Cyfrin/Solodit Findings Database Skill

Purpose

Query and leverage the Cyfrin/Solodit findings database — the largest aggregated repository of smart contract audit findings — for vulnerability research, pattern extraction, and audit enhancement. This skill provides structured access to historical audit data across the entire Web3 ecosystem.

Database Statistics

Metric	Value
Total findings indexed	50,530+
Audit firms represented	30+ (Code4rena, Sherlock, Spearbit, Trail of Bits, OpenZeppelin, ConsenSys Diligence, Cyfrin, Sigma Prime, MixBytes, Cantina, etc.)
Protocols covered	2,844+
Vulnerability categories/tags	207
Protocol categories	33 (Lending, DEX, Bridge, Yield, Governance, NFT, Stablecoin, Derivatives, Insurance, etc.)
Chains covered	Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche, Solana, and more

Severity Distribution (Approximate)

Based on the indexed findings:

Severity	Percentage	Approximate Count
Critical	~5%	~2,500
High	~25%	~12,600
Medium	~40%	~20,200
Low	~20%	~10,100
Informational/Gas	~10%	~5,050

Top Vulnerability Categories

Ranked by frequency across the entire database:

1. Access Control — Unprotected functions, missing role checks, privilege escalation
2. Input Validation — Unchecked parameters, missing bounds, zero-address checks
3. Reentrancy — Cross-function, cross-contract, read-only reentrancy
4. Oracle Manipulation — Price feed manipulation, stale prices, TWAP attacks
5. Rounding/Precision — Integer division truncation, share price inflation, dust amounts
6. Flash Loan Attacks — Governance manipulation, price oracle attacks, liquidity draining
7. Front-running/MEV — Sandwich attacks, transaction ordering dependence
8. Denial of Service — Gas griefing, unbounded loops, block stuffing
9. Logic Errors — Incorrect state transitions, wrong comparison operators, off-by-one
10. Token Integration — Fee-on-transfer, rebasing tokens, non-standard ERC20 behavior

Capabilities

Core Query Operations

• Search by vulnerability type: Query findings by category tag (e.g., reentrancy, oracle-manipulation, access-control)
• Search by protocol type: Filter by protocol category (e.g., lending, DEX, bridge, yield aggregator)
• Search by severity: Filter Critical/High/Medium/Low findings
• Search by chain: Target chain-specific vulnerabilities (Ethereum, Arbitrum, Optimism, etc.)
• Search by auditor: Filter by specific audit firm (Code4rena, Sherlock, Spearbit, etc.)
• Get specific finding: Retrieve full details of a finding by its unique ID

Research Operations

• Pattern extraction: Group findings by category to identify recurring vulnerability patterns
• Protocol benchmarking: Compare finding density across similar protocols
• Trend analysis: Track vulnerability type frequency over time
• Auditor comparison: Compare finding distributions across audit firms
• Historical research: Study how specific vulnerability classes have evolved

Audit Enhancement

• Pre-audit intelligence: Build targeted checklists from historical findings for the protocol type under review
• Live code review support: Query relevant past findings when encountering suspicious patterns during review
• Report enrichment: Reference similar historical findings to add credibility and context to audit reports
• Mitigation validation: Check whether proposed fixes align with successful remediations in past findings

API Reference

Property	Value
Base URL	https://api.solodit.xyz
Auth	API key in X-API-Key header
Rate limit	100 requests/minute, 10,000 requests/day
Response format	JSON
Pagination	page (default: 1), per_page (default: 50, max: 100)

Endpoints

Method	Endpoint	Description
GET	/findings	Search findings with filters (severity, category, chain, protocol)
GET	/findings/:id	Get a specific finding by ID
GET	/protocols	List all audited protocols
GET	/categories	List all vulnerability categories

See API Reference for full parameter documentation and response schemas.

Workflows

Workflow	When to Use
Audit Preparation	Before starting an audit — build threat model from historical findings for the protocol type
Code Review Enhancement	During code review — query past findings when encountering suspicious patterns
Vulnerability Learning	Study sessions — deep-dive into a vulnerability category with 10+ real examples
Pre-Development Research	Before writing smart contract code — learn what goes wrong in similar protocols

Resources

Resource	Purpose
API Reference	Full endpoint documentation, parameters, response schemas, error codes
Query Templates	Ready-to-use query patterns for common research scenarios
Rate Limiting	Rate limit details, caching strategies, backoff implementation
Response Parsing	How to extract, normalize, and categorize findings from API responses

Integration with Other Skills

This skill feeds data into multiple other skills in the system:

Skill	Integration
patterns/	Findings data populates vulnerability pattern files (e.g., reentrancy-patterns.md, erc4626-patterns.md)
exploit-forensics/	Past findings provide forensic case studies for exploit analysis
protocol-playbooks/	Historical findings for specific protocol types inform playbook checklists
attack-trees/	Finding severity and frequency data shapes attack tree probability nodes
checklists/	Top vulnerability categories from findings become checklist items
scoring/	Finding density by category informs risk scoring weights

Quick Start Example

To research vulnerabilities for a lending protocol audit:

1. Query: GET /findings?category=lending&severity=critical&per_page=50
2. Extract top attack vectors from results (oracle manipulation, liquidation logic, interest rate calculation)
3. Cross-reference with patterns/oracle-patterns.md and patterns/lending-patterns.md
4. Build targeted checklist using checklists/ templates
5. During review, query specific patterns: GET /findings?category=reentrancy&protocol_type=lending
6. Reference relevant historical findings in audit report

Data Quality Notes

• Findings are sourced from public audit reports and contest results
• Severity levels are preserved as assigned by the original auditor/judge
• Some findings may be marked as invalid or duplicate in contest platforms — filter accordingly
• Protocol names are normalized but may have variations across different audit firms
• Not all findings include code snippets — some only have descriptions and recommendations