Agent skill · security · affaan-m
defi-amm-security
Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math. Use when auditing or writing Solidity AMM, liquidity pool, or swap code.
Why this skill is useful
Provides critical security patterns and checks for Solidity AMM contracts that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
DeFi AMM Security Critical vulnerability patterns and hardened implementations for Solidity AMM contracts, LP vaults, and swap functions. When to Use Writing or auditing a Solidity AMM or liquidity-pool contract Implementing swap, deposit, withdraw, mint, or burn flows that hold token balances Reviewing any contract that uses token.balanceOf(address(this)) in share or reserve math Adding fee setters, pausers, oracle updates, or other admin functions to a DeFi protocol How It Works Use this as a checklist-plus-pattern library. Review every user entrypoint against the categories below and prefer the hardened examples over hand-rolled variants. Execution Safety The shell commands in this skill are local audit examples. Run them only in a trusted checkout or disposable sandbox, and do not splice untrusted contract names, paths, RPC URLs, private keys, or user-supplied flags into shell commands. Ask before installing tools or running long fuzzing/static-analysis jobs that may consume significant local or paid resources. Never include secrets, private keys, seed phrases, API tokens, or mainnet signing credentials in command examples, logs, or reports. Examples Reentrancy: enforce CEI order Vulnerable: Safe: Do not write your own guard when a hardened library exists. Donation or inflation attacks Using token.balanceOf(address(this)) directly for share math lets attackers manipulate the denominator by sending tokens to the contract outside the intended path. Track internal accounting and measure actual tokens received. Oracle manipulation Spot prices are flash-loan manipulable. Prefer TWAP. Slippage protection Every swap path needs caller-provided slippage and a deadline. Safe reserve math For large reserve math, avoid naive a b / c when overflow risk exists. Admin controls Prefer explicit acceptance for ownership transfer and gate every privileged path. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/defi-amm-security--c16dab