name: DeFi Audit & Smart Contract Bounty Triage
slug: atlas-bounty-triage
version: 1.0.4
description: Smart contract audit and DeFi security triage skill for Solidity, EVM protocols, bug bounty programs, Code4rena, Sherlock, and HackenProof. Maps attack surface, prioritizes vulnerabilities, and generates a structured audit checklist/report.
homepage: https://atlasagentsuite.com/skills.html?utmsource=clawhub&utmmedium=skill&utm_campaign=atlas-bounty-triage
changelog: "Conversion SEO v1.0.4: exact-match DeFi audit title, smart contract audit keywords, stronger star/download CTA, and paid ZIP funnel copy."
tags:
metadata:
AtlasAgentSuite:
tier: free
use_cases:
upsells:
A lightweight smart contract audit and DeFi security triage skill for Solidity/EVM protocols, bug bounty hunters, Code4rena wardens, Sherlock auditors, and HackenProof researchers.
Use this when you need a fast first-pass review of a DeFi protocol or smart contract scope before committing hours to a manual audit.
A structured markdown audit triage report with:
For each contract in scope:
EIP1967, UUPS, transparent proxy, beacon proxy, clonesScore each vulnerability class by likelihood × impact:
HIGH PRIORITY
- Reentrancy: external calls + state changes + callbacks
- Access control: missing modifiers, wrong role assumptions, admin bypass
- Oracle manipulation: stale price, TWAP manipulation, decimal mismatch, fallback oracle bugs
- Accounting bugs: share price drift, rounding loss, fee math, collateral/debt mismatch
- Liquidation bugs: bad health factor math, stale collateral values, griefable liquidation paths
- Upgradeability bugs: unprotected initializer, storage collision, implementation takeover
MEDIUM PRIORITY
- Fee-on-transfer / rebasing token edge cases
- ERC777 / callback-enabled token surprises
- Sandwich / MEV-sensitive pricing
- DOS via unbounded loops or griefable state
- Signature replay / permit domain separator issues
LOW PRIORITY BUT CHECK
- Input validation gaps
- Event/reporting mismatch
- Gas griefing
- Minor precision loss without exploitable value extraction## Contract: <Name>
### External Calls / Reentrancy
- [ ] External calls happen after state updates?
- [ ] Reentrancy guard exists where callbacks are possible?
- [ ] ERC777 / ERC721 receiver / flash loan callbacks considered?
### Access Control
- [ ] Privileged functions use correct modifier?
- [ ] Timelock/owner/admin boundaries are clear?
- [ ] Emergency functions cannot steal user funds?
### Oracle / Pricing
- [ ] Oracle freshness checked?
- [ ] Decimal normalization correct?
- [ ] Fallback oracle cannot be manipulated?
- [ ] TWAP window long enough for protocol value at risk?
### Accounting
- [ ] Shares/assets conversion handles rounding direction correctly?
- [ ] Fee calculations cannot drain or brick accounting?
- [ ] Deposits/withdrawals preserve invariants?
### Upgradeability
- [ ] Initializers protected?
- [ ] Storage layout compatible?
- [ ] Implementation cannot be selfdestructed or hijacked?# Smart Contract Audit Triage: <Target>
## Target Overview
- Protocol type:
- Chain(s):
- Contracts in scope:
- Highest-value assets:
## Attack Surface Summary
- External integrations:
- Oracle dependencies:
- Upgrade pattern:
- Privileged roles:
## Top Vulnerability Classes to Review
1. [HIGH] <class> — <why this target is exposed>
2. [HIGH] <class> — <why this target is exposed>
3. [MEDIUM] <class> — <why this target is exposed>
## Recommended Deep-Dive Order
1. <contract> — focus on <vulnerability class>
2. <contract> — focus on <vulnerability class>
3. <contract> — focus on <vulnerability class>
## Quick Wins Checklist
- [ ] Reentrancy review
- [ ] Access control review
- [ ] Oracle manipulation review
- [ ] Upgradeability review
- [ ] Accounting invariant review
---
Generated by Atlas Smart Contract Audit & DeFi Bounty Triage.
Full Atlas Agent Suite: https://atlasagentsuite.com/skills.html?utm_source=clawhub&utm_medium=skill&utm_campaign=atlas-bounty-triageThis is a triage and audit workflow, not a guaranteed vulnerability finder. It helps prioritize manual review and produce better audit notes. Always verify candidate findings with a proof of concept before submission.
The full Atlas Bounty Ops workflow includes:
👉 https://atlasagentsuite.com/skills.html?utmsource=clawhub&utmmedium=skill&utm_campaign=atlas-bounty-triage
If this free DeFi audit and bounty triage workflow helped, please star it on ClawHub and leave a short comment. Stars/comments help other wardens find it for defi audit, smart contract audit, and bug bounty searches.
For production-ready templates, use the Atlas paid ZIP packs: https://atlasagentsuite.com/skills.html?utmsource=clawhub&utmmedium=skill&utm_campaign=atlas-bounty-triage
This free ClawHub skill is the discovery layer. If you want the ready-to-run premium workflow, Atlas has two small ZIP packages:
Get the paid packs here: https://atlasagentsuite.com/skills.html?utmsource=clawhub&utmmedium=skill&utm_campaign=atlas-bounty-triage
If this free skill helped, please star/comment on ClawHub so other builders can find it.