Codex skills for Solidity and Ethereum
Codex writes Solidity 0.8.x on OpenZeppelin 5 from a spec of state, roles and invariants, then proves it with Foundry fuzz and invariant tests or Hardhat 3 with viem. Audit exploits run only on local forks, gas changes stay only when forge snapshot shows the saving, and proxy upgrades get a storage-layout diff first. Mainnet deploys and upgrades wait for your explicit confirmation.
Start with these 3
- Solidity Contracts Write contracts as if there is no second release Codex starts from a spec table of state, roles, events and invariants, then writes Solidity that follows checks-effects-interactions, uses custom errors, SafeERC20 and two-step ownership, and avoids traps like transfer(), tx.origin and unbounded loops. Every function ships with tests for its reverts and events, a contract-size check and a static analysis pass.
- Smart Contract Audit Every finding comes with a failing test Codex freezes scope at a commit, maps every entry point and value flow, writes protocol invariants, then works a checklist covering reentrancy, access control, oracle manipulation, rounding, signature replay and upgrade flaws. Suspected bugs become findings only after a Foundry proof of concept on a local fork, and the report rates each by impact and likelihood with a fix review.
- Foundry Testing Fuzz the math, run the invariants, pin the fork Codex writes forge suites that assert every revert and event, fuzzes arithmetic with bound() instead of assume(), and drives invariant tests through handlers with ghost variables so call sequences are meaningful. Fork tests are pinned to a block, CI gets its own foundry.toml profile with more runs, and Foundry 1.x behaviour changes around expectRevert are handled.
7 more Solidity and Ethereum skills
-
Hardhat Projects
Config, deploy and verify without leaking a key -
viem and wagmi
Typed contract calls that simulate before they sign -
Gas Optimization
Cut storage costs first, prove every saving -
Upgradeable Contracts
Upgrade proxies without corrupting storage -
Chainlink Oracles
Treat every oracle answer as untrusted input -
ERC Token Standards
ERC-20, 721 and 1155 composed from audited parts -
Account Abstraction
Gasless, batched transactions that bundlers accept
General skills with Solidity and Ethereum guidance
Not built around Solidity and Ethereum, but they include steps or tools for it. Not part of the install-all command.
Every Solidity and Ethereum skill in one command
Installs these 10 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- solidity-contracts smart-contract-audit foundry-testing hardhat-projects viem-wagmi gas-optimization upgradeable-contracts chainlink-oracles erc-token-standards account-abstraction Solidity and Ethereum FAQ
Do these Solidity skills use Foundry or Hardhat?
Both. Foundry Testing writes forge suites with vm.prank, vm.expectRevert and vm.expectEmit, bounded fuzz tests and handler-based invariant tests, and checks forge --version first because Foundry 1.x removed testFail tests. Hardhat Projects detects Hardhat 2 or 3 and keeps to that version's idioms, writes tests with viem and node:test, and deploys through Ignition modules. Before any mainnet deploy it shows you the module, parameters, deployer address and estimated cost and waits for explicit confirmation.
Can Codex audit a smart contract for vulnerabilities?
Smart Contract Audit first confirms the commit hash, the files in scope and that you are authorized to have the code reviewed. It treats Slither and Aderyn output as leads, then reviews reentrancy, access control, oracle manipulation, rounding, signature replay and upgrade flaws by hand. A suspected bug becomes a finding only after a Foundry proof of concept, and those exploits run only on local forks or local chains, never against a live deployment.
Is there a skill for upgradeable proxy contracts with OpenZeppelin 5?
Upgradeable Contracts starts by asking whether the contract should be upgradeable at all, then builds UUPS (its default), transparent or beacon proxies on OpenZeppelin 5.x with _disableInitializers and ERC-7201 namespaced storage. Before an upgrade it runs OpenZeppelin's upgrade validation and its bundled storage_layout_diff.py, rehearses upgradeToAndCall on a fork, and prepares the call as a multisig transaction. It never executes the mainnet steps without your confirmation at each one.
How do I install all 10 Solidity and Ethereum skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- solidity-contracts smart-contract-audit foundry-testing hardhat-projects viem-wagmi gas-optimization upgradeable-contracts chainlink-oracles erc-token-standards account-abstraction. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which Solidity and Ethereum skill should I try first?
Solidity Contracts is the closest fit for most Solidity and Ethereum work. Mention it with $solidity-contracts in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.