defi-amm-security
by affaan-mdefi-amm-security is a focused security checklist for Solidity AMMs, liquidity pools, LP vaults, and swap flows. It helps auditors and engineers review reentrancy, CEI ordering, donation or inflation attacks, oracle assumptions, slippage, admin controls, and integer math with less guesswork than a generic prompt.
This skill scores 78/100, which means it is a solid listing candidate for directory users who need DeFi AMM-specific security guidance. It gives enough concrete workflow content to be meaningfully more useful than a generic prompt, though it still lacks some adoption aids like a dedicated install command and supporting reference files.
- Clear use cases for AMM, liquidity-pool, and swap-flow audits, so agents can trigger it with low guesswork
- Substantive checklist-plus-pattern content with security topics like reentrancy, CEI ordering, donation/inflation attacks, oracle manipulation, and admin controls
- Good operational structure: valid frontmatter, multiple headings, and code examples that help an agent follow hardened implementation patterns
- No install command and no support files (scripts, references, resources), so adoption relies mainly on the SKILL.md content
- The repository preview shows only one file, so users should expect a focused checklist skill rather than a broader automated audit workflow
Overview of defi-amm-security skill
What defi-amm-security is for
The defi-amm-security skill is a focused review aid for Solidity AMMs, liquidity pools, LP vaults, and swap logic. It helps you audit the parts that usually break first: reentrancy, checks-effects-interactions order, reserve and share math, slippage handling, oracle assumptions, donation or inflation attacks, and privileged admin controls.
Who should install it
Install the defi-amm-security skill if you are building or reviewing a DeFi protocol with token balances, pricing logic, or user-facing entrypoints. It is especially useful for auditors, protocol engineers, and security reviewers who need a practical defi-amm-security for Security Audit workflow instead of a generic Solidity checklist.
What makes it different
This skill is narrower than a general smart-contract security prompt. The value of defi-amm-security is that it centers the real AMM failure modes that affect funds, pricing, and share accounting. That means less guesswork when you need to decide whether a pool is safe to ship, whether a swap path is manipulable, or whether a vault’s math can be distorted by empty-state or balance-based edge cases.
How to Use defi-amm-security skill
Install and locate the skill
Use the repository install flow for your environment, then point your agent at skills/defi-amm-security. Start by reading SKILL.md first, because it contains the intended scope and the security categories the skill expects you to check.
Give the skill the right input
The defi-amm-security usage works best when your prompt includes:
- the contract type: AMM, LP vault, router, swapper, or fee module
- the risky functions:
swap,deposit,withdraw,mint,burn,skim,sync - the token model: ERC20, fee-on-transfer, rebasing, or wrapped assets
- the pricing model: constant product, stableswap, share-based accounting, or oracle-dependent pricing
A stronger prompt is specific, for example: “Audit this AMM for donation attacks, reentrancy, and reserve manipulation, and check whether token.balanceOf(address(this)) can be abused in share math.” That is much better than “review this DeFi contract.”
Read the repo in the right order
For defi-amm-security install, the highest-signal path is:
SKILL.mdfor scope and examples- the target AMM or vault contracts
- any router, adapter, or oracle files that affect pricing or execution
- tests that cover edge cases, especially zero-liquidity, fee changes, and unusual token behavior
This skill does not rely on helper folders in the repository, so the main value comes from applying its checklist to your codebase, not from extra assets.
Use a security-audit workflow
Treat the skill as a pass over each entrypoint and accounting assumption:
- check external calls before state updates
- verify slippage and deadline protections exist where users expect them
- test whether deposits, withdrawals, or swaps can be skewed by stale balances
- confirm admin powers cannot silently change economics without controls or events
The best defi-amm-security guide usage is to map each function to one threat class, then write down the exploit path you are trying to rule out.
defi-amm-security skill FAQ
Is this only for AMMs?
No. The defi-amm-security skill also fits LP vaults, swap routers, and any Solidity contract that prices assets from balances or reserves. If the contract moves tokens and computes shares, this skill is relevant.
When should I not use it?
Do not use defi-amm-security as your only review method for governance, cross-chain bridges, or non-DeFi business logic. It is specialized for pool math, swap execution, and token-flow security, so broader protocol risks need additional review.
Is it better than a generic prompt?
Usually yes for this use case. A generic prompt may miss donation attacks, reserve desync, oracle dependency, or CEI violations in swap paths. The defi-amm-security skill narrows attention to the issues that actually cause AMM losses.
Is it beginner-friendly?
Yes, if you already know basic Solidity and ERC20 behavior. The skill is useful for beginners because it gives a concrete review frame, but you still need to understand how balances, shares, and external calls interact before trusting the result.
How to Improve defi-amm-security skill
Provide the contract context up front
The quality of defi-amm-security output improves when you include the pool design, token behavior, and trust assumptions. Say whether fees exist, whether the protocol uses an oracle, and whether admins can pause, upgrade, or set parameters. Those details change the attack surface.
Ask for the failure mode, not just the bug
A good defi-amm-security usage prompt asks the model to explain how the issue could be exploited and what state transition makes it possible. That produces more useful review notes than a simple “find vulnerabilities” request.
Force edge-case checks
The biggest failure modes in AMM review are usually around empty pools, first deposit, rounding, fee-on-transfer tokens, and balance-based accounting. Ask the skill to test those paths explicitly so you get signal beyond standard reentrancy advice.
Iterate with code and test outputs
After the first pass, feed the skill the exact function, invariant, or failing test you want rechecked. For defi-amm-security for Security Audit, the fastest improvement comes from narrowing the question: “Does this withdraw path still resist donation attacks if the token charges a transfer fee?”