{"data":{"skill":{"slug":"sickn33-defi-protocol-templates","name":"defi-protocol-templates","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/defi-protocol-templates","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"639ccc66-0fe8-41cf-9059-90b3955faf29","skill_id":"3c90d4d4-66e7-4aaf-bcb3-f64a1bcfae7e","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:86aba0c690bd59ac2c112540874d0a3456f54d7cbb9acdb2369ae219283ec5d7:dc03c77116ea19ea66cd72f74394fbb5edea2f6972e0bf4bd072e77789d14ae5:736b696c6c732f7369636b6e33332f646566692d70726f746f636f6c2d74656d706c61746573:3ac3d8c15576f96cdf2c55cfce9210ee","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 26 static findings are false positives caused by Solidity require statements and Markdown backticks, not dynamic loading, command execution, or reconnaissance. Semantic review found exploitable token-handling and receiver-authorization flaws, missing slippage protections, and a broken flash-loan repayment flow in examples described as production-ready.","remediation":[{"issue":"The flash-loan receiver approves any caller for an arbitrary token amount.","severity":"high","suggestion":"Store the trusted provider, require callbacks from that address, validate the asset, and limit approvals to the exact repayment."},{"issue":"Contracts ignore ERC20 transfer return values and assume requested amounts equal received amounts.","severity":"high","suggestion":"Use SafeERC20 and derive accounting from balance changes, or explicitly reject unsupported fee-on-transfer and rebasing tokens."},{"issue":"AMM entry points provide no minimum-output, minimum-share, or deadline parameters.","severity":"high","suggestion":"Add user-defined slippage bounds and deadlines, then test sandwich, stale-transaction, and fee-on-transfer scenarios."},{"issue":"The sample receiver approves repayment, but the provider never collects the approved amount.","severity":"medium","suggestion":"Define one repayment model and implement it consistently. Pull repayment with SafeERC20.safeTransferFrom or require a direct transfer before returning."},{"issue":"The skill labels unaudited examples as production-ready.","severity":"medium","suggestion":"Describe them as educational starting points and add explicit test, dependency-version, threat-model, and audit requirements."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":164,"line_start":164},{"file":"SKILL.md","line_end":181,"line_start":181},{"file":"SKILL.md","line_end":193,"line_start":193},{"file":"SKILL.md","line_end":312,"line_start":311},{"file":"SKILL.md","line_end":330,"line_start":330},{"file":"SKILL.md","line_end":331,"line_start":331},{"file":"SKILL.md","line_end":332,"line_start":332},{"file":"SKILL.md","line_end":335,"line_start":335},{"file":"SKILL.md","line_end":350,"line_start":350},{"file":"SKILL.md","line_end":351,"line_start":351},{"file":"SKILL.md","line_end":352,"line_start":352},{"file":"SKILL.md","line_end":396,"line_start":396},{"file":"SKILL.md","line_end":405,"line_start":404},{"file":"SKILL.md","line_end":416,"line_start":416}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":122,"line_start":36},{"file":"SKILL.md","line_end":126,"line_start":122},{"file":"SKILL.md","line_end":248,"line_start":126},{"file":"SKILL.md","line_end":252,"line_start":248},{"file":"SKILL.md","line_end":361,"line_start":252},{"file":"SKILL.md","line_end":365,"line_start":361},{"file":"SKILL.md","line_end":439,"line_start":365}]}],"critical_findings":[],"high_findings":[{"title":"Unauthenticated Flash-Loan Callback Grants Token Allowance","locations":[{"file":"SKILL.md","line_end":434,"line_start":423}],"confidence":0.99,"description":"The receiver accepts calls from any address and approves that caller to spend the requested asset. An attacker can request an allowance and drain held tokens.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The callback has no caller or asset validation and directly approves msg.sender for amount plus fee. This creates a clear unauthorized-spending path."},{"title":"Unsafe ERC20 Transfer and Accounting Assumptions","locations":[{"file":"SKILL.md","line_end":104,"line_start":92},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":169,"line_start":151},{"file":"SKILL.md","line_end":187,"line_start":174},{"file":"SKILL.md","line_end":211,"line_start":192},{"file":"SKILL.md","line_end":401,"line_start":390}],"confidence":0.97,"description":"Several contracts ignore ERC20 return values and update accounting from requested amounts. Failed or fee-charging transfers can create unbacked balances, shares, or payouts.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The examples call transfer and transferFrom without SafeERC20 or return checks, while state changes use nominal inputs. Nonstandard ERC20 behavior makes the accounting unsafe."},{"title":"AMM Omits User Slippage and Deadline Controls","locations":[{"file":"SKILL.md","line_end":171,"line_start":151},{"file":"SKILL.md","line_end":214,"line_start":192}],"confidence":0.98,"description":"Liquidity and swap functions accept no minimum return or deadline. Users cannot constrain adverse price movement, enabling sandwich losses and stale execution.