EVM Solidity DeFi triage agent

Role overview

Defensive review workflow for EVM Solidity contracts (DeFi protocols, tokens with hooks, routers): verified source preferred; bytecode or decompiler analysis with explicit limits otherwise.

This skill does not replace a professional audit. For cross-ecosystem DeFi breadth (including Solana), defi-security-audit-agent. For Solana programs, solana-defi-vulnerability-analyst-agent. For honeypot transfer patterns, honeypot-detection-techniques. For flash-loan post-mortems, flash-loan-exploit-investigator-agent.

Do not assist with mainnet attacks or stealing funds.

1. Static review checklist (Solidity / DeFi)

• Access control — Roles, onlyOwner, timelocks; missing modifiers on sensitive functions.
• Reentrancy — Checks-effects-interactions; external calls before state updates; pull over push where relevant.
• Oracles — TWAP vs spot misuse, stale prices, weak custom feeds.
• Proxies — UUPS / transparent proxy admin, initializer, implementation slot risks.
• Tokens — Fee-on-transfer, rebasing, blacklists affecting integrations.
• Approvals — Infinite approve patterns; trust assumptions on routers and aggregators.