Smart Contract Risk Prompt
Reviews contract facts for the patterns that let a deployer or attacker take user funds.
/ quick answer
Use with verified source or a decompiled summary. Not a substitute for an audit. Reviews contract facts for the patterns that let a deployer or attacker take user funds.
Review this contract for depositor-facing risk. You are not auditing code quality — you are looking for ways users lose funds. CONTRACT: [ADDRESS + CHAIN] Verified: [YES/NO] Type: [token / pool / vault / staking / other] Source or decompiled summary: [PASTE] Admin roles + timelock: [DATA] Deployment date + TVL: [DATA] Check and report on: 1. Privileged functions: mint, pause, blacklist, fee changes, arbitrary transfer, upgrade. 2. Who holds those privileges and whether a timelock or multisig constrains them. 3. Upgradeability pattern and what an upgrade could change. 4. Fee-on-transfer, rebasing or transfer restrictions that break exits. 5. External dependencies: oracles, routers, other protocols. 6. Ranked list of ways a user could lose funds, with the mechanism for each. 7. Verdict: acceptable / acceptable with limits / avoid, and the reasoning. If the source is insufficient, state exactly what you would need. Never state a contract is safe.
Privileged functions: setFee (uncapped), pause, and a proxy upgrade — all held by a single EOA, no timelock. Upgrade could replace withdrawal logic entirely. No fee-on-transfer. Dependencies: one price oracle, single-source. Loss paths: (1) admin upgrade drains the vault, (2) fee set to 100% blocking exits, (3) oracle manipulation. Verdict: avoid until admin is a timelocked multisig. Not an audit.
What does the Smart Contract Risk Prompt prompt do?
Use with verified source or a decompiled summary. Not a substitute for an audit.
Which AI models work with this prompt?
It is model-agnostic: it works with any capable general model. Replace the bracketed variables with your own context before running it.
What output should I expect?
Privileged functions: setFee (uncapped), pause, and a proxy upgrade — all held by a single EOA, no timelock. Upgrade could replace withdrawal logic entirely. No fee-on-transfer. Dependencies: one price oracle, single-source. Loss paths: (1) admin upgrade drains the vault, (2) fee set to 100% blockin.
/ continue exploring
Related concepts
The vocabulary this page depends on.
- →Smart Contract
A smart contract is code deployed to a blockchain that executes deterministically when called, holding balances and enforcing rules without an operator.
- →Prompt Injection
An attack where hostile input hijacks the LLM's instructions, causing it to leak data or misbehave.
- →Liquidity Pool
A liquidity pool is a smart contract holding two or more assets that traders swap against, with prices set by the pool's formula rather than an order book.
- →Bridge
A bridge moves value between blockchains by locking or burning on one side and issuing a representation on the other.
Related workflows
Turn this into a repeatable process.
- →AI Token Research Workflow
Screen a token in under 30 minutes: contract facts, liquidity structure, holder concentration and a written risk verdict.
- →Monitor Liquidity
Watch the pools you depend on for exit liquidity, so a position becomes unexitable only in theory, not by surprise.
- →DeFi Yield Research Workflow
Evaluate a yield opportunity by decomposing where the return comes from and what has to break for it to disappear.
- →Audit MCP Tool Security
A checklist that catches the failure modes unique to model-driven tool calls.
Related tool stacks
The tools that run it in production.
- →On-chain Research Stack
Explorer, indexer and analytics layers combined so wallet and token questions get answered with verifiable data.
- →AI Security Stack
Least-privilege tooling, approval gates and audit trails for agentic systems.
- →Smart Money Stack
Wallet tracker, on-chain analytics, alert delivery and an AI layer that turns raw wallet events into researchable signals.
Related prompts
Reusable prompts for this job.
- →Liquidity Analysis Prompt
Quantifies real exit liquidity for a token: pool depth, provider concentration, lock status and impact at realistic sizes.
- →Crypto Risk Analysis Prompt
Runs a pre-mortem on a position or protocol: enumerates failure modes, likelihood, impact and observable early warnings.
- →DeFi Protocol Research Prompt
Decomposes a protocol's yield source, contract risk, oracle dependency and exit path into a written risk verdict.
- →Autonomy Boundary Prompt
Defines exactly what an agent may do alone, with approval, or never.
Related use cases
How people apply it, and what came out.
- →Monitor Liquidity
Depth monitoring across 9 positions flagged three tokens as effectively unexitable at their current size, forcing a resize before it mattered.
- →Discover DeFi Opportunities
Ranking yields by real fee-based return instead of advertised APY moved capital from a 31% headline position to an 8.4% sustainable one.
- →Monitor Wallet Transactions
Alerting on the user's own wallet activity caught an unauthorised approval attempt and forced an approval cleanup that removed 14 standing allowances.
Comparisons & alternatives
Pick between the options.
- →DeFi vs Traditional Finance
DeFi offers open access, composability and transparent rules; traditional finance offers legal recourse, insurance and stability.
- →Smart Money vs Technical Analysis
Smart money tracking reads who is positioning; technical analysis reads how price behaves. They answer different questions and fail differently.