[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-token-integration-analyzer":3,"mdc-en58py-key":38,"related-org-trail-of-bits-token-integration-analyzer":1072,"related-repo-trail-of-bits-token-integration-analyzer":1224},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":33,"sourceUrl":36,"mdContent":37},"token-integration-analyzer","analyze token integration and implementation patterns","Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20\u002FERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Context-aware for both token implementations and token integrations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},"Smart Contracts","smart-contracts",{"name":24,"slug":25,"type":16},"Code Analysis","code-analysis",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-18T05:47:46.71802",null,541,[32],"agent-skills",{"repoUrl":27,"stars":26,"forks":30,"topics":34,"description":35},[32],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fbuilding-secure-contracts\u002Fskills\u002Ftoken-integration-analyzer","---\nname: token-integration-analyzer\ndescription: Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20\u002FERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Context-aware for both token implementations and token integrations.\n---\n\n# Token Integration Analyzer\n\n## Purpose\n\nSystematically analyzes the codebase for token-related security concerns using Trail of Bits' token integration checklist:\n\n1. **Token Implementations**: Analyze if your token follows ERC20\u002FERC721 standards or has non-standard behavior\n2. **Token Integrations**: Analyze how your protocol handles arbitrary tokens, including weird\u002Fnon-standard tokens\n3. **On-chain Analysis**: Query deployed contracts for scarcity, distribution, and configuration\n4. **Security Assessment**: Identify risks from 20+ known weird token patterns\n\n**Framework**: Building Secure Contracts - Token Integration Checklist + Weird ERC20 Database\n\n---\n\n## How This Works\n\n### Phase 1: Context Discovery\nDetermines analysis context:\n- **Token implementation**: Are you building a token contract?\n- **Token integration**: Does your protocol interact with external tokens?\n- **Platform**: Ethereum, other EVM chains, or different platform?\n- **Token types**: ERC20, ERC721, or both?\n\n### Phase 2: Slither Analysis (if Solidity)\nFor Solidity projects, I'll help run:\n- `slither-check-erc` - ERC conformity checks\n- `slither --print human-summary` - Complexity and upgrade analysis\n- `slither --print contract-summary` - Function analysis\n- `slither-prop` - Property generation for testing\n\n### Phase 3: Code Analysis\nAnalyzes:\n- Contract composition and complexity\n- Owner privileges and centralization risks\n- ERC20\u002FERC721 conformity\n- Known weird token patterns\n- Integration safety patterns\n\n### Phase 4: On-chain Analysis (if deployed)\nIf you provide a contract address, I'll query:\n- Token scarcity and distribution\n- Total supply and holder concentration\n- Exchange listings\n- On-chain configuration\n\n### Phase 5: Risk Assessment\nProvides:\n- Identified vulnerabilities\n- Non-standard behaviors\n- Integration risks\n- Prioritized recommendations\n\n---\n\n## Assessment Categories\n\nI check 10 comprehensive categories covering all aspects of token security. For detailed criteria, patterns, and checklists, see [ASSESSMENT_CATEGORIES.md](resources\u002FASSESSMENT_CATEGORIES.md).\n\n### Quick Reference:\n\n1. **General Considerations** - Security reviews, team transparency, security contacts\n2. **Contract Composition** - Complexity analysis, SafeMath usage, function count, entry points\n3. **Owner Privileges** - Upgradeability, minting, pausability, blacklisting, team accountability\n4. **ERC20 Conformity** - Return values, metadata, decimals, race conditions, Slither checks\n5. **ERC20 Extension Risks** - External calls\u002Fhooks, transfer fees, rebasing\u002Fyield-bearing tokens\n6. **Token Scarcity Analysis** - Supply distribution, holder concentration, exchange distribution, flash loan\u002Fmint risks\n7. **Weird ERC20 Patterns** (24 patterns including):\n   - Reentrant calls (ERC777 hooks)\n   - Missing return values (USDT, BNB, OMG)\n   - Fee on transfer (STA, PAXG)\n   - Balance modifications outside transfers (Ampleforth, Compound)\n   - Upgradable tokens (USDC, USDT)\n   - Flash mintable (DAI)\n   - Blocklists (USDC, USDT)\n   - Pausable tokens (BNB, ZIL)\n   - Approval race protections (USDT, KNC)\n   - Revert on approval\u002Ftransfer to zero address\n   - Revert on zero value approvals\u002Ftransfers\n   - Multiple token addresses\n   - Low decimals (USDC: 6, Gemini: 2)\n   - High decimals (YAM-V2: 24)\n   - transferFrom with src == msg.sender\n   - Non-string metadata (MKR)\n   - No revert on failure (ZRX, EURS)\n   - Revert on large approvals (UNI, COMP)\n   - Code injection via token name\n   - Unusual permit function (DAI, RAI, GLM)\n   - Transfer less than amount (cUSDCv3)\n   - ERC-20 native currency representation (Celo, Polygon, zkSync)\n   - [And more...](resources\u002FASSESSMENT_CATEGORIES.md#7-weird-erc20-patterns)\n8. **Token Integration Safety** - Safe transfer patterns, balance verification, allowlists, wrappers, defensive patterns\n9. **ERC721 Conformity** - Transfer to 0x0, safeTransferFrom, metadata, ownerOf, approval clearing, token ID immutability\n10. **ERC721 Common Risks** - onERC721Received reentrancy, safe minting, burning approval clearing\n\n---\n\n## Example Output\n\nWhen analysis is complete, you'll receive a comprehensive report structured as follows:\n\n```\n=== TOKEN INTEGRATION ANALYSIS REPORT ===\n\nProject: MultiToken DEX\nToken Analyzed: Custom Reward Token + Integration Safety\nPlatform: Solidity 0.8.20\nAnalysis Date: March 15, 2024\n\n---\n\n## EXECUTIVE SUMMARY\n\nToken Type: ERC20 Implementation + Protocol Integrating External Tokens\nOverall Risk Level: MEDIUM\nCritical Issues: 2\nHigh Issues: 3\nMedium Issues: 4\n\n**Top Concerns:**\n⚠ Fee-on-transfer tokens not handled correctly\n⚠ No validation for missing return values (USDT compatibility)\n⚠ Owner can mint unlimited tokens without cap\n\n**Recommendation:** Address critical\u002Fhigh issues before mainnet launch.