FB defi-security-audit

Analyze a DeFi protocol for vulnerabilities, mechanism safety, and risk factors. Use when the user wants to audit a DeFi project, check protocol security, or assess risk. Trigger words include "audit defi", "analyze protocol", "check security", "defi risk", "protocol vulnerability", "is it safe".

Not recommendedlow grade F

ClawHub Agent Skills author: LJ Li v1.2.0 MIT-0 80 files body ≈ 9 835 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process B 77/100 · Nearly there — weak spots: result and completion, execution cost, progress reporting

Analyzer GitHub Data and analytics Security Software developmenttype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

30/100

safety, quality, tests

Safety 60%: 0
Quality 40%: 75
Run on models: none yet

Process rating

77/100

Nearly there

Result and completion w 14: 0
Progress reporting w 2: 0
Execution cost w 6: 40

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Broad scope medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill asks for more than the task needs: broad tool access, credential environment variables, binaries. Every extra permission widens the damage from a mistake or a compromise.

For the author

Narrow allowed-tools and the variable list to the minimum; replace binaries with readable sources or scripts.

How to improve

The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 446

✓ No critical or high findings

Medium and low: 446

medium Broad scope meta-broad-allowed-tools SKILL.md:1

Broad tool permissions pre-approved: Bash
```
allowed-tools: Read Write Edit Bash Glob Grep WebSearch WebFetch
```
low Risky intent intent-offensive-security docs/audit-reports.md:42

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| Gains Network | Perps | Multi | $28M | [Report](examples/gains-network-perps.md) | GoPlus hidden_owner persists; bug bounty halved; anonymous team |
```
low Risky intent intent-offensive-security docs/audit-reports.md:46

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| edgeX | Perps | Multi | $190M | [Report](examples/edgex-perps.md) | No multisig/timelock disclosed; $10K bug bounty; single oracle |
```
low Risky intent intent-offensive-security docs/audit-reports.md:49

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| Extended | Perps | Starknet | $174.7M | [Report](examples/extended-perps.md) | Doxxed team (ex-Revolut) but unverified multisig; no bug bounty |
```
low Risky intent intent-offensive-security docs/audit-reports.md:51

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| ApeX Omni | Perps | Multi | $125M | [Report](examples/apex-omni-perps.md) | Zero governance transparency; 0 DeFiLlama audits; no bug bounty |
```
low Risky intent intent-offensive-security docs/audit-reports.md:63

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| Uniswap | DEX | Multi | $3.09B | [Report](examples/uniswap-dex.md) | No admin keys; 48h timelock; $15.5M bug bounty |
```
low Risky intent intent-offensive-security docs/batch-audit-20260420.md:33

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
```
- Gains Network: MEDIUM -> **HIGH** (GoPlus hidden_owner, bug bounty halved)
```
detector
low Risky intent intent-offensive-security docs/batch-audit-20260420.md:82

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**4. Bug bounty programs are inadequate or absent.**
```

low Risky intent intent-offensive-security docs/batch-audit-20260420.md:83

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

Only 3 of 10 have meaningful bug bounty programs (Synthetix via Immunefi, Paradex $500K, Lighter has none despite $500M TVL). For comparison, Aave offers $15.5M and GMX offers $5M.

low Risky intent intent-offensive-security docs/examples/aave-top-protocol.md:91

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- Bug bounty: Up to $1M via Immunefi
```
fixture
low Risky intent intent-offensive-security docs/examples/aave-top-protocol.md:99

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- Nov 2023: Critical V2 vulnerability patched via bug bounty before exploitation
```
fixture
low Risky intent intent-offensive-security docs/examples/aerodrome-dex.md:50

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] No bug bounty program -- NO (inherits Velodrome's program)
```
fixture
low Risky intent intent-offensive-security docs/examples/aerodrome-dex.md:57

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] No disclosed penetration testing -- YES (-5)
```
fixture
low Risky intent intent-offensive-security docs/examples/aerodrome-dex.md:77

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [x] +5  Bug bounty program details publicly listed (Velodrome/Aerodrome, up to 100k-500k EUR)
```
fixture
low Risky intent intent-offensive-security docs/examples/aerodrome-dex.md:83

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] +0  Regular penetration testing disclosed
```
fixture
low Risky intent intent-offensive-security docs/examples/aerodrome-dex.md:143

