How do I install the Solidity Best Practices skill?

Run npx skillmds add tryboy869/solidity-best-practices in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Solidity Best Practices safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Solidity Best Practices?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Solidity Best Practices free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Solidity Best Practices?

Tryboy869 (@tryboy869) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Solidity Best Practices by tryboy869

Name: Solidity Best Practices
Rating: 4.5 (4 reviews)
Author: Tryboy869

File contents

Use explicit function visibility modifiers and appropriate natspec comments.
Utilize function modifiers for common checks, enhancing readability and reducing redundancy.
Follow consistent naming: CamelCase for contracts, PascalCase for interfaces (prefixed with "I").
Implement the Interface Segregation Principle for flexible and maintainable contracts.
Design upgradeable contracts using proven patterns like the proxy pattern when necessary.
Implement comprehensive events for all significant state changes.
Follow the Checks-Effects-Interactions pattern to prevent reentrancy and other vulnerabilities.
Use static analysis tools like Slither and Mythril in the development workflow.
Implement timelocks and multisig controls for sensitive operations in production.
Conduct thorough gas optimization, considering both deployment and runtime costs.
Use OpenZeppelin's AccessControl for fine-grained permissions.
Use Solidity 0.8.0+ for built-in overflow/underflow protection.
Implement circuit breakers (pause functionality) using OpenZeppelin's Pausable when appropriate.
Use pull over push payment patterns to mitigate reentrancy and denial of service attacks.
Implement rate limiting for sensitive functions to prevent abuse.
Use OpenZeppelin's SafeERC20 for interacting with ERC20 tokens.
Implement proper randomness using Chainlink VRF or similar oracle solutions.
Use assembly for gas-intensive operations, but document extensively and use with caution.
Implement effective state machine patterns for complex contract logic.
Use OpenZeppelin's ReentrancyGuard as an additional layer of protection against reentrancy.
Implement proper access control for initializers in upgradeable contracts.
Use OpenZeppelin's ERC20Snapshot for token balances requiring historical lookups.
Implement timelocks for sensitive operations using OpenZeppelin's TimelockController.
Use OpenZeppelin's ERC20Permit for gasless approvals in token contracts.
Implement proper slippage protection for DEX-like functionalities.
Use OpenZeppelin's ERC20Votes for governance token implementations.
Implement effective storage patterns to optimize gas costs (e.g., packing variables).
Use libraries for complex operations to reduce contract size and improve reusability.
Implement proper access control for self-destruct functionality, if used.
Use OpenZeppelin's Address library for safe interactions with external contracts.
Use custom errors instead of revert strings for gas efficiency and better error handling.
Implement NatSpec comments for all public and external functions.
Use immutable variables for values set once at construction time.
Implement proper inheritance patterns, favoring composition over deep inheritance chains.
Use events for off-chain logging and indexing of important state changes.
Implement fallback and receive functions with caution, clearly documenting their purpose.
Use view and pure function modifiers appropriately to signal state access patterns.
Implement proper decimal handling for financial calculations, using fixed-point arithmetic libraries when necessary.
Use assembly sparingly and only when necessary for optimizations, with thorough documentation.
Implement effective error propagation patterns in internal functions.

---name: solidity-best-practicesdescription: [Applies to: **/*.sol] Enforces best practices for Solidity smart contract development, covering aspects like function visibility, naming conventions, and upgradeability patterns.---- Use explicit function visibility modifiers and appropriate natspec comments.- Utilize function modifiers for common checks, enhancing readability and reducing redundancy.- Follow consistent naming: CamelCase for contracts, PascalCase for interfaces (prefixed with "I").- Implement the Interface Segregation Principle for flexible and maintainable contracts.- Design upgradeable contracts using proven patterns like the proxy pattern when necessary.- Implement comprehensive events for all significant state changes.- Follow the Checks-Effects-Interactions pattern to prevent reentrancy and other vulnerabilities.- Use static analysis tools like Slither and Mythril in the development workflow.- Implement timelocks and multisig controls for sensitive operations in production.- Conduct thorough gas optimization, considering both deployment and runtime costs.- Use OpenZeppelin's AccessControl for fine-grained permissions.- Use Solidity 0.8.0+ for built-in overflow/underflow protection.- Implement circuit breakers (pause functionality) using OpenZeppelin's Pausable when appropriate.- Use pull over push payment patterns to mitigate reentrancy and denial of service attacks.- Implement rate limiting for sensitive functions to prevent abuse.- Use OpenZeppelin's SafeERC20 for interacting with ERC20 tokens.- Implement proper randomness using Chainlink VRF or similar oracle solutions.- Use assembly for gas-intensive operations, but document extensively and use with caution.- Implement effective state machine patterns for complex contract logic.- Use OpenZeppelin's ReentrancyGuard as an additional layer of protection against reentrancy.- Implement proper access control for initializers in upgradeable contracts.- Use OpenZeppelin's ERC20Snapshot for token balances requiring historical lookups.- Implement timelocks for sensitive operations using OpenZeppelin's TimelockController.- Use OpenZeppelin's ERC20Permit for gasless approvals in token contracts.- Implement proper slippage protection for DEX-like functionalities.- Use OpenZeppelin's ERC20Votes for governance token implementations.- Implement effective storage patterns to optimize gas costs (e.g., packing variables).- Use libraries for complex operations to reduce contract size and improve reusability.- Implement proper access control for self-destruct functionality, if used.- Use OpenZeppelin's Address library for safe interactions with external contracts.- Use custom errors instead of revert strings for gas efficiency and better error handling.- Implement NatSpec comments for all public and external functions.- Use immutable variables for values set once at construction time.- Implement proper inheritance patterns, favoring composition over deep inheritance chains.- Use events for off-chain logging and indexing of important state changes.- Implement fallback and receive functions with caution, clearly documenting their purpose.- Use view and pure function modifiers appropriately to signal state access patterns.- Implement proper decimal handling for financial calculations, using fixed-point arithmetic libraries when necessary.- Use assembly sparingly and only when necessary for optimizations, with thorough documentation.- Implement effective error propagation patterns in internal functions.

Frequently asked questions