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The public AMM methods expose only amounts and token selection. No minimum shares, minimum output, maximum input, or transaction deadline is enforced."}],"medium_findings":[{"title":"Flash-Loan Repayment Flow Is Inconsistent","locations":[{"file":"SKILL.md","line_end":416,"line_start":403},{"file":"SKILL.md","line_end":434,"line_start":422}],"confidence":0.99,"description":"The receiver grants an allowance, but the provider never pulls repayment. The sample receiver therefore leaves the provider balance unchanged and positive-fee loans revert.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The provider only checks its final balance, while the receiver only calls approve. No transferFrom or direct repayment connects those operations."},{"title":"Unaudited Examples Are Presented as Production-Ready","locations":[{"file":"SKILL.md","line_end":11,"line_start":9},{"file":"SKILL.md","line_end":461,"line_start":453}],"confidence":0.96,"description":"The skill calls these templates production-ready despite exploitable authorization and token-accounting flaws. This claim may encourage unsafe deployment without required hardening.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The production-ready claim is explicit, while the document itself recommends testing and professional audits and contains concrete exploitable flaws."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":475,"audit_model":"codex","audited_at":"2026-07-23T21:50:08.276+00:00","created_at":"2026-07-26T09:22:13.044161+00:00","static_findings":[{"id":"scripts:SKILL.md:93:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(amount > 0, \"Cannot stake 0\");","category":"scripts","line_end":93,"severity":"medium","line_start":93},{"id":"scripts:SKILL.md:101:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(amount > 0, \"Cannot withdraw 0\");","category":"scripts","line_end":101,"severity":"medium","line_start":101},{"id":"scripts:SKILL.md:164:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(shares > 0, \"Shares = 0\");","category":"scripts","line_end":164,"severity":"medium","line_start":164},{"id":"scripts:SKILL.md:181:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(amount0 > 0 && amount1 > 0, \"Amount0 or amount1 = 0\");","category":"scripts","line_end":181,"severity":"medium","line_start":181},{"id":"scripts:SKILL.md:193:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(tokenIn == address(token0) || tokenIn == address(token1), \"Invalid token\");","category":"scripts","line_end":193,"severity":"medium","line_start":193},{"id":"scripts:SKILL.md:311:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(","category":"scripts","line_end":312,"severity":"medium","line_start":311},{"id":"scripts:SKILL.md:330:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(block.number >= proposal.startBlock, \"Voting not started\");","category":"scripts","line_end":330,"severity":"medium","line_start":330},{"id":"scripts:SKILL.md:331:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(block.number <= proposal.endBlock, \"Voting ended\");","category":"scripts","line_end":331,"severity":"medium","line_start":331},{"id":"scripts:SKILL.md:332:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(!proposal.hasVoted[msg.sender], \"Already voted\");","category":"scripts","line_end":332,"severity":"medium","line_start":332},{"id":"scripts:SKILL.md:335:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(weight > 0, \"No voting power\");","category":"scripts","line_end":335,"severity":"medium","line_start":335},{"id":"scripts:SKILL.md:350:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(block.number > proposal.endBlock, \"Voting not ended\");","category":"scripts","line_end":350,"severity":"medium","line_start":350},{"id":"scripts:SKILL.md:351:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(!proposal.executed, \"Already executed\");","category":"scripts","line_end":351,"severity":"medium","line_start":351},{"id":"scripts:SKILL.md:352:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(proposal.forVotes > proposal.againstVotes, \"Proposal failed\");","category":"scripts","line_end":352,"severity":"medium","line_start":352},{"id":"scripts:SKILL.md:396:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(balanceBefore >= amount, \"Insufficient liquidity\");","category":"scripts","line_end":396,"severity":"medium","line_start":396},{"id":"scripts:SKILL.md:404:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(","category":"scripts","line_end":405,"severity":"medium","line_start":404},{"id":"scripts:SKILL.md:416:dynamic-require-with-variable","file":"SKILL.md","pattern":"Dynamic require with variable","snippet":"require(balanceAfter >= balanceBefore + fee, \"Flash loan not