skills.rest
BitterSecurity
BitterSecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

oracle

Detects oracle vulnerabilities in Solidity smart contracts including stale prices and manipulation patterns.

66|17|Updated Jan 21, 2026
Search Tags:#security#oracle#vulnerability detection#solidity#defi#smart contract audit#chainlink
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill oracle-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oracle
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/vulnerability-patterns/oracle
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill oracle-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Smart contracts that consume oracle price feeds often contain exploitable flaws such as stale price acceptance, missing L2 sequencer checks, and flash-loan-manipulable spot prices. This Skill gives auditors a systematic detection playbook for finding these oracle integration vulnerabilities before attackers do. ## Core Features & Use Cases - Seven Detection Patterns: Covers stale price data, deprecated Chainlink functions, L2 sequencer downtime, decimal precision mismatches, spot price manipulation, oracle revert DoS, and heartbeat mismatches. - Vulnerable vs Secure Code Examples: Each pattern includes Solidity snippets showing the dangerous implementation alongside the hardened fix, plus grep-based search patterns to locate issues in a codebase. - Severity-Ranked Checklist: A ten-point audit checklist and severity classification (Critical/High/Medium) to prioritize findings. - Use Case: While auditing a lending protocol on Arbitrum, use this Skill to verify the price feed checks updatedAt freshness, validates the sequencer uptime feed, and handles decimal scaling dynamically. ## Quick Start Audit the Solidity contracts in this repository for oracle vulnerabilities using the oracle detection patterns and produce an Oracle Integration Matrix.

Frequently Asked Questions about oracle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect stale price vulnerabilities in Chainlink oracle integrations?▼

Search Solidity code for latestRoundData calls and verify each usage checks the updatedAt timestamp against the feed's heartbeat, rejects zero or negative prices, and confirms answeredInRound is at least the roundId. Missing any of these checks allows stale price acceptance.

What oracle vulnerabilities should I check in a smart contract audit?▼

Check for stale price data, deprecated functions like latestAnswer, missing L2 sequencer uptime validation, hardcoded decimal precision, spot prices from AMM reserves vulnerable to flash loans, unhandled oracle reverts, and heartbeat thresholds mismatched with the feed specification.

Why is a sequencer uptime check needed for oracles on Arbitrum and Optimism?▼

On L2 chains, when the sequencer goes down, price feeds stop updating but contracts keep reading the last value. Without checking the sequencer uptime feed and enforcing a grace period after restart, contracts can act on stale prices during and after outages.

Can I use Uniswap pool reserves as a price oracle safely?▼

Reading spot prices directly from getReserves or slot0 is unsafe because flash loans can manipulate reserves within a single transaction. Use a TWAP with a minimum period of around 30 minutes or a manipulation-resistant oracle like Chainlink instead.

What are the limitations of grep-based oracle vulnerability detection?▼

Grep patterns locate candidate code sites but cannot confirm exploitability on their own. Each match requires manual review of surrounding validation logic, deployment context such as L2 versus L1, and the specific feed's heartbeat configuration.

Related Skills

Explore More Software Engineering Skills→
Ramprasad4121Ramprasad4121
1

oracle-flashloan-analysis

Analyze DeFi smart contracts for oracle manipulation and flash loan vulnerabilities.

Community
Advanced
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
monmacllcappmonmacllcapp

ossfuzz

Set up and execute continuous fuzzing for open-source projects on OSS-Fuzz.

Official
Advanced
jammindevjammindev

new-feature

Coordinate Django backend, React UI, and agent wiring for new features without duplicating business logic.

Official
Advanced