defi-protocols — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited defi-protocols (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Production DeFi routing across lending, AMMs, and arbitrage. Covers how capital moves on-chain: flashloan mechanics, AMM math, liquidity fragmentation, and the physics of price discovery across DEXes and chains.
Flashloans let you borrow uncollateralised capital for a single transaction, provided you repay with fee in the same block. Aave V3 is the dominant provider — 0.05% fee, supports all major assets.
function executeOperation(
address asset,
uint256 amount,
uint256 premium,
address initiator,
bytes calldata params
) external returns (bool) {
// 1. Flashloan asset is now in this contract
// 2. Execute arbitrage path: e.g. USDC → WETH (Uniswap) → cbETH (Aerodrome) → USDC (Curve)
// 3. Repay amount + premium before this function returns
IERC20(asset).approve(address(POOL), amount + premium);
return true;
}Balancer V2 offers 0-fee flashloans for pool assets — cheaper but asset-limited. Uniswap V3 has flash swaps (borrow tokenA, repay tokenB in same tx).
Three-leg price loops across DEXes exploit stale pricing on correlated assets. Classic examples: USDC/USDT/DAI, WETH/cbETH/ETH, WBTC/tBTC.
# Detect a USDC → WETH → cbETH → USDC arbitrage
r1 = quote_uniswap_v3(USDC, WETH, 10_000_000_000) # USDC → WETH
r2 = quote_aerodrome(WETH, cbETH, r1) # WETH → cbETH
r3 = quote_curve(cbETH, USDC, r2) # cbETH → USDC
profit_bps = (r3 - 10_000_000_000) * 10_000 // 10_000_000_000Profit requires: gross_bps - (2 * swap_fee_bps + flashloan_fee_bps + gas_in_bps) > threshold. Most triangles are <5bps — sub-basis-point precision on quotes matters.
V3 pools expose liquidity in price ranges (ticks), not uniformly. Price is sqrtPriceX96^2 / 2^192. Out-of-range liquidity earns nothing; in-range liquidity earns fees but suffers impermanent loss.
# Quote from a V3 pool (simplified, in-range only)
from eth_abi import decode
def quote_v3(pool, amount_in, zero_for_one):
# Delegate to quoter contract — it simulates the swap
result = quoter.quoteExactInputSingle(
token_in, token_out, fee_tier, amount_in, 0
)
return result.amountOutFee tiers: 100 (stable pairs), 500 (correlated like WETH/cbETH), 3000 (volatile pairs), 10000 (exotic). Always quote across all tiers and pick best.
Base's main DEX. Two pool types: stable (x^3y + y^3x) for stablecoins and correlated pairs, volatile (x*y) for uncorrelated. Stable pools dominate Base liquidity for stablecoin arbitrage.
Searchers front-run public mempool arbitrages. Counter-strategies:
For Base specifically: CB-Sequencer's FIFO ordering plus low latency reduces but doesn't eliminate MEV. Submit via sequencer.base.org private RPC for best inclusion odds.
USDC, USDT, DAI, FRAX — each has different depeg modes. USDC: custodian redemption (Circle), so hard-pegs within 1bp in normal times. USDT: no on-chain redemption, soft-peg ~10-30bps typical. DAI: Maker vault arbitrage keeps it tight.
Depeg arbitrage: when stablecoin deviates >50bps from $1, it's either a banking incident (USDC March 2023) or momentary liquidity imbalance (resolves in minutes via Curve pools).
1inch Aggregation API v6 gives best execution path across 100+ sources. Use protocols= filter to exclude high-gas paths for small amounts.
# Get best quote for USDC→WETH on Base, Uniswap-V3 + Aerodrome only
params = {
"src": USDC, "dst": WETH, "amount": "10000000000",
"protocols": "BASE_UNISWAP_V3,BASE_AERODROME",
"includeTokensInfo": "false",
}
r = requests.get("https://api.1inch.dev/swap/v6.0/8453/quote",
headers={"Authorization": f"Bearer {KEY}"}, params=params)eth_call at specific block number~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.