Agent skill

Solidity Patterns

by ccashwell in ccashwell/evm-cortex

Core Solidity design patterns for safe, maintainable smart contracts.

MITAuto-check passedBackend & APIs

Install Solidity Patterns

skills CLI
$ npx skills add ccashwell/evm-cortex --skill solidity-patterns -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ccashwell/evm-cortex solidity-patterns --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ccashwell/evm-cortex.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/solidity-patterns .claude/skills/solidity-patterns && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
solidity-patterns
GitHub stars
131
Token cost
~1.5k tokens
SKILL.md length
196 words
Files
1
Skills in repo
89
Repo updated
First seen
Licence
MIT

At a glance

Core Solidity design patterns for safe, maintainable smart contracts.

  • Works in 3 steps: Checks — validate inputs and preconditions → Effects — update state → Interactions — call external contracts
  • Writing new contracts
  • SKILL.md covers Checks-Effects-Interactions…, Pull-Over-Push, Guard Check Pattern and State Machine Pattern, plus 4 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Solidity Patterns is an agent skill from ccashwell/evm-cortex. Core Solidity design patterns for safe, maintainable smart contracts. Use when writing new contracts, reviewing architecture, or refactoring existing protocol code. Covers checks-effects-interactions, pull-over-push, guard checks, state machines, access restriction, and commit-reveal.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Smart contracts and Design patterns. It works with Solidity. The repository describes itself as: Ethereum protocol engineering squad for AI coding assistants. The licence is MIT.

When your agent uses it

  • Writing new contracts
  • Reviewing architecture
  • Refactoring existing protocol code

Example prompts

  • “/solidity-patterns”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. Checks — validate inputs and preconditions
  2. Effects — update state
  3. Interactions — call external contracts

What it can do on your machine

Read from SKILL.md and the folder at commit f8f3301. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are solidity).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Solidity Patterns loads about 1.5k tokens when it runs. Until then it costs about 76 tokens; SKILL.md has 196 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~76
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ccashwell/evm-cortex at commit f8f3301, republished under its MIT licence (© ccashwell). 196 words, ~1,544 tokens.

Download SKILL.mdSave it as .claude/skills/solidity-patterns/SKILL.md (or your agent's skills folder).
name
solidity-patterns
description
Core Solidity design patterns for safe, maintainable smart contracts. Use when writing new contracts, reviewing architecture, or refactoring existing protocol code. Covers checks-effects-interactions, pull-over-push, guard checks, state machines, access restriction, and commit-reveal.

Solidity Design Patterns

Checks-Effects-Interactions (CEI)

The most critical pattern in Solidity. All functions that interact with external contracts must follow this order:

  1. Checks — validate inputs and preconditions
  2. Effects — update state
  3. Interactions — call external contracts
solidity
function withdraw(uint256 amount) external {
    // CHECKS
    if (amount == 0) revert ZeroAmount();
    if (balances[msg.sender] < amount) revert InsufficientBalance();

    // EFFECTS
    balances[msg.sender] -= amount;

    // INTERACTIONS
    (bool success,) = msg.sender.call{value: amount}("");
    if (!success) revert TransferFailed();

    emit Withdrawn(msg.sender, amount);
}

Violating CEI is the root cause of reentrancy. Even with ReentrancyGuard, always write CEI-compliant code as defense in depth.

Pull-Over-Push

Never iterate over recipients to push funds. Let users withdraw (pull) their own funds.

solidity
// BAD: Push pattern — one revert blocks everyone
function distributeRewards(address[] calldata recipients, uint256[] calldata amounts) external {
    for (uint256 i; i < recipients.length; ++i) {
        payable(recipients[i]).transfer(amounts[i]); // reverts if any fails
    }
}

// GOOD: Pull pattern — each user claims independently
mapping(address => uint256) public pendingRewards;

function claimReward() external {
    uint256 amount = pendingRewards[msg.sender];
    if (amount == 0) revert NothingToClaim();

    pendingRewards[msg.sender] = 0;

    (bool success,) = msg.sender.call{value: amount}("");
    if (!success) revert TransferFailed();

    emit RewardClaimed(msg.sender, amount);
}

Guard Check Pattern

Centralize validation in modifiers or internal functions for reuse and consistency.

solidity
error Unauthorized();
error InvalidAmount();
error Expired(uint256 deadline);

modifier onlyWhitelisted() {
    if (!whitelist[msg.sender]) revert Unauthorized();
    _;
}

modifier validAmount(uint256 amount) {
    if (amount == 0 || amount > MAX_AMOUNT) revert InvalidAmount();
    _;
}

modifier beforeDeadline(uint256 deadline) {
    if (block.timestamp > deadline) revert Expired(deadline);
    _;
}

function deposit(uint256 amount, uint256 deadline)
    external
    onlyWhitelisted
    validAmount(amount)
    beforeDeadline(deadline)
{
    // core logic only — all checks in modifiers
}

