skills/solidity-testing/SKILL.md
[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any test files (*.t.sol). Covers test structure, naming conventions, coverage requirements, fuzz testing, and Foundry cheatcodes. Trigger: any task involving creating, editing, or running Solidity tests.
npx skillsauth add 0xlayerghost/solidity-agent-kit solidity-testingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
MyToken.sol → MyToken.t.soltest/ directorytest_<feature>_<scenario> for passing tests, testFail_<feature>_<scenario> for expected reverts
test_transfer_revertsWhenInsufficientBalancetest_stake_updatesBalanceCorrectlysetUp() for shared state, no cross-test dependencies--match-test and --match-contract for targeted runsEvery core function must have tests covering:
| Scenario | What to verify |
|----------|---------------|
| Happy path | Standard input → expected output, correct state changes |
| Permission checks | Unauthorized caller → vm.expectRevert with correct error |
| Boundary conditions | Zero values, max values (type(uint256).max), off-by-one |
| Failure scenarios | Every require / revert / custom error path |
| State changes | Storage updates, balance changes, event emissions (vm.expectEmit) |
| Edge cases | Empty arrays, duplicate calls, self-transfers |
| Cheatcode | Usage |
|-----------|-------|
| vm.prank(addr) | Next call from addr |
| vm.startPrank(addr) | All calls from addr until vm.stopPrank() |
| vm.warp(timestamp) | Set block.timestamp |
| vm.roll(blockNum) | Set block.number |
| vm.deal(addr, amount) | Set ETH balance |
| vm.expectRevert(error) | Next call must revert with specific error |
| vm.expectEmit(true,true,false,true) | Verify event emission (topic checks) |
| vm.record() / vm.accesses() | Track storage reads/writes |
| makeAddr("name") | Create labeled address for readable traces |
function testFuzz_<name>(uint256 amount) publicvm.assume() to constrain inputs: vm.assume(amount > 0 && amount < MAX_SUPPLY);forge test --fuzz-runs 10000# Run all tests
forge test
# Run specific test function
forge test --match-test test_transfer
# Run specific test contract
forge test --match-contract MyTokenTest
# Verbose output with full trace
forge test -vvvv
# Gas report
forge test --gas-report
# Fuzz with more runs
forge test --fuzz-runs 10000
# Test coverage
forge coverage
# Coverage with report
forge coverage --report lcov
testing
[AUTO-INVOKE] MUST be invoked when designing or reviewing ERC20 token contracts that need flash loan protection. Covers token-level defense design patterns: cost tracking, same-block cooldown, progressive sell tax, minimum balance retention, EIP-7702 aware address checks, front-run protection, and referral binding. Trigger: any ERC20 token with anti-flash-loan, anti-bot, or tokenomics security design requirements.
development
[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers pragma version, naming conventions, project layout, OpenZeppelin library selection standards, oracle integration, and anti-patterns. Trigger: any task involving creating, editing, or reviewing .sol source files.
testing
[AUTO-INVOKE] MUST be invoked BEFORE any on-chain operation (cast send, forge script --broadcast). Systematic 6-layer verification checklist: permissions, dependencies, parameters, security, testing, and knowledge capture. Trigger: any task involving sending transactions, deploying contracts, or interacting with on-chain state.
testing
[AUTO-INVOKE] MUST be invoked BEFORE writing or modifying any Solidity contract (.sol files). Covers private key handling, access control, reentrancy prevention, gas safety, and pre-audit checklists. Trigger: any task involving creating, editing, or reviewing .sol source files.