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
| Off-Chain Security | HIGH | No SOC 2/ISO 27001, no published key management, no disclosed pentest; DNS hijack incident (Nov 2025) exposed Web2 infrastructure weakness | H/O | N |
```
detectorfixture
low Secrets in code secret-high-entropy-token docs/examples/alpaca-leverage.md:12

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- Token: ALPACA (BEP-20, 0x8F…d2F on BSC)
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/alpaca-leverage.md:114

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- The Timelock contract (0x2D…a59) owns all major protocol contracts
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/alpaca-leverage.md:127

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- Proxy Admin contract at 0x53…452
```
fixture
low Risky intent intent-offensive-security docs/examples/alpaca-leverage.md:207

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug Bounty:**
```
fixture
low Risky intent intent-offensive-security docs/examples/alpaca-leverage.md:290

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Bug Bounty | $100K (Immunefi) | $200K+ (Immunefi) | $100K (Immunefi) |
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/alpaca-leverage.md:298

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition; test fixture / example file)
```
3. **Monitor contract state.** If you have remaining positions, monitor the BscScan timelock contract (0x2D…a59) for any unexpected admin transactions during the shut
```
detectorfixture
low Risky intent intent-offensive-security docs/examples/antarctic-perps.md:35

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [x] No bug bounty program (-5)
```
fixture
low Risky intent intent-offensive-security docs/examples/antarctic-perps.md:40

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [x] No disclosed penetration testing (-5)
```
fixture
low Risky intent intent-offensive-security docs/examples/antarctic-perps.md:58

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] +5   Bug bounty program details publicly listed (none found)
```
fixture
low Risky intent intent-offensive-security docs/examples/antarctic-perps.md:64

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] +5   Regular penetration testing disclosed (none found)
```
fixture
low Risky intent intent-offensive-security docs/examples/antarctic-perps.md:171

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- **Bug bounty**: No bug bounty program found on Immunefi or any other platform.
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/apex-omni-perps.md:13

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- Token: APEX (ERC-20, Ethereum: 0x52…2B8)
```
fixture
low Risky intent intent-offensive-security docs/examples/apex-omni-perps.md:32

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [x] No bug bounty program on Immunefi (-5)
```
fixture
low Risky intent intent-offensive-security docs/examples/apex-omni-perps.md:35

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [x] No disclosed penetration testing (-5)
```
fixture
low Risky intent intent-offensive-security docs/examples/apex-omni-perps.md:51

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] +5   Bug bounty program details publicly listed
```
fixture
low Risky intent intent-offensive-security docs/examples/apex-omni-perps.md:57

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- [ ] +5   Regular penetration testing disclosed
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/apex-omni-perps.md:75

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
## GoPlus Token Security (Ethereum: 0x52…2B8)
```
fixture
low Risky intent intent-offensive-security docs/examples/apex-omni-perps.md:106

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
| Off-Chain Security | HIGH | No SOC 2, no published key management, no penetration testing disclosed | O | N |
```
detectorfixture
low Secrets in code secret-high-entropy-token docs/examples/aster-perps.md:14

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- Token: ASTER (BEP-20, BNB Chain) -- 0x00…56A
```
fixture
low Risky intent intent-offensive-security docs/examples/aster-perps.md:35

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| No disclosed penetration testing | LOW | -5 |
```
fixture
low Risky intent intent-offensive-security docs/examples/aster-perps.md:46

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Bug bounty program on Immunefi | +5 |
```
fixture
low Risky intent intent-offensive-security docs/examples/aster-perps.md:100

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
| Off-Chain Security | **HIGH** | No SOC 2, no key management policy, no pentest disclosed, anonymous team | O | N |
```
detectorfixture
low Risky intent intent-offensive-security docs/examples/aster-perps.md:167

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug bounty**: Active on Immunefi with up to $200,000 max payout. Scope covers 10 smart contracts (asBTC, USDF, asUSDF, asBNB-related) plus frontend. Critical smart contract bugs: 10% of affected fun
```
fixture
low Risky intent intent-offensive-security docs/examples/aster-perps.md:198

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Off-chain controls**: No SOC 2, ISO 27001, or any third-party security certification. No published key management policy. No disclosed penetration testing. No information about operational segregati
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/aura-yield.md:12

