Auditing Foundry Smart Contract Security

Overview

Deployed smart contracts are immutable and custody real funds, so a bug shipped to mainnet cannot be patched — it can only be exploited. Most catastrophic DeFi losses come from a small set of recurring classes: reentrancy, broken access control, oracle/price manipulation, and unchecked arithmetic or external calls.

This skill runs a defense-in-depth, pre-deployment audit of a Foundry project, layering four independent techniques that each catch what the others miss:

1. Static analysis — slither (90+ detectors) and aderyn (Cyfrin, Rust) scan the AST/IR in seconds for known anti-patterns.
2. Symbolic execution — mythril (optional, slow) explores execution paths and SMT-solves for deep arithmetic/reentrancy bugs.
3. Property-based testing — forge test with fuzzing (testFuzz_*) and invariant tests (invariant_* + handler contracts with ghost variables) proves protocol-level properties hold across millions of random sequences.
4. Manual review + key hygiene — a structured checklist (see references/vulnerability-checklist.md) and a secrets/keystore audit so no pri…