\n\n---\n\n## 1. GENERAL CONSIDERATIONS\n\n✓ Contract audited by CertiK (June 2023)\n✓ Team contactable via security@project.com\n✗ No security mailing list for critical announcements\n\n**Risk:** Users won't be notified of critical issues\n**Action:** Set up security@project.com mailing list\n\n---\n\n## 2. CONTRACT COMPOSITION\n\n### Complexity Analysis\n\n**Slither human-summary Results:**\n- 456 lines of code\n- Cyclomatic complexity: Average 6, Max 14 (transferWithFee())\n- 12 functions, 8 state variables\n- Inheritance depth: 3 (moderate)\n\n✓ Contract complexity is reasonable\n⚠ transferWithFee() complexity high (14) - consider splitting\n\n### SafeMath Usage\n\n✓ Using Solidity 0.8.20 (built-in overflow protection)\n✓ No unchecked blocks found\n✓ All arithmetic operations protected\n\n### Non-Token Functions\n\n**Functions Beyond ERC20:**\n- setFeeCollector() - Admin function ✓\n- setTransferFee() - Admin function ✓\n- withdrawFees() - Admin function ✓\n- pause()\u002Funpause() - Emergency functions ✓\n\n⚠ 4 non-token functions (acceptable but adds complexity)\n\n### Address Entry Points\n\n✓ Single contract address\n✓ No proxy with multiple entry points\n✓ No token migration creating address confusion\n\n**Status:** PASS\n\n---\n\n## 3. OWNER PRIVILEGES\n\n### Upgradeability\n\n⚠ Contract uses TransparentUpgradeableProxy\n**Risk:** Owner can change contract logic at any time\n\n**Current Implementation:**\n- ProxyAdmin: 0x1234... (2\u002F3 multisig) ✓\n- Timelock: None ✗\n\n**Recommendation:** Add 48-hour timelock to all upgrades\n\n### Minting Capabilities\n\n❌ CRITICAL: Unlimited minting\nFile: contracts\u002FRewardToken.sol:89\n```solidity\nfunction mint(address to, uint256 amount) external onlyOwner {\n    _mint(to, amount);  \u002F\u002F No cap!\n}\n```\n\n**Risk:** Owner can inflate supply arbitrarily\n**Fix:** Add maximum supply cap or rate-limited minting\n\n### Pausability\n\n✓ Pausable pattern implemented (OpenZeppelin)\n✓ Only owner can pause\n⚠ Paused state affects all transfers (including existing holders)\n\n**Risk:** Owner can trap all user funds\n**Mitigation:** Use multi-sig for pause function (already implemented ✓)\n\n### Blacklisting\n\n✗ No blacklist functionality\n**Assessment:** Good - no centralized censorship risk\n\n### Team Transparency\n\n✓ Team members public (team.md)\n✓ Company registered in Switzerland\n✓ Accountable and contactable\n\n**Status:** ACCEPTABLE\n\n---\n\n## 4. ERC20 CONFORMITY\n\n### Slither-check-erc Results\n\nCommand: slither-check-erc . RewardToken --erc erc20\n\n✓ transfer returns bool\n✓ transferFrom returns bool\n✓ name, decimals, symbol present\n✓ decimals returns uint8 (value: 18)\n✓ Race condition mitigated (increaseAllowance\u002FdecreaseAllowance)\n\n**Status:** FULLY COMPLIANT\n\n### slither-prop Test Results\n\nCommand: slither-prop . --contract RewardToken\n\n**Generated 12 properties, all passed:**\n✓ Transfer doesn't change total supply\n✓ Allowance correctly updates\n✓ Balance updates match transfer amounts\n✓ No balance manipulation possible\n[... 8 more properties ...]\n\n**Echidna fuzzing:** 50,000 runs, no violations ✓\n\n**Status:** EXCELLENT\n\n---\n\n## 5. WEIRD TOKEN PATTERN ANALYSIS\n\n### Integration Safety Check\n\n**Your Protocol Integrates 5 External Tokens:**\n1. USDT (0xdac17f9...)\n2. USDC (0xa0b86991...)\n3. DAI (0x6b175474...)\n4. WETH (0xc02aaa39...)\n5. UNI (0x1f9840a8...)\n\n### Critical Issues Found\n\n❌ **Pattern 7.2: Missing Return Values**\n**Found in:** USDT integration\nFile: contracts\u002FVault.sol:156\n```solidity\nIERC20(usdt).transferFrom(msg.sender, address(this), amount);\n\u002F\u002F No return value check! USDT doesn't return bool\n```\n\n**Risk:** Silent failures on USDT transfers\n**Exploit:** User appears to deposit, but no tokens moved\n**Fix:** Use OpenZeppelin SafeERC20 wrapper\n\n---\n\n❌ **Pattern 7.3: Fee on Transfer**\n**Risk for:** Any token with transfer fees\nFile: contracts\u002FVault.sol:170\n```solidity\nuint256 balanceBefore = IERC20(token).balanceOf(address(this));\ntoken.transferFrom(msg.sender, address(this), amount);\nshares = amount * exchangeRate;  \u002F\u002F WRONG! Should use actual received amount\n```\n\n**Risk:** Accounting mismatch if token takes fees\n**Exploit:** User credited more shares than tokens deposited\n**Fix:** Calculate shares from `balanceAfter - balanceBefore`\n\n---\n\n### Known Non-Standard Token Handling\n\n✓ **USDC:** Properly handled (SafeERC20, 6 decimals accounted for)\n⚠ **DAI:** permit() function not used (opportunity for gas savings)\n✗ **USDT:** Missing return value not handled (CRITICAL)\n✓ **WETH:** Standard wrapper, properly handled\n⚠ **UNI:** Large approval handling not checked (reverts >= 2^96)\n\n---\n\n[... Additional sections for remaining analysis categories ...]\n```\n\nFor complete report template and deliverables format, see [REPORT_TEMPLATES.md](resources\u002FREPORT_TEMPLATES.md).\n\n---\n\n## Rationalizations (Do Not Skip)\n\n| Rationalization | Why It's Wrong | Required Action |\n|-----------------|----------------|-----------------|\n| \"Token looks standard, ERC20 checks pass\" | 20+ weird token patterns exist beyond ERC20 compliance | Check ALL weird token patterns from database (missing return, revert on zero, hooks, etc.) |\n| \"Slither shows no issues, integration is safe\" | Slither detects some patterns, misses integration logic | Complete manual analysis of all 5 token integration criteria |\n| \"No fee-on-transfer detected, skip that check\" | Fee-on-transfer can be owner-controlled or conditional | Test all transfer scenarios, check for conditional fee logic |\n| \"Balance checks exist, handling is safe\" | Balance checks alone don't protect against all weird tokens | Verify safe transfer wrappers, revert handling, approval patterns |\n| \"Token is deployed by reputable team, assume standard\" | Reputation doesn't guarantee standard behavior | Analyze actual code and on-chain behavior, don't trust assumptions |\n| \"Integration uses OpenZeppelin, must be safe\" | OpenZeppelin libraries don't protect against weird external tokens | Verify defensive patterns around all external token calls |\n| \"Can't run Slither, skipping automated analysis\" | Slither provides critical ERC conformance checks | Manually verify all slither-check-erc criteria or document why blocked |\n| \"This pattern seems fine\" | Intuition misses subtle token integration bugs | Systematically check all 20+ weird token patterns with code evidence |\n\n---\n\n## Deliverables\n\nWhen analysis is complete, I'll provide:\n\n1. **Compliance Checklist** - Checkboxes for all assessment categories\n2. **Weird Token Pattern Analysis** - Presence\u002Fabsence of all 24 patterns with risk levels and evidence\n3. **On-chain Analysis Report** (if applicable) - Holder distribution, exchange listings, configuration\n4. **Integration Safety Assessment** (if applicable) - Safe transfer usage, defensive patterns, weird token handling\n5. **Prioritized Recommendations** - CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW issues with specific fixes\n\nComplete deliverable templates available in [REPORT_TEMPLATES.md](resources\u002FREPORT_TEMPLATES.md).