blockchain-security

Q: How do I install blockchain-security?

Run npx skills add https://github.com/transilienceai/communitytools --skill blockchain-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/blockchain-security/ (personal) or .claude/skills/blockchain-security/ (project).

Q: Which AI agents can use blockchain-security?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Q: Is blockchain-security safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Q: Who maintains blockchain-security?

It is published by transilienceai in transilienceai/communitytools. It has 575 recorded installs.

by transilienceaiBusiness & Finance

Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.

Installs: 575
Last 24h: +25
Trending rank: #4948
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/transilienceai/communitytools --skill blockchain-security

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads blockchain-security automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Blockchain Security

Quick Start

Download and decompile contracts (source or bytecode)
Map storage layout and identify privileged operations
Check for delegatecall, CREATE address prediction, reentrancy, access control
Deploy exploit contracts via web3.py or cast/forge
Verify win condition (isSolved/flag endpoint)

Blockchain CTF Challenge Pattern

# Get connection info
curl http://$HOST:$PORT/connection_info  # -> PrivateKey, Address, TargetAddress, setupAddress
# RPC endpoint
RPC_URL="http://$HOST:$PORT/rpc"
# Win condition: Setup.isSolved() must return true

Key Attack Vectors

1. Delegatecall Storage Manipulation

When contract A does delegatecall to contract B, B's code runs with A's storage.

Deploy exploit contract that mirrors A's storage layout
Exploit contract writes to A's storage slots via delegatecall
Critical: Storage layout must match exactly (same slot ordering)
See reference/delegatecall-attacks.md

2. CREATE Address Prediction (Nonce Manipulation)

Contract addresses from CREATE are deterministic: keccak256(rlp([sender, nonce]))[12:]

Brute-force nonce to find which nonce produces target address
Send dummy transactions (self-transfers) to increment nonce
Deploy exploit contract at the exact nonce that hits target address
See reference/create-address-prediction.md

3. Storage Layout & Slot Computation

Mappings: keccak256(h(key) || uint256(slot_number))
- Value types: h(k) = abi.encode(k) (left-padded to 32 bytes)
- String/bytes: h(k) = keccak256(k)
Read private variables via eth_getStorageAt
See reference/storage-layout.md

4. Empty Array / Zero-Length Input Bypass

When a function loops over a user-supplied array to validate items (signatures, approvals, votes), passing an empty array skips the loop entirely. If there's no minimum-length check, validation is bypassed.

Check: for (uint i = 0; i < arr.length; i++) with no require(arr.length >= N)
Exploit: Call the function with [] to skip all validation

5. ECDSA Signature Malleability

Raw ecrecover accepts both (v, r, s) and (v', r, N-s) (where N = secp256k1 order, v flipped 27↔28). If a contract deduplicates signatures by hash of raw bytes, the malleable form has a different hash but recovers to the same signer.

Check: ecrecover used without s <= N/2 enforcement (OpenZeppelin's ECDSA.sol enforces this)
Exploit: Take a known valid signature, compute new_s = N - s, flip v, submit as "new" signature

6. Common Vulnerability Classes

Vulnerability	Check
Reentrancy	External calls before state updates
Access control	Missing onlyOwner / msg.sender checks
Integer overflow	Solidity < 0.8.0 without SafeMath
Delegatecall injection	User-controlled delegatecall target
tx.origin auth	`tx.origin` instead of `msg.sender`
Selfdestruct	Force-send ETH, reset contract nonce
Weak randomness	blockhash/timestamp as entropy source
Empty array bypass	Loop validation with no min-length check
Signature malleability	Raw ecrecover without s-normalization

Tools

# web3.py essentials
from web3 import Web3
w3 = Web3(Web3.HTTPProvider(RPC_URL))
acct = w3.eth.account.from_key(PRIVATE_KEY)

# Read private storage
w3.eth.get_storage_at(contract_addr, slot)

# Deploy contract
from solcx import compile_source, install_solc
install_solc("0.8.13")
compiled = compile_source(source, output_values=["abi", "bin"], solc_version="0.8.13")

# Send raw bytecode deployment
tx = {'data': bytecode, 'gas': 3000000, 'gasPrice': w3.eth.gas_price, 'nonce': nonce, 'chainId': chain_id}
signed = acct.sign_transaction(tx)
w3.eth.send_raw_transaction(signed.raw_transaction)

Reference

Delegatecall Attacks
CREATE Address Prediction
Storage Layout

Critical Rules

Always read storage before attacking (private vars are readable on-chain)
Mirror exact storage layout when exploiting delegatecall
For CREATE nonce brute-force, check nonces 0-100000+ systematically
CTF instances are often ephemeral -- script the full attack for speed

FAQ

What does the blockchain-security skill do?

How do I install blockchain-security?

Run npx skills add https://github.com/transilienceai/communitytools --skill blockchain-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/blockchain-security/ (personal) or .claude/skills/blockchain-security/ (project).

Which AI agents can use blockchain-security?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is blockchain-security safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains blockchain-security?

It is published by transilienceai in transilienceai/communitytools. It has 575 recorded installs.

More from transilienceai/communitytools

View all →

attack-path-stitcher

transilienceai/communitytools

Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

1.4K installs