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- Token: AURA (ERC-20, 0xC0…DBF on Ethereum)
```
fixture
low Risky intent intent-offensive-security docs/examples/aura-yield.md:176

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug Bounty:** Active on Immunefi since June 2022, with up to $1M maximum payout for critical vulnerabilities. Critical bugs require PoC, capped at 10% of economic damage.
```
fixture
low Risky intent intent-offensive-security docs/examples/aura-yield.md:246

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Bug Bounty | $1M (Immunefi) | Yes (Immunefi) | $250K (Immunefi) |
```
fixture
low Risky intent intent-offensive-security docs/examples/babylon-bitcoin-restaking.md:72

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
| Smart Contract | **LOW** | 9+ audits from 6 firms; open source; active bug bounty | Y |
```
detectorfixture
low Risky intent intent-offensive-security docs/examples/babylon-bitcoin-restaking.md:154

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Sherlock | Phase 1 (competition) | 2024 | Bug bounty competition format |
```
fixture
low Risky intent intent-offensive-security docs/examples/babylon-bitcoin-restaking.md:179

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug Bounty:**
```
fixture
low Risky intent intent-offensive-security docs/examples/babylon-bitcoin-restaking.md:264

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Bug Bounty | $500K max / $3M cap (Immunefi) | Immunefi | $120K Cantina competition |
```
fixture
low Risky intent intent-offensive-security docs/examples/balancer-dex.md:161

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug Bounty:**
```
fixture
low Risky intent intent-offensive-security docs/examples/bancor-dex.md:163

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug bounty:** Carbon DeFi by Bancor has an active Immunefi bug bounty program with rewards up to $900,000 (paid in BNT). KYC required for payouts.
```
fixture
low Risky intent intent-offensive-security docs/examples/bancor-dex.md:212

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Bug Bounty | $900K (Carbon only) | $15.5M | $250K+ |
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/benqi-lending.md:54

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
## GoPlus Token Security (QI on Avalanche, 0x87…0F5)
```
fixture
low Risky intent intent-offensive-security docs/examples/benqi-lending.md:183

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Web App Pentest | Halborn | March 2022 | Web application & API | 0.25 |
```
fixture
low Risky intent intent-offensive-security docs/examples/benqi-lending.md:190

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- CORS vulnerability was identified in the Halborn web app pentest (API allows any website to trigger authenticated requests). Status of fix: UNVERIFIED.
```
fixture
low Risky intent intent-offensive-security docs/examples/benqi-lending.md:192

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
**Bug Bounty (Immunefi):**
```
fixture
low Risky intent intent-offensive-security docs/examples/benqi-lending.md:264

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Bug Bounty | Immunefi (max undisclosed) | Immunefi ($1M max) | Immunefi ($1M max) |
```
fixture
low Risky intent intent-offensive-security docs/examples/benqi-lending.md:275

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
4. **For the BENQI team**: Implement a timelock (48h minimum, 7d for critical changes); increase Markets multisig to 4+ signers minimum; publish reserve fund balances; disclose multisig signer identit
```
fixture
low Secrets in code secret-high-entropy-token docs/examples/camelot-dex.md:12

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
- Token: GRAIL (ERC-20, Arbitrum: 0x3d…2D8)
```
fixture
low Risky intent intent-offensive-security docs/examples/camelot-dex.md:27

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- -5: No confirmed bug bounty program on Immunefi
```
fixture
low Risky intent intent-offensive-security docs/examples/camelot-dex.md:32

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
Red flags found: 0 CRITICAL, 1 HIGH (anonymous team), 4 MEDIUM (mintable token, TVL decline, low multisig threshold, overlapping multisig signers), 3 LOW (no timelock, no bug bounty, undisclosed signe
```
detectorfixture
low Secrets in code secret-high-entropy-token docs/examples/camelot-dex.md:112

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file)
```
**Team Multisig (2/3):** Address 0x46…2D7 (Safe v1.3.0+L2, no modules) controls the most critical protocol functions: Factory/Pairs, Master/NFTPools, NitroPoolFactory
```
fixture

…and 386 more

Files scanned: 80. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning body-long SKILL.md body ≈ 9835 tokens (recommended < 5000); move details to references/

Process rating: all ten parameters 77/100

0Result and completion. Does not say what the result is
0Progress reporting. Says nothing while it works
40Execution cost. Instruction body is 9835 tokens: crowds the task out of the window
70Inputs and preconditions. Inputs and preconditions are listed
100Tools and files. Tools declared in frontmatter
100Steps. 210 steps
100When it triggers. States when to use and when not to
100Failures and branches. 11 branches, has a failure section
100Consistency. Name and required fields are in place
100Running it twice. Mutating operations check current state

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+4Description does not say when NOT to use the skill (false activations)
+3Output format is not stated: the model decides each time
-42 reference files, but SKILL.md never points to them: the model will not open them
+1No license
+2Single-language instructions
+5Description quotes 6 example trigger phrases
+3Description length 297: enough signal without eating the budget
+4Structure: 48 headings
+3Step-by-step instructions: 210 items
+4Has examples (22 code blocks)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 75.

