Trail of Bits

Review Substrate and Polkadot runtime modules, called pallets, for seven security patterns, including unsafe arithmetic, crashes, incorrect processing costs, and weak permission checks. Produce a complete coverage table, findings with code references, and proposed fixes.

• Auditing custom Substrate pallets
• Reviewing processing costs and fees
• Checking permissions for privileged operations

Build a documented understanding of unfamiliar code before a security audit. It records function assumptions, guarantees, dependencies, and open questions, producing a dossier and individual function notes to support later vulnerability analysis.

• Understanding unfamiliar code before an audit
• Mapping dependencies for threat modeling
• Preparing background notes for an architecture review

Review smart contract security through five steps covering Slither scans, special features, diagrams, documented safety conditions, and manual checks. Get project-specific findings, testing setup guidance, and a prioritized action plan for development or deployment reviews.

• Review smart contract security before deployment
• Triage Slither findings and false positives
• Visualize inheritance and access permissions

Prepares a project for open-source release by checking sensitive history, licensing, documentation, tests, and automated publishing. Helps identify gaps so people outside the project can build, use, and contribute to it.

• Preparing a private repository for public release
• Choosing and documenting a project license
• Improving README and contribution instructions

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Guides agents to access GitHub repositories, pull requests, issues, and APIs through the authenticated gh command-line tool. Covers private repository access and recommends cloning repositories to read files locally, with commands for viewing GitHub information.

• Viewing GitHub pull requests and issues
• Accessing private repositories with authentication
• Querying the GitHub API through gh

Organize open GitHub issues and pull requests using the gh CLI, GitHub's command-line tool. Identifies resolved issues and pending fixes, estimates priorities and change sizes locally, and proposes closures, links, reviews, or merges for approval.

• Clean up resolved issues left open
• Link issues to pull requests with pending fixes
• Estimate priorities and change sizes for outstanding work

Write or modernize C++ with guidance on C++20, C++23, and C++26 features. Review memory ownership, error handling, and template constraints, with recommendations for compiler protections and runtime checks that detect bugs.

• Modernize legacy C++ patterns
• Choose approaches for new C++ code
• Review memory ownership and error handling

Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.

• Preparing a codebase for an external security audit
• Organizing fixes and missing tests before review
• Defining the review scope and a stable code version

Inspect DWARF, the debug information stored with compiled code, to find functions and types, check structural integrity, and clarify specification details. Also helps write parsing tools using libraries such as pyelftools, libdwarf, or gimli.

• Finding functions and types in debug information
• Checking DWARF structural integrity
• Comparing debug-information quality metrics

Verify a reported security bug by tracing inputs, checking attacker capabilities, and examining existing protections. Produces a documented TRUE POSITIVE or FALSE POSITIVE verdict for each finding, with deeper verification for complex cases.

• Checking whether a reported vulnerability is real
• Verifying the conditions needed to exploit a finding
• Reviewing suspected false positives

Compare implementation code with a specification, whitepaper, or design document. It checks individual requirements, independently challenges reported mismatches, and writes evidence-based reports covering missing or partial implementation, contradictions, undocumented behavior, and requirements that cannot be judged.

• Check an implementation against a specification
• Compare protocol code with a whitepaper
• Verify guarantees stated in a README

Build and test code with AddressSanitizer, a tool that detects invalid memory access during execution. Configure checks for C/C++ and unsafe Rust, investigate crash reports, and adjust settings for fuzzing, or testing with generated inputs.

• Detect memory errors while fuzzing C/C++
• Test unsafe Rust and calls to external libraries
• Interpret an ASan crash report

Review Cairo smart contracts on StarkNet for six vulnerability patterns involving arithmetic, cross-layer messages, addresses, and signature reuse. Receive a coverage table with evidence for every pattern, plus severity ratings and fixes for identified issues.

• Review StarkNet contracts before launch
• Audit L1-L2 bridge message handling
• Check protection against signature reuse

Validate security patches by comparing vulnerable and patched code against exploit tests, related attack variants, and normal behavior. Produce reproducible logs showing remaining flaws, regressions, newly introduced security failures, and gaps that still need testing.

• Validate an AI-generated security patch before review
• Check related attack variants for incomplete fixes
• Check whether a fix breaks normal behavior

Reviews Rust applications and libraries for security issues involving unsafe code, memory safety, concurrency, calls across language boundaries, panics, and async runtimes. Coordinates specialized reviewers and produces Markdown and SARIF reports, a format for analysis tools.

• Auditing unsafe Rust code
• Reviewing calls across language boundaries
• Checking concurrency and async runtime hazards

Review TON smart contracts written in FunC for three security patterns: incorrect boolean values, unverified Jetton token notifications, and forwarding funds without reserving execution fees. Receive a coverage table, source references, severity ratings, and suggested fixes.

• Review FunC boolean logic
• Check sender validation in Jetton transfer notifications
• Inspect forwarded TON amounts and execution fee reserves

Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.

• Finding CORS or other response headers in captured traffic
• Filtering security findings by severity and confidence
• Extracting URLs from proxy history

Maps externally callable smart contract functions that change stored data, then groups them by access restrictions. Produces a structured audit report showing public functions, privileged operations, and access checks that need further review.

• Mapping entry points before a smart contract audit
• Listing administrator and role-restricted operations
• Reviewing caller restrictions on callbacks

Scan Android APK files for Firebase configuration and access-control weaknesses in databases, storage, authentication, and cloud functions. Produce text and JSON reports with evidence, severity ratings, and suggested fixes for authorized security assessments.

• Auditing Firebase security in Android apps
• Checking unauthenticated database access
• Testing storage listing and write permissions

Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.

• Creating detection rules for recurring bug patterns
• Tracking untrusted input reaching dangerous operations
• Enforcing coding standards with custom rules

Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.

• Security checks before an Algorand contract audit
• Reviewing TEAL or PyTeal transaction validation
• Verifying fixes for reported vulnerabilities

Runs repeated reviews and fixes on a Claude Code skill until no critical or major findings remain. Tracks findings across rounds, checks change boundaries, and stops for a design decision when fixes stop making progress.

• Refining a skill until critical and major findings are resolved
• Improving skill metadata, trigger descriptions, and references
• Tracking recurring findings across review rounds

Audits arithmetic code for mixed units, decimal precision mistakes, and scaling errors. Adds comments identifying each value’s units and produces a summary of findings, unit definitions, and files reviewed.

• Reviewing token amounts and price conversions in DeFi code
• Checking WAD/RAY scaling errors
• Documenting units and precision in existing formulas