building-secure-contracts

What this skill does

Guides security engineers and auditors through smart contract security reviews on non-EVM chains: Solana (Anchor/native), Algorand (AVM/PyTeal), Cairo (Starknet), Cosmos (CosmWasm), Substrate (ink!/FRAME pallets), and TON (FunC/Tact). Covers platform-specific vulnerability patterns, chain-appropriate static analysis tooling, a common vulnerability checklist per platform, and a pre-audit code maturity assessment to determine whether a codebase is ready for a formal audit.

When to use

• When auditing or reviewing smart contracts on any non-EVM chain (Solana, Algorand, Cairo, Cosmos, Substrate, TON)
• When assessing whether a multi-chain protocol is audit-ready before scheduling a formal engagement
• When triaging a bug bounty submission from a non-EVM chain
• When onboarding to a new chain and needing a structured security checklist
• When mapping vulnerability classes across chains for a cross-chain bridge or interoperability protocol

Prerequisites

Chain-specific tooling — install only what matches your target platform:

Solana

# Anchor framework (includes anchor-cli with built-in lint)
cargo install --git https://github.com/coral-xyz/anchor anchor-cli --locked
# Soteria static analyzer (optional, proprietary)
# https://www.soteria.dev/

Cairo / Starknet

# cairo-lint (Scarb plugin)
scarb add --dev cairo_lint
# Or standalone
cargo install cairo-lint

Cosmos / CosmWasm

# cargo-audit for dependency CVEs
cargo install cargo-audit
# cosmwasm-check for schema and interface validation
cargo install cosmwasm-check

Substrate / ink!

cargo install cargo-contract
cargo install cargo-audit

Algorand

pip install pyteal tealer   # Tealer: AVM static analysis

TON

npm install -g @tact-lang/compiler  # Tact compiler with type checks
# toncli or blueprint for project scaffolding

All platforms

# Generic dependency audit
cargo audit        # Rust chains
pip-audit          # Python chains
npm audit          # JS/TS tooling