Smart Contract Risk Prompt
Reviews contract facts for the patterns that let a deployer or attacker take user funds.
/ quick answer
Use with verified source or a decompiled summary. Not a substitute for an audit. Reviews contract facts for the patterns that let a deployer or attacker take user funds.
Review this contract for depositor-facing risk. You are not auditing code quality — you are looking for ways users lose funds. CONTRACT: [ADDRESS + CHAIN] Verified: [YES/NO] Type: [token / pool / vault / staking / other] Source or decompiled summary: [PASTE] Admin roles + timelock: [DATA] Deployment date + TVL: [DATA] Check and report on: 1. Privileged functions: mint, pause, blacklist, fee changes, arbitrary transfer, upgrade. 2. Who holds those privileges and whether a timelock or multisig constrains them. 3. Upgradeability pattern and what an upgrade could change. 4. Fee-on-transfer, rebasing or transfer restrictions that break exits. 5. External dependencies: oracles, routers, other protocols. 6. Ranked list of ways a user could lose funds, with the mechanism for each. 7. Verdict: acceptable / acceptable with limits / avoid, and the reasoning. If the source is insufficient, state exactly what you would need. Never state a contract is safe.
Privileged functions: setFee (uncapped), pause, and a proxy upgrade — all held by a single EOA, no timelock. Upgrade could replace withdrawal logic entirely. No fee-on-transfer. Dependencies: one price oracle, single-source. Loss paths: (1) admin upgrade drains the vault, (2) fee set to 100% blocking exits, (3) oracle manipulation. Verdict: avoid until admin is a timelocked multisig. Not an audit.
/ frequently asked
What does the Smart Contract Risk Prompt prompt do?
Use with verified source or a decompiled summary. Not a substitute for an audit.
Which AI models work with this prompt?
It is model-agnostic: it works with any capable general model. Replace the bracketed variables with your own context before running it.
How do I use this prompt?
1) Copy the prompt with the copy button. 2) Replace every bracketed variable with your real details. 3) Paste it into your AI assistant. 4) Compare the answer with the example output and ask for changes if needed.
What output should I expect?
Privileged functions: setFee (uncapped), pause, and a proxy upgrade — all held by a single EOA, no timelock. Upgrade could replace withdrawal logic entirely. No fee-on-transfer. Dependencies: one price oracle, single-source. Loss paths: (1) admin upgrade drains the vault, (2) fee set to 100% blockin.
/ continue exploring
Related concepts
The vocabulary this page depends on.
- →Smart Contract
A smart contract is code deployed to a blockchain that executes deterministically when called, holding balances and enforcing rules without an operator.
- →Prompt Injection
An attack where hostile input hijacks the LLM's instructions, causing it to leak data or misbehave.
- →Liquidity Pool
A liquidity pool is a smart contract holding two or more assets that traders swap against, with prices set by the pool's formula rather than an order book.
- →Bridge
A bridge moves value between blockchains by locking or burning on one side and issuing a representation on the other.
Related workflows
Turn this into a repeatable process.
- →AI Token Research Workflow
Screen a token in under 30 minutes: contract facts, liquidity structure, holder concentration and a written risk verdict.
- →Monitor Liquidity
Watch the pools you depend on for exit liquidity, so a position becomes unexitable only in theory, not by surprise.
- →DeFi Yield Research Workflow
Evaluate a yield opportunity by decomposing where the return comes from and what has to break for it to disappear.
- →Audit MCP Tool Security
A checklist that catches the failure modes unique to model-driven tool calls.
Related tool stacks
The tools that run it in production.
- →On-chain Research Stack
Explorer, indexer and analytics layers combined so wallet and token questions get answered with verifiable data.
- →AI Security Stack
Least-privilege tooling, approval gates and audit trails for agentic systems.
Related prompts
Reusable prompts for this job.
- →Liquidity Analysis Prompt
Quantifies real exit liquidity for a token: pool depth, provider concentration, lock status and impact at realistic sizes.
- →Crypto Risk Analysis Prompt
Runs a pre-mortem on a position or protocol: enumerates failure modes, likelihood, impact and observable early warnings.
- →DeFi Protocol Research Prompt
Decomposes a protocol's yield source, contract risk, oracle dependency and exit path into a written risk verdict.
- →Autonomy Boundary Prompt
Defines exactly what an agent may do alone, with approval, or never.
Related use cases
How people apply it, and what came out.
- →Monitor Liquidity
Depth monitoring across 9 positions flagged three tokens as effectively unexitable at their current size, forcing a resize before it mattered.
- →Discover DeFi Opportunities
Ranking yields by real fee-based return instead of advertised APY moved capital from a 31% headline position to an 8.4% sustainable one.
- →Monitor Wallet Transactions
Alerting on the user's own wallet activity caught an unauthorised approval attempt and forced an approval cleanup that removed 14 standing allowances.
Comparisons & alternatives
Pick between the options.
- →DeFi vs Traditional Finance
DeFi offers open access, composability and transparent rules; traditional finance offers legal recourse, insurance and stability.
- →Smart Money vs Technical Analysis
Smart money tracking reads who is positioning; technical analysis reads how price behaves. They answer different questions and fail differently.