building-secure-contracts

What this skill does

Guides security engineers and auditors through smart contract security reviews on non-EVM chains: Solana (Anchor/native), Algorand (AVM/PyTeal), Cairo (Starknet), Cosmos (CosmWasm), Substrate (ink!/FRAME pallets), and TON (FunC/Tact). Covers platform-specific vulnerability patterns, chain-appropriate static analysis tooling, a common vulnerability checklist per platform, and a pre-audit code maturity assessment to determine whether a codebase is ready for a formal audit.

When to use

When auditing or reviewing smart contracts on any non-EVM chain (Solana, Algorand, Cairo, Cosmos, Substrate, TON)
When assessing whether a multi-chain protocol is audit-ready before scheduling a formal engagement
When triaging a bug bounty submission from a non-EVM chain
When onboarding to a new chain and needing a structured security checklist
When mapping vulnerability classes across chains for a cross-chain bridge or interoperability protocol

Prerequisites

Chain-specific tooling — install only what matches your target platform:

Solana

# Anchor framework (includes anchor-cli with built-in lint)
cargo install --git https://github.com/coral-xyz/anchor anchor-cli --locked
# Soteria static analyzer (optional, proprietary)
# https://www.soteria.dev/

Cairo / Starknet

# cairo-lint (Scarb plugin)
scarb add --dev cairo_lint
# Or standalone
cargo install cairo-lint

Cosmos / CosmWasm

# cargo-audit for dependency CVEs
cargo install cargo-audit
# cosmwasm-check for schema and interface validation
cargo install cosmwasm-check

Substrate / ink!

cargo install cargo-contract
cargo install cargo-audit

Algorand

pip install pyteal tealer   # Tealer: AVM static analysis

TON

npm install -g @tact-lang/compiler  # Tact compiler with type checks
# toncli or blueprint for project scaffolding

All platforms

# Generic dependency audit
cargo audit        # Rust chains
pip-audit          # Python chains
npm audit          # JS/TS tooling

Inputs

Variable	Required	Description
`SECSKILL_CONTRACT_DIR`	required	Path to the contract source root
`SECSKILL_CHAIN`	required	Target chain: `solana`, `algorand`, `cairo`, `cosmos`, `substrate`, `ton`
`SECSKILL_PROTOCOL_NAME`	optional	Protocol name for report labeling
`SECSKILL_OUTPUT_DIR`	optional	Directory for findings output (default: `./output`)

Workflow

Step 1: Identify chain and platform

export SRC="${SECSKILL_CONTRACT_DIR:?Set SECSKILL_CONTRACT_DIR}"
export CHAIN="${SECSKILL_CHAIN:?Set SECSKILL_CHAIN (solana|algorand|cairo|cosmos|substrate|ton)}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export PROTOCOL="${SECSKILL_PROTOCOL_NAME:-unknown}"
mkdir -p "$OUTDIR"

echo "===== Pre-Audit Assessment: $PROTOCOL ====="
echo "Chain        : $CHAIN"
echo "Source path  : $SRC"

# Count contract source files by chain
case "$CHAIN" in
  solana|cosmos|substrate)
    find "$SRC" -name "*.rs" | grep -v target | grep -v tests | wc -l
    ;;
  cairo)
    find "$SRC" -name "*.cairo" | wc -l
    ;;
  algorand)
    find "$SRC" -name "*.py" -o -name "*.teal" | wc -l
    ;;
  ton)
    find "$SRC" -name "*.fc" -o -name "*.tact" | wc -l
    ;;
esac

echo "[*] Check: Is there a prior audit report in docs/ or audits/?"
echo "[*] Check: Are test files present and covering happy + sad paths?"
echo "[*] Check: Is the deployment/migration script reviewed separately?"

Step 2: Static analysis with chain-specific tools

Run the appropriate analyzer for your target chain. Save output to $OUTDIR.

cd "$SRC"
case "$CHAIN" in
  solana)
    anchor build 2>&1 | tee "$OUTDIR/anchor-build.log"
    rg --type rust "pub [a-z_]+: Account" --no-heading | grep -v "Signer\|Mut" \
      > "$OUTDIR/signer-candidates.txt"
    rg --type rust "\.owner\s*!?=\|check_program_id\|constraint.*owner" \
      > "$OUTDIR/ownership-checks.txt"
    ;;
  cairo)
    scarb lint 2>&1 | tee "$OUTDIR/cairo-lint.log"
    grep -rn "\bfelt252\b" "$SRC" --include="*.cairo" | grep "[+\-\*]" \
      > "$OUTDIR/felt-arithmetic.txt"
    grep -rn "#\[external\]\|fn.*external" "$SRC" --include="*.cairo" \
      > "$OUTDIR/external-entrypoints.txt"
    ;;
  cosmos)
    cosmwasm-check "$SRC"/artifacts/*.wasm 2>&1 | tee "$OUTDIR/cosmwasm-check.log"
    cargo audit 2>&1 | tee "$OUTDIR/cargo-audit.log"
    rg --type rust "as u64\|as u128\|as i64\|unchecked_" > "$OUTDIR/unsafe-casts.txt"
    ;;
  substrate)
    cargo contract build 2>&1 | tee "$OUTDIR/cargo-contract-build.log"
    cargo test 2>&1 | tee "$OUTDIR/cargo-test.log"
    cargo audit 2>&1 | tee "$OUTDIR/cargo-audit.log"
    rg --type rust "saturating_add\|saturating_sub\|checked_" > "$OUTDIR/arithmetic-patterns.txt"
    ;;
  algorand)
    tealer analyze "$SRC" 2>&1 | tee "$OUTDIR/tealer.log"
    grep -rn "Gtxn\|GroupSize\|group_size" "$SRC" --include="*.py" --include="*.teal" \
      > "$OUTDIR/group-txn-checks.txt"
    grep -rn "AuthAddr\|RekeyTo\|auth_addr" "$SRC" --include="*.py" --include="*.teal" \
      > "$OUTDIR/rekey-checks.txt"
    ;;
  ton)
    find "$SRC" -name "*.tact" | grep -q . && \
      npx tact --check "$SRC" 2>&1 | tee "$OUTDIR/tact-check.log"
    grep -rn "sender()\|msg_sender\|get_sender" "$SRC" \
      --include="*.fc" --include="*.tact" > "$OUTDIR/sender-checks.txt"
    grep -rn "send_raw_message\|BOUNCEABLE\|NON_BOUNCEABLE" "$SRC" \
      --include="*.fc" > "$OUTDIR/bounce-flags.txt"
    ;;
esac

Step 3: Common vulnerability checks per platform

Review findings from Step 2 against these platform-specific vulnerability patterns: