cairo-vulnerability-scanner
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
Security Assessment
About cairo-vulnerability-scanner
The cairo-vulnerability-scanner is a specialized AI skill designed to analyze Cairo smart contracts on the StarkNet blockchain for security vulnerabilities. Its primary function is to detect six critical vulnerability patterns that are specific to the Cairo/StarkNet ecosystem, including arithmetic overflows with felt252 types, L1-L2 messaging issues, improper contract address usage, and gaps in signature verification. By scanning the codebase systematically, it helps developers identify and mitigate security risks that could compromise contract integrity or blockchain interactions.
The skill’s capabilities include automatically locating Cairo files within a project, analyzing contracts for known vulnerability patterns, and producing detailed reports with file references, severity levels, and recommended fixes. It supports cross-layer checks for L1-L2 messaging vulnerabilities and verifies contract-specific patterns such as storage handling, access control, and arithmetic safety. Additionally, it is compatible with popular Cairo development tools like Caracal for static analysis, cairo-test for built-in testing, and Starknet Foundry for development workflows.
This skill is particularly useful for security auditors, blockchain developers, and teams preparing for StarkNet smart contract deployment. Common use cases include auditing new or existing contracts, reviewing bridge implementations for cross-layer interactions, pre-launch security assessments, and validating access control or caller verification mechanisms. By targeting critical vulnerabilities unique to Cairo/StarkNet, it enables teams to ensure contract reliability and mitigate potential exploits before deployment.
FAQ
Which types of vulnerabilities does this skill detect?
It detects six critical vulnerability patterns in Cairo contracts, including unchecked arithmetic with felt252, storage collisions, missing access controls, improper felt252 boundaries, unvalidated contract addresses, and missing caller validations.
Can I use this skill with any Cairo project?
Yes, it is designed for Cairo projects on StarkNet. It identifies .cairo files and analyzes common contract patterns. Compatibility is best with projects following standard Cairo project structures, such as having src/ directories and Scarb.toml configuration files.
Does it provide fixes for detected vulnerabilities?
Yes, for each identified issue, the scanner reports recommended fixes along with file references and severity, helping developers remediate vulnerabilities efficiently.
Is it compatible with Cairo testing tools?
Yes, it complements existing tools like Caracal for static analysis, cairo-test for contract testing, and Starknet Foundry for development, making integration into testing workflows straightforward.
Are there limitations to what it can detect?
The scanner focuses on six critical vulnerabilities unique to Cairo/StarkNet. It may not cover general code quality issues or vulnerabilities outside these specific patterns.
Install cairo-vulnerability-scanner
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
trailofbits/skills