State Machine Pattern

Enforce valid state transitions for multi-phase protocols (auctions, vesting, governance).

solidity
enum AuctionState { Created, Bidding, Ended, Settled }

AuctionState public state;

error InvalidState(AuctionState expected, AuctionState actual);

modifier inState(AuctionState expected) {
    if (state != expected) revert InvalidState(expected, state);
    _;
}

function startBidding() external onlyOwner inState(AuctionState.Created) {
    state = AuctionState.Bidding;
    emit BiddingStarted(block.timestamp);
}

function endBidding() external onlyOwner inState(AuctionState.Bidding) {
    state = AuctionState.Ended;
    emit BiddingEnded(block.timestamp);
}

function settle() external inState(AuctionState.Ended) {
    state = AuctionState.Settled;
    // settlement logic
}

Access Restriction Pattern

Layer access control for different privilege levels.

solidity
import {AccessControl} from "@openzeppelin/contracts/access/AccessControl.sol";

contract Treasury is AccessControl {
    bytes32 public constant MANAGER_ROLE = keccak256("MANAGER_ROLE");
    bytes32 public constant EXECUTOR_ROLE = keccak256("EXECUTOR_ROLE");

    uint256 public constant LARGE_THRESHOLD = 100 ether;

    function executeSmall(address to, uint256 amount)
        external
        onlyRole(EXECUTOR_ROLE)
    {
        if (amount >= LARGE_THRESHOLD) revert ExceedsThreshold();
        _transfer(to, amount);
    }

    function executeLarge(address to, uint256 amount)
        external
        onlyRole(MANAGER_ROLE)
    {
        _transfer(to, amount);
    }
}

Commit-Reveal Pattern

Prevent front-running by splitting actions into commit and reveal phases.

solidity
struct Commitment {
    bytes32 hash;
    uint64 timestamp;
    bool revealed;
}

mapping(address => Commitment) public commitments;

uint256 public constant REVEAL_WINDOW = 1 hours;
uint256 public constant MIN_COMMIT_AGE = 1 minutes;

function commit(bytes32 hash) external {
    commitments[msg.sender] = Commitment({
        hash: hash,
        timestamp: uint64(block.timestamp),
        revealed: false
    });
    emit Committed(msg.sender, hash);
}

function reveal(uint256 value, bytes32 salt) external {
    Commitment storage c = commitments[msg.sender];

    if (c.hash == bytes32(0)) revert NoCommitment();
    if (c.revealed) revert AlreadyRevealed();
    if (block.timestamp < c.timestamp + MIN_COMMIT_AGE) revert TooEarly();
    if (block.timestamp > c.timestamp + REVEAL_WINDOW) revert RevealExpired();

    bytes32 expected = keccak256(abi.encodePacked(msg.sender, value, salt));
    if (c.hash != expected) revert InvalidReveal();

    c.revealed = true;
    _processReveal(msg.sender, value);
}

Pattern Selection Checklist

SituationPattern
External calls after state changesChecks-Effects-Interactions
Distributing funds to many usersPull-over-Push
Repeated precondition checksGuard Check / modifiers
Multi-phase protocol flowState Machine
Tiered permissionsAccess Restriction
Sensitive action prone to front-runningCommit-Reveal

Anti-Patterns to Avoid

  • Nested external calls within loops
  • tx.origin for authorization (phishing vector)
  • transfer() / send() for ETH transfers (2300 gas limit breaks with EIP-1884)
  • Implicit state transitions without explicit enum tracking
  • Boolean flags instead of proper state machines

© ccashwell, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/solidity-patterns of ccashwell/evm-cortex.

Open the folder on GitHubat commit f8f3301

Compare with similar skills

Solidity Patterns next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Solidity Patterns compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Solidity Patterns this skillccashwell/evm-cortex131—~1.5kAutomated safety check: PassMIT
Auditsablier-labs/evm-monorepo353—~1.8kAutomated safety check: PassCustom licence
Foundry Reference Modelaviggiano/security144—~516Automated safety check: PassMIT
Fizz Convertpashov/skills1.2k2 repos~3.7kAutomated safety check: PassMIT
Feynman Auditor0xiehnnkta/nemesis-auditor2441 repos~11kAutomated safety check: PassMIT
Smart Contract Auditgreatpie/smart-contract-audit-skill101—~1.1kAutomated safety check: PassNone

Similar skills

  • Audit

    sablier-labs/evm-monorepo

    Security audit and code review for Solidity smart contracts.

    353 GitHub stars~1.8k tokensUpdated 13 days ago
    Backend & APIsAuto-check passed
  • Foundry Reference Model

    aviggiano/security

    Build a simple independent Solidity reference implementation for Foundry tests.