\n\n---\n\n## Ready to Begin\n\n**What I'll need**:\n- Your codebase\n- Context: Token implementation or integration?\n- Token type: ERC20, ERC721, or both?\n- Contract address (if deployed and want on-chain analysis)\n- RPC endpoint (if querying on-chain)\n\nLet's analyze your token implementation or integration for security risks!\n",{"data":39,"body":40},{"name":4,"description":6},{"type":41,"children":42},"root",[43,51,58,64,110,120,124,130,137,142,186,192,197,245,251,256,284,290,295,318,324,329,352,355,361,375,381,606,609,615,620,632,649,655,660,676,682,694,700,705,715,718,724,730,735,740,749,755,760,776,786,795,798,804,810,818,846,852,869,897,919,922,938,970,997,1000,1006,1046,1049,1057,1066],{"type":44,"tag":45,"props":46,"children":47},"element","h1",{"id":4},[48],{"type":49,"value":50},"text","Token Integration Analyzer",{"type":44,"tag":52,"props":53,"children":55},"h2",{"id":54},"purpose",[56],{"type":49,"value":57},"Purpose",{"type":44,"tag":59,"props":60,"children":61},"p",{},[62],{"type":49,"value":63},"Systematically analyzes the codebase for token-related security concerns using Trail of Bits' token integration checklist:",{"type":44,"tag":65,"props":66,"children":67},"ol",{},[68,80,90,100],{"type":44,"tag":69,"props":70,"children":71},"li",{},[72,78],{"type":44,"tag":73,"props":74,"children":75},"strong",{},[76],{"type":49,"value":77},"Token Implementations",{"type":49,"value":79},": Analyze if your token follows ERC20\u002FERC721 standards or has non-standard behavior",{"type":44,"tag":69,"props":81,"children":82},{},[83,88],{"type":44,"tag":73,"props":84,"children":85},{},[86],{"type":49,"value":87},"Token Integrations",{"type":49,"value":89},": Analyze how your protocol handles arbitrary tokens, including weird\u002Fnon-standard tokens",{"type":44,"tag":69,"props":91,"children":92},{},[93,98],{"type":44,"tag":73,"props":94,"children":95},{},[96],{"type":49,"value":97},"On-chain Analysis",{"type":49,"value":99},": Query deployed contracts for scarcity, distribution, and configuration",{"type":44,"tag":69,"props":101,"children":102},{},[103,108],{"type":44,"tag":73,"props":104,"children":105},{},[106],{"type":49,"value":107},"Security Assessment",{"type":49,"value":109},": Identify risks from 20+ known weird token patterns",{"type":44,"tag":59,"props":111,"children":112},{},[113,118],{"type":44,"tag":73,"props":114,"children":115},{},[116],{"type":49,"value":117},"Framework",{"type":49,"value":119},": Building Secure Contracts - Token Integration Checklist + Weird ERC20 Database",{"type":44,"tag":121,"props":122,"children":123},"hr",{},[],{"type":44,"tag":52,"props":125,"children":127},{"id":126},"how-this-works",[128],{"type":49,"value":129},"How This Works",{"type":44,"tag":131,"props":132,"children":134},"h3",{"id":133},"phase-1-context-discovery",[135],{"type":49,"value":136},"Phase 1: Context Discovery",{"type":44,"tag":59,"props":138,"children":139},{},[140],{"type":49,"value":141},"Determines analysis context:",{"type":44,"tag":143,"props":144,"children":145},"ul",{},[146,156,166,176],{"type":44,"tag":69,"props":147,"children":148},{},[149,154],{"type":44,"tag":73,"props":150,"children":151},{},[152],{"type":49,"value":153},"Token implementation",{"type":49,"value":155},": Are you building a token contract?",{"type":44,"tag":69,"props":157,"children":158},{},[159,164],{"type":44,"tag":73,"props":160,"children":161},{},[162],{"type":49,"value":163},"Token integration",{"type":49,"value":165},": Does your protocol interact with external tokens?",{"type":44,"tag":69,"props":167,"children":168},{},[169,174],{"type":44,"tag":73,"props":170,"children":171},{},[172],{"type":49,"value":173},"Platform",{"type":49,"value":175},": Ethereum, other EVM chains, or different platform?",{"type":44,"tag":69,"props":177,"children":178},{},[179,184],{"type":44,"tag":73,"props":180,"children":181},{},[182],{"type":49,"value":183},"Token types",{"type":49,"value":185},": ERC20, ERC721, or both?",{"type":44,"tag":131,"props":187,"children":189},{"id":188},"phase-2-slither-analysis-if-solidity",[190],{"type":49,"value":191},"Phase 2: Slither Analysis (if Solidity)",{"type":44,"tag":59,"props":193,"children":194},{},[195],{"type":49,"value":196},"For Solidity projects, I'll help run:",{"type":44,"tag":143,"props":198,"children":199},{},[200,212,223,234],{"type":44,"tag":69,"props":201,"children":202},{},[203,210],{"type":44,"tag":204,"props":205,"children":207},"code",{"className":206},[],[208],{"type":49,"value":209},"slither-check-erc",{"type":49,"value":211}," - ERC conformity checks",{"type":44,"tag":69,"props":213,"children":214},{},[215,221],{"type":44,"tag":204,"props":216,"children":218},{"className":217},[],[219],{"type":49,"value":220},"slither --print human-summary",{"type":49,"value":222}," - Complexity and upgrade analysis",{"type":44,"tag":69,"props":224,"children":225},{},[226,232],{"type":44,"tag":204,"props":227,"children":229},{"className":228},[],[230],{"type":49,"value":231},"slither --print contract-summary",{"type":49,"value":233}," - Function analysis",{"type":44,"tag":69,"props":235,"children":236},{},[237,243],{"type":44,"tag":204,"props":238,"children":240},{"className":239},[],[241],{"type":49,"value":242},"slither-prop",{"type":49,"value":244}," - Property generation for testing",{"type":44,"tag":131,"props":246,"children":248},{"id":247},"phase-3-code-analysis",[249],{"type":49,"value":250},"Phase 3: Code