Smart contracts are unforgiving: a single missing onlyOwner or a reentrancy hole can drain a protocol in minutes. According to the annual Web3 security reports that Chainalysis and CertiK publish, losses tied to smart-contract exploits keep climbing year over year, and most of those bugs are not exotic zero-days — they are patterns a careful reviewer would catch. That is exactly the space where a well-aimed LLM prompt earns its keep: not as an oracle, but as a tireless first-pass reviewer that never gets bored of reading the same function for the tenth time.
Below are ten prompts I keep coming back to, grouped from basic to expert. Each has a task, the prompt itself, and a realistic example of what comes back. Treat every output as a draft: the model can hallucinate a non-existent OpenZeppelin import or miss an economic invariant, so the final word always belongs to a human reviewer and a tool like Slither or Foundry's fuzzer.
Basic tier: getting correct, idiomatic Solidity
1. Generate a contract from a plain-language spec. Task: turn requirements into compilable code. Prompt: "You are a Solidity 0.8.x engineer. Write an ERC-20 token named X with a capped supply, a 2% transfer fee sent to a treasury address, and OpenZeppelin imports only. Add NatSpec comments and list every assumption you made." Example result: the model returns a contract inheriting ERC20 and Ownable, overrides _update to apply the fee, and flags the assumption that fee-on-transfer breaks some DEX routers.
2. Explain a standard, not just quote it. Task: understand ERC-721 vs ERC-1155 before you build. Prompt: "Compare ERC-721 and ERC-1155 for a game with both unique items and stackable resources. Reference the actual EIP text from eips.ethereum.org and show which functions differ." Example result: a table mapping safeTransferFrom semantics, batch operations in 1155, and a recommendation to use 1155 for fungible stacks.
| Standard | Best for | Key trade-off |
|---|---|---|
| ERC-20 | Fungible tokens | No hooks, simple |
| ERC-721 | Unique NFTs | One token per id |
| ERC-1155 | Mixed assets | More complex approvals |
Advanced tier: review and hardening
3. Hunt for reentrancy and access-control bugs. Task: a first-pass audit. Prompt: "Review this contract for reentrancy, unchecked external calls, and missing access control. For each finding give severity, the vulnerable line, and a patched version using checks-effects-interactions." Example result: it flags a call{value: x}("") before a balance update and rewrites the function to zero the balance first, mirroring the pattern the Ethereum Foundation documents in its security recommendations.
4. Generate Foundry tests from the spec. Task: prove behavior, not just compile. Prompt: "Write Foundry tests in Solidity for this contract covering the fee path, the cap, and a revert case. Use vm.prank and vm.expectRevert." Example result: runnable .t.sol files that pass under forge test, including an edge case where the fee rounds to zero.
5. Map an upgrade path. Task: move to a proxy safely. Prompt: "Convert this logic contract to a UUPS proxy using OpenZeppelin Upgrades. Explain storage-layout risks and list what must never change between versions." Example result: an initialize function replacing the constructor and a warning about storage slot collisions.
Expert tier: gas and economics
6. Gas-optimization pass. Task: shave cost without breaking semantics. Prompt: "Optimize this loop for gas. Suggest packing structs, caching array.length, and using unchecked where provably safe. Quantify expected savings per operation." Example result: caching length and packing two uint128 fields into one slot, with a note that unchecked is only safe when overflow is impossible.
7. Storage-vs-calldata analysis. Task: understand where gas actually goes. Prompt: "Explain why calldata is cheaper than memory for external function args, and rewrite these signatures accordingly." Example result: a corrected signature and a short explanation tied to how the EVM charges for storage slots versus calldata bytes.
8. Threat-model an economic attack. Task: think like an adversary. Prompt: "Model a flash-loan attack on this lending contract's oracle. List the preconditions, the profit path, and two mitigations such as a TWAP oracle." Example result: a step-by-step attack narrative and a recommendation to use a time-weighted average price feed.
9. Draft an audit report skeleton. Task: hand reviewers a structured starting point. Prompt: "Produce an audit report outline with scope, methodology, severity matrix, findings table, and a disclaimer, in the style of public reports on GitHub." Example result: a Markdown template ready to fill with real findings.
10. Explain a failing transaction. Task: debug a revert fast. Prompt: "Given this revert reason and bytecode snippet, explain the likely cause and the minimal fix." Example result: it identifies a require on an allowance and suggests the missing approve call.
Findings and takeaways
The pattern across all ten: the model is strongest at breadth — reading a whole contract, naming a pattern, drafting tests — and weakest at certainty. Pair it with Slither for static analysis, Foundry for execution, and your own eyes for economics. Used that way, it compresses the boring parts of an audit and leaves you the thinking. If you want to go deeper into prompt craft and Web3 fundamentals, the structured courses on asibiont.com are a solid next step.
Comments