repaid\");","category":"scripts","line_end":416,"severity":"medium","line_start":416},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```solidity","category":"external_commands","line_end":122,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":126,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```solidity","category":"external_commands","line_end":248,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":252,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```solidity","category":"external_commands","line_end":361,"severity":"medium","line_start":252},{"id":"external_commands:SKILL.md:361:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":365,"severity":"medium","line_start":361},{"id":"external_commands:SKILL.md:365:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```solidity","category":"external_commands","line_end":439,"severity":"medium","line_start":365},{"id":"blocker:SKILL.md:193:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"require(tokenIn == address(token0) || tokenIn == address(token1), \"Invalid token\");","category":"blocker","line_end":193,"severity":"low","line_start":193},{"id":"blocker:SKILL.md:318:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"newProposal.id = proposalCount;","category":"blocker","line_end":318,"severity":"low","line_start":318}],"finding_verdicts":[{"id":"scripts:SKILL.md:93:dynamic-require-with-variable","reason":"This is a Solidity require assertion that rejects a zero stake. It does not load a module or execute dynamic code.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:101:dynamic-require-with-variable","reason":"This is a Solidity require assertion that rejects a zero withdrawal. It has no relation to dynamic module loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:164:dynamic-require-with-variable","reason":"The statement is a Solidity runtime condition requiring positive liquidity shares. No script import or variable module path is present.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:181:dynamic-require-with-variable","reason":"The statement is a Solidity validation check for nonzero withdrawal amounts. It cannot dynamically load or execute a dependency.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:193:dynamic-require-with-variable","reason":"This Solidity require restricts swaps to either configured token address. The scanner confused a contract assertion with a dynamic require call.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:311:dynamic-require-with-variable","reason":"This begins a multiline Solidity assertion checking proposal voting power. It does not resolve or import executable code.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:330:dynamic-require-with-variable","reason":"This is a Solidity voting-period assertion based on the current block. It is not a dynamic module require.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:331:dynamic-require-with-variable","reason":"This Solidity assertion rejects votes after the proposal end block. It performs no dynamic loading.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:332:dynamic-require-with-variable","reason":"This Solidity assertion prevents an address from voting twice. It is contract control flow, not script execution.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:335:dynamic-require-with-variable","reason":"This Solidity assertion requires positive voting power. There is no variable dependency path or code-loading behavior.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:350:dynamic-require-with-variable","reason":"This Solidity assertion permits execution only after voting ends. It does not invoke a script loader.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:351:dynamic-require-with-variable","reason":"This is a Solidity state check preventing repeated proposal execution. It does not dynamically require code.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:352:dynamic-require-with-variable","reason":"This Solidity assertion compares governance vote totals. It is unrelated to dynamic imports or execution.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:396:dynamic-require-with-variable","reason":"This Solidity assertion checks available flash-loan liquidity. It has no module-loading behavior.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:404:dynamic-require-with-variable","reason":"This begins a Solidity assertion checking the receiver callback result. It does not resolve or load executable files.","verdict":"false_positive","confidence":0.99},{"id":"scripts:SKILL.md:416:dynamic-require-with-variable","reason":"This Solidity assertion verifies the provider balance after a loan. It is not a dynamic require operation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The backticks delimit an inline Markdown file path. They do not execute a shell or Ruby command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"This is the opening fence for a Solidity Markdown example. It is documentation syntax, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"This closes a fenced Solidity example in Markdown. No shell or Ruby execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"This opens a fenced Solidity code