Analysis",{"type":44,"tag":59,"props":252,"children":253},{},[254],{"type":49,"value":255},"Analyzes:",{"type":44,"tag":143,"props":257,"children":258},{},[259,264,269,274,279],{"type":44,"tag":69,"props":260,"children":261},{},[262],{"type":49,"value":263},"Contract composition and complexity",{"type":44,"tag":69,"props":265,"children":266},{},[267],{"type":49,"value":268},"Owner privileges and centralization risks",{"type":44,"tag":69,"props":270,"children":271},{},[272],{"type":49,"value":273},"ERC20\u002FERC721 conformity",{"type":44,"tag":69,"props":275,"children":276},{},[277],{"type":49,"value":278},"Known weird token patterns",{"type":44,"tag":69,"props":280,"children":281},{},[282],{"type":49,"value":283},"Integration safety patterns",{"type":44,"tag":131,"props":285,"children":287},{"id":286},"phase-4-on-chain-analysis-if-deployed",[288],{"type":49,"value":289},"Phase 4: On-chain Analysis (if deployed)",{"type":44,"tag":59,"props":291,"children":292},{},[293],{"type":49,"value":294},"If you provide a contract address, I'll query:",{"type":44,"tag":143,"props":296,"children":297},{},[298,303,308,313],{"type":44,"tag":69,"props":299,"children":300},{},[301],{"type":49,"value":302},"Token scarcity and distribution",{"type":44,"tag":69,"props":304,"children":305},{},[306],{"type":49,"value":307},"Total supply and holder concentration",{"type":44,"tag":69,"props":309,"children":310},{},[311],{"type":49,"value":312},"Exchange listings",{"type":44,"tag":69,"props":314,"children":315},{},[316],{"type":49,"value":317},"On-chain configuration",{"type":44,"tag":131,"props":319,"children":321},{"id":320},"phase-5-risk-assessment",[322],{"type":49,"value":323},"Phase 5: Risk Assessment",{"type":44,"tag":59,"props":325,"children":326},{},[327],{"type":49,"value":328},"Provides:",{"type":44,"tag":143,"props":330,"children":331},{},[332,337,342,347],{"type":44,"tag":69,"props":333,"children":334},{},[335],{"type":49,"value":336},"Identified vulnerabilities",{"type":44,"tag":69,"props":338,"children":339},{},[340],{"type":49,"value":341},"Non-standard behaviors",{"type":44,"tag":69,"props":343,"children":344},{},[345],{"type":49,"value":346},"Integration risks",{"type":44,"tag":69,"props":348,"children":349},{},[350],{"type":49,"value":351},"Prioritized recommendations",{"type":44,"tag":121,"props":353,"children":354},{},[],{"type":44,"tag":52,"props":356,"children":358},{"id":357},"assessment-categories",[359],{"type":49,"value":360},"Assessment Categories",{"type":44,"tag":59,"props":362,"children":363},{},[364,366,373],{"type":49,"value":365},"I check 10 comprehensive categories covering all aspects of token security. For detailed criteria, patterns, and checklists, see ",{"type":44,"tag":367,"props":368,"children":370},"a",{"href":369},"resources\u002FASSESSMENT_CATEGORIES.md",[371],{"type":49,"value":372},"ASSESSMENT_CATEGORIES.md",{"type":49,"value":374},".",{"type":44,"tag":131,"props":376,"children":378},{"id":377},"quick-reference",[379],{"type":49,"value":380},"Quick Reference:",{"type":44,"tag":65,"props":382,"children":383},{},[384,394,404,414,424,434,444,576,586,596],{"type":44,"tag":69,"props":385,"children":386},{},[387,392],{"type":44,"tag":73,"props":388,"children":389},{},[390],{"type":49,"value":391},"General Considerations",{"type":49,"value":393}," - Security reviews, team transparency, security contacts",{"type":44,"tag":69,"props":395,"children":396},{},[397,402],{"type":44,"tag":73,"props":398,"children":399},{},[400],{"type":49,"value":401},"Contract Composition",{"type":49,"value":403}," - Complexity analysis, SafeMath usage, function count, entry points",{"type":44,"tag":69,"props":405,"children":406},{},[407,412],{"type":44,"tag":73,"props":408,"children":409},{},[410],{"type":49,"value":411},"Owner Privileges",{"type":49,"value":413}," - Upgradeability, minting, pausability, blacklisting, team accountability",{"type":44,"tag":69,"props":415,"children":416},{},[417,422],{"type":44,"tag":73,"props":418,"children":419},{},[420],{"type":49,"value":421},"ERC20 Conformity",{"type":49,"value":423}," - Return values, metadata, decimals, race conditions, Slither checks",{"type":44,"tag":69,"props":425,"children":426},{},[427,432],{"type":44,"tag":73,"props":428,"children":429},{},[430],{"type":49,"value":431},"ERC20 Extension Risks",{"type":49,"value":433}," - External calls\u002Fhooks, transfer fees, rebasing\u002Fyield-bearing tokens",{"type":44,"tag":69,"props":435,"children":436},{},[437,442],{"type":44,"tag":73,"props":438,"children":439},{},[440],{"type":49,"value":441},"Token Scarcity Analysis",{"type":49,"value":443}," - Supply distribution, holder concentration, exchange distribution, flash loan\u002Fmint risks",{"type":44,"tag":69,"props":445,"children":446},{},[447,452,454],{"type":44,"tag":73,"props":448,"children":449},{},[450],{"type":49,"value":451},"Weird ERC20 Patterns",{"type":49,"value":453}," (24 patterns including):\n",{"type":44,"tag":143,"props":455,"children":456},{},[457,462,467,472,477,482,487,492,497,502,507,512,517,522,527,532,537,542,547,552,557,562,567],{"type":44,"tag":69,"props":458,"children":459},{},[460],{"type":49,"value":461},"Reentrant calls (ERC777 hooks)",{"type":44,"tag":69,"props":463,"children":464},{},[465],{"type":49,"value":466},"Missing return values (USDT, BNB, OMG)",{"type":44,"tag":69,"props":468,"children":469},{},[470],{"type":49,"value":471},"Fee on transfer (STA, PAXG)",{"type":44,"tag":69,"props":473,"children":474},{},[475],{"type":49,"value":476},"Balance modifications outside transfers (Ampleforth, Compound)",{"type":44,"tag":69,"props":478,"children":479},{},[480],{"type":49,"value":481},"Upgradable tokens (USDC, USDT)",{"type":44,"tag":69,"props":483,"children":484},{},[485],{"type":49,"value":486},"Flash mintable (DAI)",{"type":44,"tag":69,"props":488,"children":489},{},[490],{"type":49,"value":491},"Blocklists (USDC, USDT)",{"type":44,"tag":69,"props":493,"children":494},{},[495],{"type":49,"value":496},"Pausable tokens (BNB, ZIL)",{"type":44,"tag":69,"props":498,"children":499},{},[500],{"type":49,"value":501},"Approval race protections (USDT, KNC)",{"type":44,"tag":69,"props":503,"children":504},{},[505],{"type":49,"value":506},"Revert on approval\u002Ftransfer to zero address",{"type":44,"tag":69,"props":508,"children":509},{},[510],{"type":49,"value":511},"Revert on zero value approvals\u002Ftransfers",{"type":44,"tag":69,"props":513,"children":514},{},[515],{"type":49,"value":516},"Multiple