The Complete Production SOP: How to Deploy and Run Reentrancy Guard & Checks-Effects-Interactions Pattern in Autonomous AI Agents
Step-by-step SOP to install and run the Solidity Reentrancy Guard & CEI Pattern skill in Codex, Claude Code, and Cursor. Includes verified prompts and tests.
Technical Overview & Architectural Context
When generating or refactoring Solidity smart contracts, autonomous coding agents (Codex, Claude Code, Cursor, Windsurf) frequently succumb to optimistic execution patterns. Agents routinely emit code that executes external calls (e.g., call{value: amount}('') or token transfers) prior to zeroing out internal state mappings, or omit reentrancy locks on cross-contract invocations. These oversights introduce classic single-function, cross-function, and read-only reentrancy vulnerabilities that compromise user balances. The `solidity-reentrancy-guard-pattern` skill establishes strict architectural guardrails directly into the agent's context lifecycle. By enforcing the Checks-Effects-Interactions (CEI) state machine ordering as an uncompromisable constraint and prescribing OpenZeppelin ReentrancyGuard/ReentrancyGuardTransient abstractions, the skill prevents agents from emitting vulnerable state transitions. Agents equipped with this SOP systematically refactor state updates ahead of untrusted calls, emit reentrancy modifiers, and run formal slither/forge invariant checks prior to completing tasks.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into agent runtime directories.
Autonomous runtimes parse deterministic skills from designated `.agents/skills` or `.claude/skills` directory structures. Injecting the `solidity-reentrancy-guard-pattern` manifest establishes declarative triggers ('prevent reentrancy attack solidity', 'apply checks-effects-interactions') and sets restrictive file system access rules (`shell_exec: false`, `net_access: false`, `fs_write: workspace`) to guarantee execution safety.
mkdir -p .agents/skills/solidity-reentrancy-guard-pattern && curl -fsSL https://askills.dev/api/skills/solidity-reentrancy-guard-pattern/raw -o .agents/skills/solidity-reentrancy-guard-pattern/SKILL.md---
name: "solidity-reentrancy-guard-pattern"
description: "Protect smart contracts from reentrancy attacks using Checks-Effects-Interactions and guards."
metadata:
author: "OpenZeppelin"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "prevent reentrancy attack solidity"
- "use reentrancyguard openzeppelin"
- "apply checks-effects-interactions"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# Reentrancy Guard & Checks-Effects-Interactions Pattern
1. Checks: Validate all inputs, msg.sender, balances, and conditions.
2. Effects: Mutate contract state (balances[msg.sender] = 0) BEFORE external calls.
3. Interactions: Invoke external calls, transfers, or token dispatches LAST.
4. Guards: Attach OpenZeppelin `nonReentrant` modifier to external state-mutating endpoints.Place this skill in the project root under `.cursor/rules` or `.agents/skills` rather than global runtime storage to prevent context token bloat on non-Solidity projects.
Claude Code and Cursor ignore SKILL.md manifests if file write permissions exceed workspace boundaries; ensure fs_write remains strictly pinned to 'workspace'.
Dependency Validation & OpenZeppelin Contract Binding
Verify local workspace access to OpenZeppelin contracts and transient storage packages.
The agent must link directly against verified OpenZeppelin ReentrancyGuard modules. If using Foundry, install forge-std and openzeppelin-contracts submodules; if Hardhat, verify node_modules resolution. Ensure reentrancy transient primitives (ERC-1153) are targeted only if the Solidity EVM version is set to Cancun or later.
forge install OpenZeppelin/openzeppelin-contracts --no-commit || npm install @openzeppelin/contractsFor Solidity >=0.8.24 on Cancun EVM, instruct the agent to leverage `ReentrancyGuardTransient` to save up to 2,000 gas per transaction compared to SSTORE/SLOAD guards.
Do not hardcode relative paths like `../../contracts/security/ReentrancyGuard.sol`. Always enforce OpenZeppelin package remappings via `remappings.txt`.
Intent Matching & Trigger Invocation
Invoke the CEI and guard pattern deterministically using frontmatter-aligned prompt triggers.
Provide high-intent prompting that triggers the parsed YAML metadata. When the autonomous agent receives triggers such as 'apply checks-effects-interactions' or 'prevent reentrancy attack solidity', it automatically loads the SOP constraints into its active working memory, suppressing vulnerable raw call patterns.
State the external interaction method clearly (e.g., 'Address.sendValue' or low-level '.call') in your prompt to force explicit return value validation.
Omitting the explicit modifier check can cause the agent to fix the CEI ordering but omit `nonReentrant`, leaving read-only reentrancy vulnerabilities unaddressed across viewing functions.
Verification, Linting & Slither Static Analysis Gate
Run local invariant tests and static analysis gates before approving agent deliverables.
Autonomous agents must self-validate against automated quality gates. Require the agent to run Slither static analysis and Foundry invariant fuzzing tests to confirm that reentrancy detectors pass with exit code 0.
slither . --detect reentrancy-eth,reentrancy-no-eth,reentrancy-unlimited-gas && forge test --match-test testReentrancyPipe Slither's JSON report directly into the agent's feedback loop if failures occur so it can inspect precise assembly/bytecode trace offsets.
Slither may return exit code 255 if remappings are missing. Ensure remappings.txt contains '@openzeppelin/=lib/openzeppelin-contracts/' before invoking the agent.
Real-World Scenario: Refactoring Vulnerable Staking Vault to CEI & Transient Reentrancy Guard
“Refactor Vault.sol: prevent reentrancy attack solidity, use reentrancyguard openzeppelin, and apply checks-effects-interactions to the withdrawBalances() function. Ensure transient storage is utilized if Cancun EVM is supported.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent attempted a partial fix by adding nonReentrant but kept the state mutation after the low-level call, violating Checks-Effects-Interactions.
// Ensure state mutation strictly precedes call
uint256 toWithdraw = balances[msg.sender];
balances[msg.sender] = 0;
(bool sent, ) = msg.sender.call{value: toWithdraw}("");
require(sent, "Ether transfer failed");Root Cause: OpenZeppelin v5.0 relocated ReentrancyGuard from `security/ReentrancyGuard.sol` to `utils/ReentrancyGuard.sol`.
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";Frequently Asked Questions (Reentrancy Guard & Checks-Effects-Interactions Pattern SOP)
Q:Can I use Reentrancy Guard & Checks-Effects-Interactions Pattern across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. Symlinking `.agents/skills/solidity-reentrancy-guard-pattern` into `.cursor/rules` or `.claude/skills` allows Codex, Claude Code, Cursor, and Windsurf to consume the exact same CEI procedural constraints.
Q:How does Reentrancy Guard & Checks-Effects-Interactions Pattern prevent context window overflow during long agent sessions?
Rather than dumping raw OpenZeppelin code bases into system instructions, this skill introduces concise, token-efficient procedural anchors. The agent references local compiler ASTs and targeted reentrancy rules without re-ingesting duplicate Solidity libraries.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100. It requires zero shell execution (`shell_exec: false`) and no network access (`net_access: false`), constraining all agent actions entirely to workspace file edits.
Ready to equip your autonomous agent with Reentrancy Guard & Checks-Effects-Interactions Pattern?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.