About near-contract-audit
A security-audit skill for NEAR smart contracts written in Rust, intended for auditors and coding agents. It combines automated analysis with manual review and organizes findings by severity, location, and remediation.
Key features
- 01Scan common vulnerability patterns
- 02Review business logic and access control
- 03Assess exploitability of findings
- 04Generate severity-based audit reports
- 05Consult vulnerability detector references
Use cases
- 01Audit NEAR Rust contract security
- 02Verify whether scan results are true positives
- 03Prepare remediation guidance for findings
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/near-contract-auditin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
references/high-severity.mdlow-severity.mdmedium-severity.mdDetails
From the project READMENEAR Contract Audit
Security audit skill for NEAR smart contracts in Rust.
Audit Workflow
Phase 1: Automated Analysis
Run your preferred Rust static analysis and NEAR-focused security tools on the contract to:
- Scan for common vulnerability patterns (reentrancy, unsafe math, unhandled promises, access control issues, etc.)
- Highlight potentially risky patterns for deeper manual review
Phase 2: Manual Review
After automated analysis, perform manual review for:
- Business logic vulnerabilities
- Access control patterns
- Economic attack vectors
- Cross-contract interaction safety
Phase 3: Code-Specific Analysis
For each finding, verify:
- Is it a true positive?
- What is the exploitability?
- What is the recommended fix?
Phase 4: Report Generation
Document findings with severity, location, description, and remediation.
Vulnerability Quick Reference
| Severity | Detector ID | Description |
|---|---|---|
| High | non-private-callback | Callback missing #[private] macro |
| High | reentrancy | State change after cross-contract call |
| High | incorrect-argument-or-return-types | Using native integer types in JSON interfaces |
| High | unsaved-changes | Collection modifications not persisted |
| High | owner-check | Missing caller/owner verification |
| High | yocto-attach | Missing assert_one_yocto on sensitive functions |
| High | storage-collision | Same storage prefix for different collections |
| High | required-initialization-macro | Missing #[init] on initialization method |
| Medium | gas-griefing | Unbounded loops causing DoS |
| Medium | insecure-random | Predictable randomness from block data |
| Medium | prepaid-gas | Insufficient gas reserved for callbacks |
| Low | cover-storage-cost | Missing storage deposit verification |
| Low | unsafe-math | Arithmetic without overflow checks |
| Low | float-math | Using floating point types for financial math |
Reference Files
For detailed vulnerability documentation with code examples:
- high-severity.md - Critical vulnerabilities (8 detectors)
- medium-severity.md - Medium vulnerabilities (4 detectors)
- low-severity.md - Low severity findings (3 detectors)
Comments
Markdown supported