token addresses",{"type":44,"tag":69,"props":518,"children":519},{},[520],{"type":49,"value":521},"Low decimals (USDC: 6, Gemini: 2)",{"type":44,"tag":69,"props":523,"children":524},{},[525],{"type":49,"value":526},"High decimals (YAM-V2: 24)",{"type":44,"tag":69,"props":528,"children":529},{},[530],{"type":49,"value":531},"transferFrom with src == msg.sender",{"type":44,"tag":69,"props":533,"children":534},{},[535],{"type":49,"value":536},"Non-string metadata (MKR)",{"type":44,"tag":69,"props":538,"children":539},{},[540],{"type":49,"value":541},"No revert on failure (ZRX, EURS)",{"type":44,"tag":69,"props":543,"children":544},{},[545],{"type":49,"value":546},"Revert on large approvals (UNI, COMP)",{"type":44,"tag":69,"props":548,"children":549},{},[550],{"type":49,"value":551},"Code injection via token name",{"type":44,"tag":69,"props":553,"children":554},{},[555],{"type":49,"value":556},"Unusual permit function (DAI, RAI, GLM)",{"type":44,"tag":69,"props":558,"children":559},{},[560],{"type":49,"value":561},"Transfer less than amount (cUSDCv3)",{"type":44,"tag":69,"props":563,"children":564},{},[565],{"type":49,"value":566},"ERC-20 native currency representation (Celo, Polygon, zkSync)",{"type":44,"tag":69,"props":568,"children":569},{},[570],{"type":44,"tag":367,"props":571,"children":573},{"href":572},"resources\u002FASSESSMENT_CATEGORIES.md#7-weird-erc20-patterns",[574],{"type":49,"value":575},"And more...",{"type":44,"tag":69,"props":577,"children":578},{},[579,584],{"type":44,"tag":73,"props":580,"children":581},{},[582],{"type":49,"value":583},"Token Integration Safety",{"type":49,"value":585}," - Safe transfer patterns, balance verification, allowlists, wrappers, defensive patterns",{"type":44,"tag":69,"props":587,"children":588},{},[589,594],{"type":44,"tag":73,"props":590,"children":591},{},[592],{"type":49,"value":593},"ERC721 Conformity",{"type":49,"value":595}," - Transfer to 0x0, safeTransferFrom, metadata, ownerOf, approval clearing, token ID immutability",{"type":44,"tag":69,"props":597,"children":598},{},[599,604],{"type":44,"tag":73,"props":600,"children":601},{},[602],{"type":49,"value":603},"ERC721 Common Risks",{"type":49,"value":605}," - onERC721Received reentrancy, safe minting, burning approval clearing",{"type":44,"tag":121,"props":607,"children":608},{},[],{"type":44,"tag":52,"props":610,"children":612},{"id":611},"example-output",[613],{"type":49,"value":614},"Example Output",{"type":44,"tag":59,"props":616,"children":617},{},[618],{"type":49,"value":619},"When analysis is complete, you'll receive a comprehensive report structured as follows:",{"type":44,"tag":621,"props":622,"children":626},"pre",{"className":623,"code":625,"language":49},[624],"language-text","=== TOKEN INTEGRATION ANALYSIS REPORT ===\n\nProject: MultiToken DEX\nToken Analyzed: Custom Reward Token + Integration Safety\nPlatform: Solidity 0.8.20\nAnalysis Date: March 15, 2024\n\n---\n\n## EXECUTIVE SUMMARY\n\nToken Type: ERC20 Implementation + Protocol Integrating External Tokens\nOverall Risk Level: MEDIUM\nCritical Issues: 2\nHigh Issues: 3\nMedium Issues: 4\n\n**Top Concerns:**\n⚠ Fee-on-transfer tokens not handled correctly\n⚠ No validation for missing return values (USDT compatibility)\n⚠ Owner can mint unlimited tokens without cap\n\n**Recommendation:** Address critical\u002Fhigh issues before mainnet launch.\n\n---\n\n## 1. GENERAL CONSIDERATIONS\n\n✓ Contract audited by CertiK (June 2023)\n✓ Team contactable via security@project.com\n✗ No security mailing list for critical announcements\n\n**Risk:** Users won't be notified of critical issues\n**Action:** Set up security@project.com mailing list\n\n---\n\n## 2. CONTRACT COMPOSITION\n\n### Complexity Analysis\n\n**Slither human-summary Results:**\n- 456 lines of code\n- Cyclomatic complexity: Average 6, Max 14 (transferWithFee())\n- 12 functions, 8 state variables\n- Inheritance depth: 3 (moderate)\n\n✓ Contract complexity is reasonable\n⚠ transferWithFee() complexity high (14) - consider splitting\n\n### SafeMath Usage\n\n✓ Using Solidity 0.8.20 (built-in overflow protection)\n✓ No unchecked blocks found\n✓ All arithmetic operations protected\n\n### Non-Token Functions\n\n**Functions Beyond ERC20:**\n- setFeeCollector() - Admin function ✓\n- setTransferFee() - Admin function ✓\n- withdrawFees() - Admin function ✓\n- pause()\u002Funpause() - Emergency functions ✓\n\n⚠ 4 non-token functions (acceptable but adds complexity)\n\n### Address Entry Points\n\n✓ Single contract address\n✓ No proxy with multiple entry points\n✓ No token migration creating address confusion\n\n**Status:** PASS\n\n---\n\n## 3. OWNER PRIVILEGES\n\n### Upgradeability\n\n⚠ Contract uses TransparentUpgradeableProxy\n**Risk:** Owner can change contract logic at any time\n\n**Current Implementation:**\n- ProxyAdmin: 0x1234... (2\u002F3 multisig) ✓\n- Timelock: None ✗\n\n**Recommendation:** Add 48-hour timelock to all upgrades\n\n### Minting Capabilities\n\n❌ CRITICAL: Unlimited minting\nFile: contracts\u002FRewardToken.sol:89\n```solidity\nfunction mint(address to, uint256 amount) external onlyOwner {\n    _mint(to, amount);  \u002F\u002F No cap!\n}\n",[627],{"type":44,"tag":204,"props":628,"children":630},{"__ignoreMap":629},"",[631],{"type":49,"value":625},{"type":44,"tag":59,"props":633,"children":634},{},[635,640,642,647],{"type":44,"tag":73,"props":636,"children":637},{},[638],{"type":49,"value":639},"Risk:",{"type":49,"value":641}," Owner can inflate supply arbitrarily\n",{"type":44,"tag":73,"props":643,"children":644},{},[645],{"type":49,"value":646},"Fix:",{"type":49,"value":648}," Add maximum supply cap or rate-limited minting",{"type":44,"tag":131,"props":650,"children":652},{"id":651},"pausability",[653],{"type":49,"value":654},"Pausability",{"type":44,"tag":59,"props":656,"children":657},{},[658],{"type":49,"value":659},"✓ Pausable pattern implemented (OpenZeppelin)\n✓ Only owner can pause\n⚠ Paused state affects all transfers (including existing holders)",{"type":44,"tag":59,"props":661,"children":662},{},[663,667,669,674],{"type":44,"tag":73,"props":664,"children":665},{},[666],{"type":49,"value":639},{"type":49,"value":668}," Owner can trap all user funds\n",{"type":44,"tag":73,"props":670,"children":671},{},[672],{"type":49,"value":673},"Mitigation:",{"type":49,"value":675}," Use