas}(data) — for arbitrary calls

Solana:
├── CPI (Cross-Program Invocation): invoke() or invoke_signed()
└── PDA signing: Programs sign for PDAs via invoke_signed()

Cardano:
├── Script-to-script: Redeemer-based validation
└── One-shot contracts: eUTxO model, no persistent state

Security Patterns

Common Vulnerability Mitigations

Platform-Specific Patterns

EVM (Solidity)

• Storage: 32-byte slot-based, SSTORE costs 20K (cold) / 2.9K (warm)
• Events: emit for off-chain indexing, topics up to 4 (3 indexed + 1 non-indexed)
• ABI encoding: abi.encode (padded) vs abi.encodePacked (tight)
• Precompiles: ecrecover (0x01), SHA-256 (0x02), RIPEMD-160 (0x03), identity (0x04), modexp (0x05), BN254 (0x06, 0x07, 0x08), BLS12-381 (0x0a-0x0d)

Solana (Rust + Anchor)

#[derive(Accounts)]
pub struct CreateUser<'info> {
    #[account(init, payer = user, space = 8 + User::INIT_SPACE)]
    pub user_account: Account<'info, User>,
    #[account(mut)]
    pub user: Signer<'info>,
    pub system_program: Program<'info, System>,
}

#[account]
pub struct User {
    pub name: String,
    pub age: u8,
}

Cardano (Plutus)

• eUTxO model: no global state, contracts are validators
• Datum: on-chain data locked at script address
• Redeemer: spending condition
• Script context: entire transaction context available to validator

StarkNet (Cairo)

• Storage: contract-level storage variables, accessed via read()/write()
• UDC (Universal Deployer Contract): standardized contract deployment
• L1<>L2 messaging: send_message_to_l1, consume_message_from_l1

Move (Sui/Aptos)

• Resource-oriented: assets are resources, cannot be copied or dropped
• Object-centric (Sui): objects, not accounts, are the unit of storage
• Global storage (Aptos): Move modules manage access to globally stored resources
• Abilities: copy, drop, store, key — define what operations are allowed on a type

Production Considerations

Deployment Checklist

• Constructor args verified and tested
• Proxy admin transferred to multi-sig (not deployer EOA)
• Implementation contract initialized and disabled
• Contract verified on block explorer
• Ownership transferred to timelock + governance
• Emergency pause mechanism tested
• Rate limits configured for high-value functions
• Monitoring alerts set up for suspicious activity

Multi-Chain Deployment

• Deterministic addresses via CREATE2 (same address on all EVM chains)
• Proxy admin same address on all chains via CREATE2
• Deployment scripts idempotent (check if already deployed)
• Cross-chain governance for upgrade coordination
• L1 as source of truth, L2 as execution layer

Gas Budget Guidelines (EVM)

• Simple transfer: 21,000 gas
• ERC-20 transfer: ~50,000 gas
• ERC-721 mint: ~100,000 gas
• Uniswap swap: ~150,000 gas
• Complex AMM operation: ~300,000 gas
• L1 block gas limit: 30M (Ethereum)
• L2 block gas limit: 30M-1B (depends on L2)

Rules

1. Use Solidity for EVM chains (Ethereum, Polygon, Arbitrum, Optimism, Base, BSC)
2. Use Rust for Solana (Anchor framework as default), NEAR, and Polkadot ink!
3. Use Haskell/Plutus for Cardano smart contracts
4. Always follow checks-effects-interactions pattern regardless of language
5. Use Foundry (forge) for Solidity development and testing as default toolchain
6. Include gas optimization in every code review — storage is expensive, calldata is cheaper
7. Never hardcode sensitive parameters — use constructor args, setters with timelock
8. Default to UUPS for upgradeable contracts over transparent proxy
9. Use OpenZeppelin audited libraries over custom implementations
10. Always use explicit visibility (public, external, internal, private)
11. Avoid tx.origin for authentication — use msg.sender
12. Validate all external inputs with require or custom errors
13. Emit events for all state-changing operations
14. Test on testnet with real conditions before mainnet
15. Transfer ownership to multi-sig or timelock, not EOA

References

• references/blockchain-application-advanced.md — Blockchain Application Advanced Topics
• references/blockchain-application-fundamentals.md — Blockchain Application Fundamentals
• references/cairo-language.md — Cairo Language (StarkNet)
• references/contract-security.md — Smart Contract Security
• references/haskell-plutus.md — Haskell & Plutus (Cardano)
• references/move-language.md — Move Language (Sui & Aptos)
• references/rust-smart-contracts.md — Rust Smart Contracts
• references/smart-contract-patterns.md — Smart Contract Design Patterns
• references/solidity-evm.md — Solidity & EVM Deep Dive
• references/vyper-language.md — Vyper Language
• references/cross-chain-deployment.md — Cross-Chain Deployment Strategy
• references/gas-optimization-patterns.md — Gas Optimization Techniques

Phase

blockchain → blockchain-application

Handoff

blockchain-application → blockchain-testing (for test strategy implementation) blockchain-application → blockchain-security (for pre-audit review)

Source: j4flmao/agent-skills — distributed by TomeVault.