Defi Amm Security

A checklist and pattern library for auditing Solidity AMM and liquidity pool contracts. Covers the critical vulnerabilities that show up in DeFi protocols: reentrancy guards and CEI ordering, donation attacks from using raw balanceOf in share math, oracle manipulation via spot prices instead of TWAP, missing slippage protection, and overflow-prone reserve calculations. Each section shows a vulnerable pattern next to the hardened version using OpenZeppelin or Uniswap libraries. The security checklist at the end is a good final pass before you ship or before you start a deeper audit. Includes commands for Slither, Echidna, and Foundry fuzzing. This is reference material, not a tutorial, so you'll want some AMM background first.

skills.sh installs: 5.4K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill defi-amm-security --agent claude-code

Installs into .claude/skills of the current project.

Files

DeFi AMM Security

Critical vulnerability patterns and hardened implementations for Solidity AMM contracts, LP vaults, and swap functions.

When to Use

Writing or auditing a Solidity AMM or liquidity-pool contract
Implementing swap, deposit, withdraw, mint, or burn flows that hold token balances
Reviewing any contract that uses token.balanceOf(address(this)) in share or reserve math
Adding fee setters, pausers, oracle updates, or other admin functions to a DeFi protocol

How It Works

Use this as a checklist-plus-pattern library. Review every user entrypoint against the categories below and prefer the hardened examples over hand-rolled variants.

Execution Safety

The shell commands in this skill are local audit examples. Run them only in a trusted checkout or disposable sandbox, and do not splice untrusted contract names, paths, RPC URLs, private keys, or user-supplied flags into shell commands. Ask before installing tools or running long fuzzing/static-analysis jobs that may consume significant local or paid resources.

Never include secrets, private keys, seed phrases, API tokens, or mainnet signing credentials in command examples, logs, or reports.

SKILL.md on GitHub