multi-sig for pause function (already implemented ✓)",{"type":44,"tag":131,"props":677,"children":679},{"id":678},"blacklisting",[680],{"type":49,"value":681},"Blacklisting",{"type":44,"tag":59,"props":683,"children":684},{},[685,687,692],{"type":49,"value":686},"✗ No blacklist functionality\n",{"type":44,"tag":73,"props":688,"children":689},{},[690],{"type":49,"value":691},"Assessment:",{"type":49,"value":693}," Good - no centralized censorship risk",{"type":44,"tag":131,"props":695,"children":697},{"id":696},"team-transparency",[698],{"type":49,"value":699},"Team Transparency",{"type":44,"tag":59,"props":701,"children":702},{},[703],{"type":49,"value":704},"✓ Team members public (team.md)\n✓ Company registered in Switzerland\n✓ Accountable and contactable",{"type":44,"tag":59,"props":706,"children":707},{},[708,713],{"type":44,"tag":73,"props":709,"children":710},{},[711],{"type":49,"value":712},"Status:",{"type":49,"value":714}," ACCEPTABLE",{"type":44,"tag":121,"props":716,"children":717},{},[],{"type":44,"tag":52,"props":719,"children":721},{"id":720},"_4-erc20-conformity",[722],{"type":49,"value":723},"4. ERC20 CONFORMITY",{"type":44,"tag":131,"props":725,"children":727},{"id":726},"slither-check-erc-results",[728],{"type":49,"value":729},"Slither-check-erc Results",{"type":44,"tag":59,"props":731,"children":732},{},[733],{"type":49,"value":734},"Command: slither-check-erc . RewardToken --erc erc20",{"type":44,"tag":59,"props":736,"children":737},{},[738],{"type":49,"value":739},"✓ transfer returns bool\n✓ transferFrom returns bool\n✓ name, decimals, symbol present\n✓ decimals returns uint8 (value: 18)\n✓ Race condition mitigated (increaseAllowance\u002FdecreaseAllowance)",{"type":44,"tag":59,"props":741,"children":742},{},[743,747],{"type":44,"tag":73,"props":744,"children":745},{},[746],{"type":49,"value":712},{"type":49,"value":748}," FULLY COMPLIANT",{"type":44,"tag":131,"props":750,"children":752},{"id":751},"slither-prop-test-results",[753],{"type":49,"value":754},"slither-prop Test Results",{"type":44,"tag":59,"props":756,"children":757},{},[758],{"type":49,"value":759},"Command: slither-prop . --contract RewardToken",{"type":44,"tag":59,"props":761,"children":762},{},[763,768,770],{"type":44,"tag":73,"props":764,"children":765},{},[766],{"type":49,"value":767},"Generated 12 properties, all passed:",{"type":49,"value":769},"\n✓ Transfer doesn't change total supply\n✓ Allowance correctly updates\n✓ Balance updates match transfer amounts\n✓ No balance manipulation possible\n",{"type":44,"tag":771,"props":772,"children":773},"span",{},[774],{"type":49,"value":775},"... 8 more properties ...",{"type":44,"tag":59,"props":777,"children":778},{},[779,784],{"type":44,"tag":73,"props":780,"children":781},{},[782],{"type":49,"value":783},"Echidna fuzzing:",{"type":49,"value":785}," 50,000 runs, no violations ✓",{"type":44,"tag":59,"props":787,"children":788},{},[789,793],{"type":44,"tag":73,"props":790,"children":791},{},[792],{"type":49,"value":712},{"type":49,"value":794}," EXCELLENT",{"type":44,"tag":121,"props":796,"children":797},{},[],{"type":44,"tag":52,"props":799,"children":801},{"id":800},"_5-weird-token-pattern-analysis",[802],{"type":49,"value":803},"5. WEIRD TOKEN PATTERN ANALYSIS",{"type":44,"tag":131,"props":805,"children":807},{"id":806},"integration-safety-check",[808],{"type":49,"value":809},"Integration Safety Check",{"type":44,"tag":59,"props":811,"children":812},{},[813],{"type":44,"tag":73,"props":814,"children":815},{},[816],{"type":49,"value":817},"Your Protocol Integrates 5 External Tokens:",{"type":44,"tag":65,"props":819,"children":820},{},[821,826,831,836,841],{"type":44,"tag":69,"props":822,"children":823},{},[824],{"type":49,"value":825},"USDT (0xdac17f9...)",{"type":44,"tag":69,"props":827,"children":828},{},[829],{"type":49,"value":830},"USDC (0xa0b86991...)",{"type":44,"tag":69,"props":832,"children":833},{},[834],{"type":49,"value":835},"DAI (0x6b175474...)",{"type":44,"tag":69,"props":837,"children":838},{},[839],{"type":49,"value":840},"WETH (0xc02aaa39...)",{"type":44,"tag":69,"props":842,"children":843},{},[844],{"type":49,"value":845},"UNI (0x1f9840a8...)",{"type":44,"tag":131,"props":847,"children":849},{"id":848},"critical-issues-found",[850],{"type":49,"value":851},"Critical Issues Found",{"type":44,"tag":59,"props":853,"children":854},{},[855,857,862,867],{"type":49,"value":856},"❌ ",{"type":44,"tag":73,"props":858,"children":859},{},[860],{"type":49,"value":861},"Pattern 7.2: Missing Return Values",{"type":44,"tag":73,"props":863,"children":864},{},[865],{"type":49,"value":866},"Found in:",{"type":49,"value":868}," USDT integration\nFile: contracts\u002FVault.sol:156",{"type":44,"tag":621,"props":870,"children":874},{"className":871,"code":872,"language":873,"meta":629,"style":629},"language-solidity shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","IERC20(usdt).transferFrom(msg.sender, address(this), amount);\n\u002F\u002F No return value check! USDT doesn't return bool\n","solidity",[875],{"type":44,"tag":204,"props":876,"children":877},{"__ignoreMap":629},[878,888],{"type":44,"tag":771,"props":879,"children":882},{"class":880,"line":881},"line",1,[883],{"type":44,"tag":771,"props":884,"children":885},{},[886],{"type":49,"value":887},"IERC20(usdt).transferFrom(msg.sender, address(this), amount);\n",{"type":44,"tag":771,"props":889,"children":891},{"class":880,"line":890},2,[892],{"type":44,"tag":771,"props":893,"children":894},{},[895],{"type":49,"value":896},"\u002F\u002F No return value check! USDT doesn't return bool\n",{"type":44,"tag":59,"props":898,"children":899},{},[900,904,906,911,913,917],{"type":44,"tag":73,"props":901,"children":902},{},[903],{"type":49,"value":639},{"type":49,"value":905}," Silent failures on USDT transfers\n",{"type":44,"tag":73,"props":907,"children":908},{},[909],{"type":49,"value":910},"Exploit:",{"type":49,"value":912}," User appears to deposit, but no tokens moved\n",{"type":44,"tag":73,"props":914,"children":915},{},[916],{"type":49,"value":646},{"type":49,"value":918}," Use OpenZeppelin SafeERC20 wrapper",{"type":44,"tag":121,"props":920,"children":921},{},[],{"type":44,"tag":59,"props":923,"children":924},{},[925,926,931,936],{"type":49,"value":856},{"type":44,"tag":73,"props":927,"children":928},{},[929],{"type":49,"value":930},"Pattern 