Which Cairo versions are supported?

The skill is designed for the modern Cairo ecosystem (Cairo 1.0+) but provides guidance on distinguishing between legacy Cairo 0 and current contract structures.

Does this replace a professional security audit?

While it identifies major patterns and provides a robust automated scan, it is designed to augment professional security research and should be part of a broader audit workflow.

Can it help with L1-L2 bridge security?

Yes, it specifically reviews L1-L2 messaging workflows, ensuring that from_address parameters are validated and cross-layer messages implement proper cancellation and symmetry.

What types of vulnerabilities does this skill detect?

It scans for six critical patterns including unchecked felt252 arithmetic, L1-handler validation issues, storage collisions, missing access controls, and signature replay vulnerabilities.

Cairo Vulnerability Scanner

Name: Cairo Vulnerability Scanner
Author: trailofbits

bytrailofbits

•

2,992

•

Security & Testing

Scans Cairo and StarkNet smart contracts for critical security vulnerabilities including arithmetic overflows, L1-L2 messaging flaws, and signature replay attacks.

The Cairo Vulnerability Scanner is a specialized security tool designed for auditing StarkNet smart contracts. It systematically identifies six critical vulnerability patterns unique to the Cairo ecosystem, such as felt252 arithmetic issues and improper L1-L2 handler validation. By encoding Trail of Bits' security expertise, this skill helps developers and auditors perform deep code reviews, validate cross-layer interactions, and ensure robust cryptographic implementations before mainnet deployment.

Key Features

01Automated detection of 6 critical Cairo and StarkNet vulnerability patterns

02Validation of signature verification logic and replay protection

03Deep analysis of L1-L2 messaging security and bridge implementations

04Integration support for Caracal static analysis and security testing workflows

05Identification of felt252 arithmetic overflows and boundary risks

062,992 GitHub stars

Use Cases

01Validating L1-L2 bridge handlers and cross-layer message integrity

02Pre-launch security assessments for Cairo-based decentralized applications

03Conducting comprehensive security audits on StarkNet smart contracts

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills cairo-vulnerability-scanner

For use in Claude.ai and ChatGPT

Download Skill