Skip to content
LiveNew tools this week
Submit
AIMarketly
defi-security logo

DeFi Security Principles

defi-security

[AUTO-INVOKE] MUST be invoked BEFORE deploying DeFi contracts (DEX, lending, staking, LP, token). Covers anti-whale, anti-MEV, flash loan protection, launch checklists, and emergency response. Trigger: any deployment or security review of DeFi-related contracts.

NeverSight/skills_feed0installs214starsDevOps & CI/CD

SKILL.md

Full skill instructions

DeFi Security Principles

Language Rule

  • Always respond in the same language the user is using. If the user asks in Chinese, respond in Chinese. If in English, respond in English.

Scope: Only applicable to DeFi projects (DEX, lending, staking, LP, yield). Non-DeFi projects can ignore this skill.

Protection Decision Rules

ThreatRequired Protection
Whale manipulationDaily transaction caps + per-tx amount limits + cooldown window
MEV / sandwich attackEOA-only checks (msg.sender == tx.origin), or use commit-reveal pattern
ArbitrageReferral binding + liquidity distribution + fixed yield model + lock period
ReentrancyReentrancyGuard on all external-call functions (see solidity-security skill)
Flash loan attackCheck block.number change between operations, or use TWAP pricing
Price manipulationChainlink oracle or TWAP — never rely on spot AMM reserves for pricing
Approval exploitUse safeIncreaseAllowance / safeDecreaseAllowance, never raw approve for user flows
Governance attackVoting requires snapshot + minimum token holding period; timelock ≥ 48h on proposal execution
ERC4626 inflation attackFirst deposit must enforce minimum amount or use virtual shares to prevent share dilution via rounding

Anti-Whale Implementation Rules

  • Maximum single transaction amount: configurable via onlyOwner setter
  • Daily cumulative limit per address: track with mapping(address => mapping(uint256 => uint256)) (address → day → amount)
  • Cooldown between transactions: enforce minimum time gap with block.timestamp check
  • Whitelist for exempt addresses (deployer, LP pair, staking contract)

Flash Loan Protection Rules

  • For price-sensitive operations: require that block.number has changed since last interaction
  • For oracle-dependent calculations: use time-weighted average (TWAP) over minimum 30 minutes
  • For critical state changes: add minimum holding period before action (e.g., must hold tokens for N blocks)

Launch Checklist

Before mainnet deployment, verify all items:

  • All onlyOwner functions transferred to multisig (e.g., Gnosis Safe)
  • Timelock contract deployed and configured (minimum 24h delay for critical changes)
  • Pausable emergency switch tested — both pause() and unpause() work correctly
  • Daily limit parameters documented and set to reasonable values
  • Third-party security audit completed and all critical/​high findings resolved
  • Testnet deployment running for minimum 7 days with no issues
  • Slippage, fee, and lock period parameters reviewed and documented
  • Initial liquidity plan documented (amount, lock duration, LP token handling)
  • forge test --fuzz-runs 10000 passes on all DeFi-critical functions

Emergency Response Procedure

StepAction
1. DetectMonitor alerts trigger (on-chain monitoring, community reports)
2. PauseDesignated address calls pause() — must respond within minutes
3. AssessTechnical lead analyzes root cause, estimates fund impact
4. CommunicatePost incident notice to community channels (Discord, Twitter, Telegram)
5. FixDeploy fix or prepare recovery plan
6. ResumeCall unpause() after fix verified on fork — or migrate to new contract
7. Post-mortemPublish detailed incident report within 48 hours

DeFi Testing Commands

# Fuzz test fund flows with high iterations
forge test --match-contract StakingTest --fuzz-runs 10000

# Fork mainnet to test against real state
forge test --fork-url $MAINNET_RPC -vvvv

# Simulate whale transaction on fork
cast send <CONTRACT> "stake(uint256)" 1000000000000000000000000 \
  --rpc-url $FORK_RPC --private-key $TEST_KEY