7.3: Fee on Transfer",{"type":44,"tag":73,"props":932,"children":933},{},[934],{"type":49,"value":935},"Risk for:",{"type":49,"value":937}," Any token with transfer fees\nFile: contracts\u002FVault.sol:170",{"type":44,"tag":621,"props":939,"children":941},{"className":871,"code":940,"language":873,"meta":629,"style":629},"uint256 balanceBefore = IERC20(token).balanceOf(address(this));\ntoken.transferFrom(msg.sender, address(this), amount);\nshares = amount * exchangeRate;  \u002F\u002F WRONG! Should use actual received amount\n",[942],{"type":44,"tag":204,"props":943,"children":944},{"__ignoreMap":629},[945,953,961],{"type":44,"tag":771,"props":946,"children":947},{"class":880,"line":881},[948],{"type":44,"tag":771,"props":949,"children":950},{},[951],{"type":49,"value":952},"uint256 balanceBefore = IERC20(token).balanceOf(address(this));\n",{"type":44,"tag":771,"props":954,"children":955},{"class":880,"line":890},[956],{"type":44,"tag":771,"props":957,"children":958},{},[959],{"type":49,"value":960},"token.transferFrom(msg.sender, address(this), amount);\n",{"type":44,"tag":771,"props":962,"children":964},{"class":880,"line":963},3,[965],{"type":44,"tag":771,"props":966,"children":967},{},[968],{"type":49,"value":969},"shares = amount * exchangeRate;  \u002F\u002F WRONG! Should use actual received amount\n",{"type":44,"tag":59,"props":971,"children":972},{},[973,977,979,983,985,989,991],{"type":44,"tag":73,"props":974,"children":975},{},[976],{"type":49,"value":639},{"type":49,"value":978}," Accounting mismatch if token takes fees\n",{"type":44,"tag":73,"props":980,"children":981},{},[982],{"type":49,"value":910},{"type":49,"value":984}," User credited more shares than tokens deposited\n",{"type":44,"tag":73,"props":986,"children":987},{},[988],{"type":49,"value":646},{"type":49,"value":990}," Calculate shares from ",{"type":44,"tag":204,"props":992,"children":994},{"className":993},[],[995],{"type":49,"value":996},"balanceAfter - balanceBefore",{"type":44,"tag":121,"props":998,"children":999},{},[],{"type":44,"tag":131,"props":1001,"children":1003},{"id":1002},"known-non-standard-token-handling",[1004],{"type":49,"value":1005},"Known Non-Standard Token Handling",{"type":44,"tag":59,"props":1007,"children":1008},{},[1009,1011,1016,1018,1023,1025,1030,1032,1037,1039,1044],{"type":49,"value":1010},"✓ ",{"type":44,"tag":73,"props":1012,"children":1013},{},[1014],{"type":49,"value":1015},"USDC:",{"type":49,"value":1017}," Properly handled (SafeERC20, 6 decimals accounted for)\n⚠ ",{"type":44,"tag":73,"props":1019,"children":1020},{},[1021],{"type":49,"value":1022},"DAI:",{"type":49,"value":1024}," permit() function not used (opportunity for gas savings)\n✗ ",{"type":44,"tag":73,"props":1026,"children":1027},{},[1028],{"type":49,"value":1029},"USDT:",{"type":49,"value":1031}," Missing return value not handled (CRITICAL)\n✓ ",{"type":44,"tag":73,"props":1033,"children":1034},{},[1035],{"type":49,"value":1036},"WETH:",{"type":49,"value":1038}," Standard wrapper, properly handled\n⚠ ",{"type":44,"tag":73,"props":1040,"children":1041},{},[1042],{"type":49,"value":1043},"UNI:",{"type":49,"value":1045}," Large approval handling not checked (reverts >= 2^96)",{"type":44,"tag":121,"props":1047,"children":1048},{},[],{"type":44,"tag":59,"props":1050,"children":1051},{},[1052],{"type":44,"tag":771,"props":1053,"children":1054},{},[1055],{"type":49,"value":1056},"... Additional sections for remaining analysis categories ...",{"type":44,"tag":621,"props":1058,"children":1061},{"className":1059,"code":1060,"language":49},[624],"\nFor complete report template and deliverables format, see [REPORT_TEMPLATES.md](resources\u002FREPORT_TEMPLATES.md).\n\n---\n\n## Rationalizations (Do Not Skip)\n\n| Rationalization | Why It's Wrong | Required Action |\n|-----------------|----------------|-----------------|\n| \"Token looks standard, ERC20 checks pass\" | 20+ weird token patterns exist beyond ERC20 compliance | Check ALL weird token patterns from database (missing return, revert on zero, hooks, etc.) |\n| \"Slither shows no issues, integration is safe\" | Slither detects some patterns, misses integration logic | Complete manual analysis of all 5 token integration criteria |\n| \"No fee-on-transfer detected, skip that check\" | Fee-on-transfer can be owner-controlled or conditional | Test all transfer scenarios, check for conditional fee logic |\n| \"Balance checks exist, handling is safe\" | Balance checks alone don't protect against all weird tokens | Verify safe transfer wrappers, revert handling, approval patterns |\n| \"Token is deployed by reputable team, assume standard\" | Reputation doesn't guarantee standard behavior | Analyze actual code and on-chain behavior, don't trust assumptions |\n| \"Integration uses OpenZeppelin, must be safe\" | OpenZeppelin libraries don't protect against weird external tokens | Verify defensive patterns around all external token calls |\n| \"Can't run Slither, skipping automated analysis\" | Slither provides critical ERC conformance checks | Manually verify all slither-check-erc criteria or document why blocked |\n| \"This pattern seems fine\" | Intuition misses subtle token integration bugs | Systematically check all 20+ weird token patterns with code evidence |\n\n---\n\n## Deliverables\n\nWhen analysis is complete, I'll provide:\n\n1. **Compliance Checklist** - Checkboxes for all assessment categories\n2. **Weird Token Pattern Analysis** - Presence\u002Fabsence of all 24 patterns with risk levels and evidence\n3. **On-chain Analysis Report** (if applicable) - Holder distribution, exchange listings, configuration\n4. **Integration Safety Assessment** (if applicable) - Safe transfer usage, defensive patterns, weird token handling\n5. **Prioritized Recommendations** - CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW issues with specific fixes\n\nComplete deliverable templates available in [REPORT_TEMPLATES.md](resources\u002FREPORT_TEMPLATES.md).\n\n---\n\n## Ready to Begin\n\n**What I'll need**:\n- Your codebase\n- Context: Token implementation or integration?\n- Token type: ERC20, ERC721, or both?\n- Contract address (if deployed and want on-chain analysis)\n- RPC endpoint (if querying on-chain)\n\nLet's analyze your token implementation or integration for security risks!