example. Markdown backticks are not executable command substitution here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"This closes a Markdown code fence. The file contains documentation, not a shell context that executes backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:252:ruby-shell-backtick-execution","reason":"This is an opening Markdown fence labeled Solidity. It does not invoke any external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:361:ruby-shell-backtick-execution","reason":"This closes a fenced Solidity example. The backticks have no execution semantics in Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:365:ruby-shell-backtick-execution","reason":"This opens the flash-loan Solidity example as a Markdown code fence. It is not a Ruby or shell expression.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:193:system-reconnaissance","reason":"The line validates a token address inside a Solidity AMM. It does not inspect the host, network, environment, or installed software.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:318:system-reconnaissance","reason":"The line assigns a proposal identifier in contract storage. It performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unauthenticated Flash-Loan Callback Grants Token Allowance","severity":"high","locations":[{"file":"SKILL.md","line_end":434,"line_start":423}],"confidence":0.99,"description":"The receiver accepts calls from any address and approves that caller to spend the requested asset. An attacker can request an allowance and drain held tokens.","confidence_reasoning":"The callback has no caller or asset validation and directly approves msg.sender for amount plus fee. This creates a clear unauthorized-spending path."},{"title":"Unsafe ERC20 Transfer and Accounting Assumptions","severity":"high","locations":[{"file":"SKILL.md","line_end":104,"line_start":92},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":169,"line_start":151},{"file":"SKILL.md","line_end":187,"line_start":174},{"file":"SKILL.md","line_end":211,"line_start":192},{"file":"SKILL.md","line_end":401,"line_start":390}],"confidence":0.97,"description":"Several contracts ignore ERC20 return values and update accounting from requested amounts. Failed or fee-charging transfers can create unbacked balances, shares, or payouts.","confidence_reasoning":"The examples call transfer and transferFrom without SafeERC20 or return checks, while state changes use nominal inputs. Nonstandard ERC20 behavior makes the accounting unsafe."},{"title":"AMM Omits User Slippage and Deadline Controls","severity":"high","locations":[{"file":"SKILL.md","line_end":171,"line_start":151},{"file":"SKILL.md","line_end":214,"line_start":192}],"confidence":0.98,"description":"Liquidity and swap functions accept no minimum return or deadline. Users cannot constrain adverse price movement, enabling sandwich losses and stale execution.","confidence_reasoning":"The public AMM methods expose only amounts and token selection. No minimum shares, minimum output, maximum input, or transaction deadline is enforced."},{"title":"Flash-Loan Repayment Flow Is Inconsistent","severity":"medium","locations":[{"file":"SKILL.md","line_end":416,"line_start":403},{"file":"SKILL.md","line_end":434,"line_start":422}],"confidence":0.99,"description":"The receiver grants an allowance, but the provider never pulls repayment. The sample receiver therefore leaves the provider balance unchanged and positive-fee loans revert.","confidence_reasoning":"The provider only checks its final balance, while the receiver only calls approve. No transferFrom or direct repayment connects those operations."},{"title":"Unaudited Examples Are Presented as Production-Ready","severity":"medium","locations":[{"file":"SKILL.md","line_end":11,"line_start":9},{"file":"SKILL.md","line_end":461,"line_start":453}],"confidence":0.96,"description":"The skill calls these templates production-ready despite exploitable authorization and token-accounting flaws. This claim may encourage unsafe deployment without required hardening.","confidence_reasoning":"The production-ready claim is explicit, while the document itself recommends testing and professional audits and contains concrete exploitable flaws."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"86aba0c690bd59ac2c112540874d0a3456f54d7cbb9acdb2369ae219283ec5d7","subject_tree_hash":"dc03c77116ea19ea66cd72f74394fbb5edea2f6972e0bf4bd072e77789d14ae5","subject_plugin_path":"skills/sickn33/defi-protocol-templates","audit_payload_hash":"3ac3d8c15576f96cdf2c55cfce9210ee","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"86aba0c690bd59ac2c112540874d0a3456f54d7cbb9acdb2369ae219283ec5d7","treeHash":"dc03c77116ea19ea66cd72f74394fbb5edea2f6972e0bf4bd072e77789d14ae5","pluginPath":"skills/sickn33/defi-protocol-templates","auditPayloadHash":"3ac3d8c15576f96cdf2c55cfce9210ee"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-defi-protocol-templates/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":5,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}