XSpoonAi Security Audit Skill
Smart contract security audit assistant powered by Solodit API and professional audit tools.
Quick Start
# Search vulnerabilities
python3 scripts/solodit_api.py search --keywords "reentrancy" --impact HIGH
# Fetch contract from Etherscan URL
python3 scripts/fetch_contract.py "https://etherscan.io/address/0x..."
# Detect project framework
python3 scripts/project_detector.py /path/to/project
Scripts
| Script | Purpose |
|---|---|
| solodit_api.py | Search Solodit vulnerability database |
| fetch_contract.py | Fetch verified contracts from 40+ chains |
| project_detector.py | Detect project framework and chain type |
Environment Variables
| Variable | Required | Description |
|---|---|---|
SOLODIT_API_KEY |
Yes | Solodit API key from https://solodit.cyfrin.io |
ETHERSCAN_API_KEY |
No | Etherscan API key for fetching contracts |
BSCSCAN_API_KEY |
No | BSCScan API key |
ARBISCAN_API_KEY |
No | Arbiscan API key |
Capabilities
- Search Vulnerabilities - Query 50,000+ findings from top audit firms (Cyfrin, Sherlock, Code4rena, etc.)
- Fetch Contracts - Download verified source code from 40+ blockchain explorers
- Detect Frameworks - Auto-detect project framework (Foundry, Hardhat, Anchor, etc.)
- Static Analysis - Run Slither, Aderyn, Mythril for automated scanning
- Fuzz Testing - Echidna, Medusa, Foundry for invariant testing
- PoC Generation - Templates for reentrancy, flash loan, oracle manipulation exploits
- Report Generation - Code4rena, Sherlock, Cyfrin style audit reports
Best Practices
- Always verify contract source before auditing
- Use multiple static analysis tools for comprehensive coverage
- Search Solodit for similar vulnerabilities in related protocols
- Write PoC tests to confirm findings
- Follow severity guidelines when rating issues