    144 GitHub stars~516 tokensUpdated 22 days ago
    Backend & APIsAuto-check passed
  • Fizz Convert

    pashov/skills

    Convert English-language properties in PROPERTIES.md (produced by the Fizz skill) into Solidity assertions inside the existing fuzz harness, then flip their checkboxes.

    1.2k GitHub starsUsed in 2 repos~3.7k tokens
    Backend & APIsAuto-check passed
  • Feynman Auditor

    0xiehnnkta/nemesis-auditor

    Deep business logic bug finder using the Feynman technique. An agent skill from 0xiehnnkta/nemesis-auditor.

    244 GitHub starsUsed in 1 repo~11k tokens
    Backend & APIsAuto-check passed
  • Smart Contract Audit

    greatpie/smart-contract-audit-skill

    Script-backed, out-of-box auditing workflow for Solidity/EVM repositories based on EVMbench detect/patch/exploit methodology.

    101 GitHub stars~1.1k tokensUpdated 7 mo ago
    Backend & APIsAuto-check passed
  • Radar

    Auditware/radar

    Use radar for smart contract security analysis, AST generation, and detection template development.

    154 GitHub stars~2.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

More from ccashwell/evm-cortex

All 89 skills in this repo
  • Xray Pre Audit

    ccashwell/evm-cortex

    A skill your agent uses when preparing for a security audit, performing reconnaissance on a new codebase, or creating a protocol overview.

    131 GitHub stars~25k tokensUpdated 7 days ago
    Auto-check passed
  • Aave Integration

    ccashwell/evm-cortex

    A skill your agent uses when integrating with Aave V3 for lending, borrowing, flash loans, or building on top of Aave markets.

    131 GitHub stars~1.3k tokensUpdated 7 days ago
    Auto-check passed
  • Access Control Patterns

    ccashwell/evm-cortex

    Access control design patterns for Solidity protocols. An agent skill from ccashwell/evm-cortex.

    131 GitHub stars~1.8k tokensUpdated 7 days ago
    Auto-check passed
  • Anvil Patterns

    ccashwell/evm-cortex

    A skill your agent uses when running a local Ethereum node with Anvil.

    131 GitHub stars~1.3k tokensUpdated 7 days ago
    Auto-check passed
  • Audit Breadth Scan

    ccashwell/evm-cortex

    A skill your agent uses when performing systematic breadth-first review of all contracts during a security audit.

    131 GitHub stars~1.4k tokensUpdated 7 days ago
    Auto-check passed
  • Audit Depth Analysis

    ccashwell/evm-cortex

    A skill your agent uses when performing deep analysis of specific findings or high-risk areas during a security audit.

    131 GitHub stars~1.6k tokensUpdated 7 days ago
    Auto-check passed

Works with

Questions about Solidity Patterns

What does Solidity Patterns do?

Core Solidity design patterns for safe, maintainable smart contracts. Solidity Patterns is an agent skill from ccashwell/evm-cortex. Core Solidity design patterns for safe, maintainable smart contracts.

When should I use Solidity Patterns?

Solidity Patterns fits situations like: writing new contracts; reviewing architecture; refactoring existing protocol code.

How do I install Solidity Patterns in Claude Code?

Run `npx skills add ccashwell/evm-cortex --skill solidity-patterns -a claude-code`. Or copy the skill folder (skills/solidity-patterns in ccashwell/evm-cortex) into .claude/skills/solidity-patterns in your project. Claude Code loads it when a task matches its description.

How do I install Solidity Patterns in Codex?

Run `npx skills add ccashwell/evm-cortex --skill solidity-patterns -a codex`. Or copy the skill folder (skills/solidity-patterns in ccashwell/evm-cortex) into .agents/skills/solidity-patterns in your project. Codex loads it when a task matches its description.

Can I use Solidity Patterns in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ccashwell/evm-cortex --skill solidity-patterns -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/solidity-patterns, .gemini/skills/solidity-patterns, .github/skills/solidity-patterns and .opencode/skills/solidity-patterns in your project.

What does Solidity Patterns need to run?

SKILL.md names no scripts, command-line tools or credentials: Solidity Patterns is instructions for the agent only.

Does Solidity Patterns access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Solidity Patterns safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Solidity Patterns use?

Solidity Patterns is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Solidity Patterns use?

About 1.5k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Solidity Patterns?

Skills that share tags, products or a category with Solidity Patterns: Audit (sablier-labs/evm-monorepo, 353 stars), Foundry Reference Model (aviggiano/security, 144 stars), Fizz Convert (pashov/skills, 1.2k stars) and Feynman Auditor (0xiehnnkta/nemesis-auditor, 244 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Solidity Patterns?

ccashwell (a GitHub user) maintains it in ccashwell/evm-cortex, which has 131 GitHub stars. The repository holds 89 skills in this directory. The repository was last updated on September 30, 2026.

Source: ccashwell/evm-cortex on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.