solidity-security

Solidity Security Standards

Language Rule

• Always respond in the same language the user is using. If the user asks in Chinese, respond in Chinese. If in English, respond in English.

Private Key Protection

• Before an on-chain write, let the developer choose a signing method:
  • Foundry Keystore (recommended): import with cast wallet import <NAME> --interactive and use --account <NAME>.
  • Environment file: store PRIVATE_KEY in .env, load it with source .env, and reference "$PRIVATE_KEY"; never paste the literal value into a command.
• Never expose private keys in logs, screenshots, conversations, or commits
• Provide .env.example with placeholder values for team reference
• Add .env to .gitignore — verify with git status before every commit
• Never read or print a developer's .env; only provide commands for the developer to run

Security Decision Rules

When writing or reviewing Solidity code, apply these rules:

Reentrancy Protection

• All contracts with external calls: inherit ReentrancyGuard, add nonReentrant modifier
  • Import: @openzeppelin/contracts/security/ReentrancyGuard.sol (OZ 4.9.x)
• Always apply CEI pattern even with ReentrancyGuard:
  1. Checks — validate all conditions (require)
  2. Effects — update state variables
  3. Interactions — external calls last

Input Validation

• Reject address(0) for all address parameters
• Reject zero amounts for fund transfers
• Validate array lengths match when processing paired arrays
• Bound numeric inputs to reasonable ranges (prevent dust attacks, gas griefing)

Gas Control

• Deployment commands must include --gas-limit (recommended >= 3,000,000)
• Monitor gas with forge test --gas-report — review before every PR
• Configure optimizer in foundry.toml: optimizer = true, optimizer_runs = 200
• Avoid unbounded loops over dynamic arrays — use pagination or pull patterns

Pre-Audit Checklist

Before submitting code for review or audit, verify:

Access & Control:

• All external/public functions have nonReentrant where applicable
• No tx.origin used for authentication (use msg.sender)
• No delegatecall to untrusted addresses
• Owner transfer uses Ownable2Step (not Ownable) to prevent accidental loss
• Contracts with user-facing functions inherit Pausable with pause() / unpause()
• UUPS _authorizeUpgrade has onlyOwner modifier — EVMbench/basin H-01
• Implementation constructor calls _disableInitializers() — EVMbench/basin H-01
• Router/Registry relay operations verify source contract authorization — EVMbench/noya H-08

Token & Fund Safety:

• All ERC20 interactions use SafeERC20 (safeTransfer / safeTransferFrom)
• No raw token.transfer() or require(token.transfer()) patterns
• Token approvals use safeIncreaseAllowance, not raw approve
• All external call return values checked

Code Quality:

• Events emitted for every state change
• No hardcoded addresses — use config or constructor params
• .env is in .gitignore

Oracle & Price (if applicable):

• Price data sourced from Chainlink feed or TWAP — never raw spot price
• Oracle has minimum liquidity check — revert if pool reserves too low
• Price deviation circuit breaker in place

Testing:

• forge test passes with zero failures
• forge coverage shows adequate coverage on security-critical paths
• Fuzz tests cover arithmetic edge cases (zero, max uint, boundary values)

Security Verification Commands

# Run all tests with gas report
forge test --gas-report
 
# Fuzz testing with higher runs for critical functions
forge test --fuzz-runs 10000
 
# Check test coverage
forge

Slither MCP Integration (if available)

When slither MCP is configured, prefer it over the CLI for structured analysis:

Recommended: Use slither MCP when working with AI agents (results are structured and actionable). Use CLI for quick local checks during development.

Graceful degradation: If neither slither MCP nor slither CLI is available, rely on the Pre-Audit Checklist above and forge test --fuzz-runs 10000 for coverage.