\n",[1062],{"type":44,"tag":204,"props":1063,"children":1064},{"__ignoreMap":629},[1065],{"type":49,"value":1060},{"type":44,"tag":1067,"props":1068,"children":1069},"style",{},[1070],{"type":49,"value":1071},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1073,"total":1223},[1074,1091,1101,1119,1130,1143,1155,1165,1178,1189,1201,1212],{"slug":1075,"name":1075,"fn":1076,"description":1077,"org":1078,"tags":1079,"stars":26,"repoUrl":27,"updatedAt":1090},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1080,1083,1086,1087],{"name":1081,"slug":1082,"type":16},"C#","c",{"name":1084,"slug":1085,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":1088,"slug":1089,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":1092,"name":1092,"fn":1093,"description":1094,"org":1095,"tags":1096,"stars":26,"repoUrl":27,"updatedAt":1100},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1097,1098,1099],{"name":1081,"slug":1082,"type":16},{"name":14,"slug":15,"type":16},{"name":1088,"slug":1089,"type":16},"2026-07-17T06:05:12.433192",{"slug":1102,"name":1102,"fn":1103,"description":1104,"org":1105,"tags":1106,"stars":26,"repoUrl":27,"updatedAt":1118},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1107,1110,1113,1114,1117],{"name":1108,"slug":1109,"type":16},"Agents","agents",{"name":1111,"slug":1112,"type":16},"CI\u002FCD","ci-cd",{"name":24,"slug":25,"type":16},{"name":1115,"slug":1116,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":1120,"name":1120,"fn":1121,"description":1122,"org":1123,"tags":1124,"stars":26,"repoUrl":27,"updatedAt":1129},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1125,1126,1127,1128],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-18T05:47:43.989063",{"slug":1131,"name":1131,"fn":1132,"description":1133,"org":1134,"tags":1135,"stars":26,"repoUrl":27,"updatedAt":1142},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1136,1139],{"name":1137,"slug":1138,"type":16},"Engineering","engineering",{"name":1140,"slug":1141,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":1144,"name":1144,"fn":1145,"description":1146,"org":1147,"tags":1148,"stars":26,"repoUrl":27,"updatedAt":1154},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1149,1152,1153],{"name":1150,"slug":1151,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":1088,"slug":1089,"type":16},"2026-07-17T06:05:14.575191",{"slug":1156,"name":1156,"fn":1157,"description":1158,"org":1159,"tags":1160,"stars":26,"repoUrl":27,"updatedAt":1164},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1161,1162,1163],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":1166,"name":1166,"fn":1167,"description":1168,"org":1169,"tags":1170,"stars":26,"repoUrl":27,"updatedAt":1177},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1171,1174,1175,1176],{"name":1172,"slug":1173,"type":16},"Architecture","architecture",{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":1137,"slug":1138,"type":16},"2026-07-18T05:47:40.122449",{"slug":1179,"name":1179,"fn":1180,"description":1181,"org":1182,"tags":1183,"stars":26,"repoUrl":27,"updatedAt":1188},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1184,1185,1186,1187],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":1137,"slug":1138,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":1190,"name":1190,"fn":1191,"description":1192,"org":1193,"tags":1194,"stars":26,"repoUrl":27,"updatedAt":1200},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1195,1196,1199],{"name":18,"slug":19,"type":16},{"name":1197,"slug":1198,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":1202,"name":1202,"fn":1203,"description":1204,"org":1205,"tags":1206,"stars":26,"repoUrl":27,"updatedAt":1211},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1207,1208,1209,1210],{"name":18,"slug":19,"type":16},{"name":1081,"slug":1082,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":1213,"name":1213,"fn":1214,"description":1215,"org":1216,"tags":1217,"stars":26,"repoUrl":27,"updatedAt":1222},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1218,1219,1220,1221],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},"2026-07-18T05:47:42.84568",111,{"items":1225,"total":1271},[1226,1233,1239,1247,1254,1259,1265],{"slug":1075,"name":1075,"fn":1076,"description":1077,"org":1227,"tags":1228,"stars":26,"repoUrl":27,"updatedAt":1090},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1229,1230,1231,1232],{"name":1081,"slug":1082,"type":16},{"name":1084,"slug":1085,"type":16},{"name":14,"slug":15,"type":16},{"name":1088,"slug":1089,"type":16},{"slug":1092,"name":1092,"fn":1093,"description":1094,"org":1234,"tags":1235,"stars":26,"repoUrl":27,"updatedAt":1100},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1236,1237,1238],{"name":1081,"slug":1082,"type":16},{"name":14,"slug":15,"type":16},{"name":1088,"slug":1089,"type":16},{"slug":1102,"name":1102,"fn":1103,"description":1104,"org":1240,"tags":1241,"stars":26,"repoUrl":27,"updatedAt":1118},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1242,1243,1244,1245,1246],{"name":1108,"slug":1109,"type":16},{"name":1111,"slug":1112,"type":16},{"name":24,"slug":25,"type":16},{"name":1115,"slug":1116,"type":16},{"name":14,"slug":15,"type":16},{"slug":1120,"name":1120,"fn":1121,"description":1122,"org":1248,"tags":1249,"stars":26,"repoUrl":27,"updatedAt":1129},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1250,1251,1252,1253],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},{"name":21,"slug":22,"type":16},{"slug":1131,"name":1131,"fn":1132,"description":1133,"org":1255,"tags":1256,"stars":26,"repoUrl":27,"updatedAt":1142},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1257,1258],{"name":1137,"slug":1138,"type":16},{"name":1140,"slug":1141,"type":16},{"slug":1144,"name":1144,"fn":1145,"description":1146,"org":1260,"tags":1261,"stars":26,"repoUrl":27,"updatedAt":1154},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1262,1263,1264],{"name":1150,"slug":1151,"type":16},{"name":14,"slug":15,"type":16},{"name":1088,"slug":1089,"type":16},{"slug":1156,"name":1156,"fn":1157,"description":1158,"org":1266,"tags":1267,"stars":26,"repoUrl":27,"updatedAt":1164},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1268,1269,1270],{"name":18,"slug":19,"type":16},{"name":24,"slug":25,"type":16},{"name":14,"slug":15,"type":16},77]