--- name: rr-solidity-1bab3dd6252b description: Comprehensive Solidity smart contract development skill using Foundry framework. Use for writing, testing, deploying, and auditing Solidity contracts with security-first practices. Also triggers when working with .sol files, Foundry project files (foundry.toml), test files (.t.sol), or smart contract deployment scripts. Example triggers: "Write smart contract", "Create Solidity test", "Deploy contract", "Audit smart contract", "Fix security vulnerability", "Write Foundry test", "Set up Foundry project" --- # Solidity Development with Foundry ## Overview Comprehensive skill for professional Solidity smart contract development using the Foundry framework. Provides security-first development practices, testing patterns, static analysis integration (Slither, solhint), and deployment workflows for EVM-compatible blockchains. ## When to Use This Skill Automatically activate when: - Working with `.sol` (Solidity) files - User mentions smart contracts, blockchain, Web3, DeFi, or Ethereum - Foundry project detected (`foundry.toml` present) - User requests contract deployment, testing, or security auditing - Working with forge, cast, or anvil commands - Implementing ERC standards (ERC20, ERC721, ERC1155, etc.) ## Development Workflow ### 1. Write Secure Contracts Follow security-first patterns from `references/solidity-security.md`: **Always implement:** - Checks-Effects-Interactions (CEI) pattern - Access control (Ownable, AccessControl) - Input validation - Emergency pause mechanisms - Pull over push for payments - Custom errors for gas efficiency **Example contract structure:** ```solidity // SPDX-License-Identifier: MIT pragma solidity ^0.8.30; import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol"; import {Pausable} from "@openzeppelin/contracts/security/Pausable.sol"; contract MyContract is Ownable, Pausable { /*////////////////////////////////////////////////////////////// ERRORS //////////////////////////////////////////////////////////////*/ error InvalidInput(); error InsufficientBalance(); /*////////////////////////////////////////////////////////////// EVENTS //////////////////////////////////////////////////////////////*/ event ActionCompleted(address indexed user, uint256 amount); /*////////////////////////////////////////////////////////////// STATE VARIABLES //////////////////////////////////////////////////////////////*/ mapping(address => uint256) public balances; /*////////////////////////////////////////////////////////////// CONSTRUCTOR //////////////////////////////////////////////////////////////*/ constructor() Ownable(msg.sender) {} /*////////////////////////////////////////////////////////////// EXTERNAL FUNCTIONS //////////////////////////////////////////////////////////////*/ function deposit() external payable whenNotPaused { if (msg.value == 0) revert InvalidInput(); balances[msg.sender] += msg.value; emit ActionCompleted(msg.sender, msg.value); } function withdraw(uint256 amount) external whenNotPaused { // CEI Pattern: Checks if (amount == 0) revert InvalidInput(); if (balances[msg.sender] < amount) revert InsufficientBalance(); // Effects balances[msg.sender] -= amount; // Interactions (bool success, ) = msg.sender.call{value: amount}(""); require(success, "Transfer failed"); emit ActionCompleted(msg.sender, amount); } } ``` ### 2. Write Comprehensive Tests Follow testing patterns from `references/foundry-testing.md`: **Test structure:** ```solidity import {Test, console} from "forge-std/Test.sol"; import {MyContract} from "../src/MyContract.sol"; contract MyContractTest is Test { MyContract public myContract; address constant OWNER = address(1); address constant USER = address(2); function setUp() public { vm.prank(OWNER); myContract = new MyContract(); } // Unit tests function test_Deposit() public { } // Edge cases function test_RevertWhen_ZeroDeposit() public { } // Fuzz tests function testFuzz_Deposit(uint256 amount) public { } // Invariant tests function invariant_TotalBalanceMatchesContract() public { } } ``` **Run tests:** ```bash forge test # Run all tests forge test -vvv # Verbose output forge test --gas-report # Include gas costs forge coverage # Coverage report ``` ### 3. Security Analysis **Run comprehensive security checks:** ```bash # Static analysis with Slither slither . --exclude-optimization --exclude-informational # Linting with solhint solhint 'src/**/*.sol' 'test/**/*.sol' # Or use the automated script bash scripts/check_security.sh ``` **Pre-deployment checklist** (from `references/solidity-security.md`): - [ ] Reentrancy protection implemented - [ ] Access controls on privileged functions - [ ] Input validation on all external functions - [ ] Emergency pause mechanism - [ ] External calls follow CEI pattern - [ ] Events emitted for state changes - [ ] Gas optimizations applied - [ ] Test coverage >90% - [ ] Slither analysis passed - [ ] solhint checks passed - [ ] Professional audit for mainnet ### 4. Build and Deploy **Build contracts:** ```bash forge build --optimize --optimizer-runs 200 ``` **Deploy using script:** ```solidity // script/Deploy.s.sol import {Script} from "forge-std/Script.sol"; import {MyContract} from "../src/MyContract.sol"; contract DeployScript is Script { function run() external { uint256 deployerPrivateKey = vm.envUint("PRIVATE_KEY"); vm.startBroadcast(deployerPrivateKey); MyContract myContract = new MyContract(); console.log("Deployed at:", address(myContract)); vm.stopBroadcast(); } } ``` **Execute deployment:** ```bash # Load environment variables source .env # Simulate deployment forge script script/Deploy.s.sol --rpc-url $SEPOLIA_RPC_URL # Deploy to testnet forge script script/Deploy.s.sol \ --rpc-url $SEPOLIA_RPC_URL \ --broadcast \ --verify # Deploy to mainnet (after audits!) forge script script/Deploy.s.sol \ --rpc-url $MAINNET_RPC_URL \ --broadcast \ --verify ``` ## Advanced Testing Patterns ### Mainnet Forking Test against real deployed contracts: ```solidity contract ForkTest is Test { IERC20 constant USDC = IERC20(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48); function setUp() public { vm.createSelectFork("mainnet", 18_000_000); } function test_InteractWithRealProtocol() public { // Test with actual mainnet state } } ``` ```bash forge test --fork-url $MAINNET_RPC_URL ``` ### Invariant Testing Test properties that must always hold: ```solidity function invariant_SumOfBalancesEqualsTotalSupply() public { assertEq(token.totalSupply(), handler.sumOfBalances()); } ``` ### Fuzz Testing Test with randomized inputs: ```solidity function testFuzz_Transfer(address to, uint256 amount) public { vm.assume(to != address(0)); amount = bound(amount, 1, 1000 ether); // Test with random inputs } ``` ## Gas Optimization Key strategies from `references/solidity-security.md`: 1. **Storage packing** - Group uint8/uint16/etc in single slots 2. **uint256 for counters** - Native EVM word size 3. **calldata over memory** - For function parameters 4. **Events over storage** - Log data instead of storing 5. **Custom errors** - More gas-efficient than strings 6. **Immutable/constant** - For unchanging values ## Contract Verification ```bash # Verify on Etherscan forge verify-contract $CONTRACT_ADDRESS \ src/MyContract.sol:MyContract \ --chain-id 1 \ --etherscan-api-key $ETHERSCAN_KEY # With constructor args forge verify-contract $CONTRACT_ADDRESS \ src/MyContract.sol:MyContract \ --chain-id 1 \ --etherscan-api-key $ETHERSCAN_KEY \ --constructor-args $(cast abi-encode "constructor(uint256)" 100) ``` ## Common Commands Reference Quick reference from `references/foundry-commands.md`: **Development:** ```bash forge build # Compile contracts forge test # Run tests forge test -vvv # Verbose test output forge coverage # Coverage report forge fmt # Format code forge clean # Clean artifacts ``` **Testing:** ```bash forge test --match-test test_Transfer # Run specific test forge test --match-contract MyTest # Run specific contract forge test --gas-report # Show gas usage forge test --fork-url $RPC_URL # Fork testing forge snapshot # Gas snapshot ``` **Deployment:** ```bash forge script script/Deploy.s.sol --broadcast forge create src/MyContract.sol:MyContract --rpc-url $RPC_URL forge verify-contract $ADDRESS src/MyContract.sol:MyContract ``` **Debugging:** ```bash forge test --debug test_MyTest # Interactive debugger cast run $TX_HASH --debug # Debug transaction cast run $TX_HASH --trace # Trace transaction ``` **Local node:** ```bash anvil # Start local node anvil --fork-url $MAINNET_RPC_URL # Fork mainnet locally ``` ## Security Tools Integration ### Slither Static analyzer with 99+ vulnerability detectors: ```bash slither . # Full analysis slither . --exclude-optimization # Skip optimizations slither . --exclude-informational # Critical issues only slither . --checklist # Generate checklist ``` ### solhint Linter configured via `assets/solhint.config.json`: ```bash solhint 'src/**/*.sol' # Lint source solhint 'test/**/*.sol' # Lint tests solhint --fix 'src/**/*.sol' # Auto-fix issues ``` ## Resources ### references/ - `solidity-security.md` - Comprehensive security patterns, vulnerabilities, and mitigation strategies - `foundry-testing.md` - Testing patterns including fuzzing, invariants, fork testing, and mocking - `foundry-commands.md` - Complete command reference for forge, cast, and anvil ## Best Practices Summary 1. **Security First**: Always implement CEI pattern, access controls, and input validation 2. **Test Coverage**: Aim for >90% coverage with unit, fuzz, and invariant tests 3. **Static Analysis**: Run Slither and solhint before every deployment 4. **Gas Optimization**: Apply after security, never at the expense of safety 5. **Documentation**: Use NatSpec comments for all public/external functions 6. **Audit**: Professional audit required for mainnet deployment 7. **Verification**: Verify all contracts on Etherscan post-deployment 8. **Emergency**: Include pause mechanisms for critical contracts ## Common Patterns to Reference When implementing specific functionality, reference these sections: - **ERC20 tokens** - Use OpenZeppelin's implementation - **Access control** - `references/solidity-security.md` (AccessControl, Ownable) - **Upgradeable contracts** - OpenZeppelin's proxy patterns - **Reentrancy protection** - `references/solidity-security.md` (CEI pattern) - **Testing external protocols** - `references/foundry-testing.md` (fork testing) - **Gas optimization** - `references/solidity-security.md` (optimization strategies) - **Randomness** - Use Chainlink VRF, never block.timestamp alone - **Oracles** - Use Chainlink price feeds for production ## Workflow Example Complete workflow for adding a new feature: 1. **Write contract** following security patterns 2. **Write tests** with >90% coverage 3. **Run tests**: `forge test -vvv` 4. **Check coverage**: `forge coverage` 5. **Run Slither**: `slither .` 6. **Run solhint**: `solhint 'src/**/*.sol'` 7. **Format code**: `forge fmt` 8. **Build**: `forge build` 9. **Deploy to testnet**: `forge script script/Deploy.s.sol --broadcast` 10. **Verify**: `forge verify-contract ...` 11. **Get audit** (for mainnet) 12. **Deploy to mainnet** after audit approval --- Source attribution: Activer007 Original project: https://github.com/Activer007/ordinary-claude-skills/blob/e3e1b3d55f9a132a68d242040d23048a7ba8f85c/skills_all/rr-solidity/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2025 Microck Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. i did not write most of these. i just collected them. * **anthropic skills:** mit license (mostly) * **community skills:** check the `LICENSE` file in each specific folder. credits go to https://github.com/anthropics, https://github.com/obra, https://github.com/ComposioHQ, and the other people listed in the source tables. if you own one of these and want me to take it down, just open an issue and i will nuke it. # Mega AI Hub resource metadata Creator / publisher: Activer007 Original project: https://github.com/Activer007/ordinary-claude-skills/blob/e3e1b3d55f9a132a68d242040d23048a7ba8f85c/skills_all/rr-solidity/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering, Product Management Roles: Backend Developer, DevOps / SRE, Growth Product Manager, ML / AI Engineer, Product Manager Specialties: API, Backend, Cross Platform, Testing Tools: Foundry Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: cf1f87caa395c468ec558972bf5f5463bd1d43f5f3dbe83873779698eceec315