Encoding Solidity Security Patterns as Skills for Coding Agents

Coding agents are rapidly improving at generating smart contract code. However, unlike typical application development, contracts control assets and once deployed, bugs cannot be easily fixed. This makes security a paramount concern. The author has compiled battle-tested smart contract patterns and packaged them as skills for coding agents.

The goal is to give agents not just knowledge of Solidity syntax, but also the reasoning patterns experienced developers have learned over years. The author highlights a common vulnerability - reentrancy. In a simple withdrawal function, if an external call is made before updating the contract's balance, an attacker could exploit the contract by calling withdraw() again before the first call is completed, leading to a loss of funds.

The author argues that agents should be taught to understand that external calls represent control-flow boundaries and that their contract's state must remain safe even when execution leaves the contract. This requires understanding adversarial execution, economic incentives, and strict accounting invariants. The author emphasizes that the aim is to embed decades of hard-earned blockchain security directly into the machine's default behavior, rather than treating security as an afterthought.