External checks

ClawHub: clean

This is a purpose-aligned DeFi research skill, but users should understand it sends lookup targets to public APIs and can produce high-stakes risk guidance.

LLM: benign (medium) · VirusTotal: · 29 May 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 80

CLAUDE.md 4K
docs/audit-reports.md 14K
docs/batch-audit-20260420.md 14K
docs/examples/aave-top-protocol.md 6K
docs/examples/aerodrome-dex.md 25K
docs/examples/alpaca-leverage.md 20K
docs/examples/antarctic-perps.md 21K
docs/examples/apex-omni-perps.md 21K
docs/examples/aster-perps.md 23K
docs/examples/aura-yield.md 20K
docs/examples/babylon-bitcoin-restaking.md 20K
docs/examples/balancer-dex.md 17K
docs/examples/bancor-dex.md 17K
docs/examples/benqi-lending.md 19K
docs/examples/camelot-dex.md 22K
docs/examples/centrifuge-rwa.md 23K
docs/examples/cian-protocol-yield.md 17K
docs/examples/circle-usyc-rwa.md 22K
docs/examples/compound-lending.md 19K
docs/examples/convex-yield.md 17K
docs/examples/curve-dex.md 18K
docs/examples/dodo-dex.md 20K
docs/examples/drift-protocol-post-hack-20260420.md 19K
docs/examples/drift-protocol-pre-hack.md 5K
docs/examples/dydx-derivatives.md 27K
docs/examples/edgex-perps.md 22K
docs/examples/eigenlayer-restaking.md 13K
docs/examples/ethena-basis-trading.md 19K
docs/examples/ethena-stablecoin.md 21K
docs/examples/etherfi-liquid-restaking.md 17K
docs/examples/extended-perps.md 22K
docs/examples/falcon-finance-basis.md 25K
docs/examples/fluid-lending-dex.md 28K
docs/examples/gains-network-perps.md 31K
docs/examples/gmx-derivatives.md 30K
docs/examples/grove-finance-allocator.md 19K
docs/examples/grvt-perps.md 23K
docs/examples/hyperliquid-perps.md 35K
docs/examples/infrared-berachain.md 22K
docs/examples/instadapp-aggregator.md 20K
docs/examples/jupiter-ecosystem-deep-dive.md 39K
docs/examples/jupiter-solana-dex.md 29K
docs/examples/justlend-lending.md 18K
docs/examples/kamino-lending.md 20K
docs/examples/kelp-liquid-restaking.md 23K
docs/examples/kelp-post-hack-20260419.md 11K
docs/examples/lido-liquid-staking.md 15K
docs/examples/lighter-perps.md 23K
docs/examples/lybra-stablecoin.md 17K
docs/examples/mantle-meth-staking.md 25K
docs/examples/maple-lending.md 19K
docs/examples/morpho-lending.md 20K
docs/examples/notional-lending.md 18K
docs/examples/obol-dvt-staking.md 17K
docs/examples/ondo-rwa.md 22K
docs/examples/osmosis-dex.md 20K
docs/examples/ostium-perps.md 21K
docs/examples/pancakeswap-dex.md 17K
docs/examples/paradex-perps.md 26K
docs/examples/pendle-yield-tokenization.md 21K

Frontmatter

version: 1.2.0

allowed-tools: Read, Write, Edit, Bash, Glob, Grep, WebSearch, WebFetch

metadata: {"openclaw":{"requires":{"bins":["curl","jq"]},"optional_bins":["solana"]}}

Dates

In catalog since 5 Apr 2026

Updated in catalog 11 May 2026

First seen here 9 Sept 2026

Last analysis 11 Sept 2026, 02:19 UTC

Last seen in crawl 7 h ago

Score history

Date		Score	Safety	Qual.
9 Sept 2026	F	30	0	75