Reentrancy
external calls before state updates, cross-function and read-only reentrancy.
The pack · 12 / 14 →
Web3
Shiba
the web3 dog. Solidity and Rust contracts: reentrancy, access control, oracles and upgrades.
Vault.sol
12function withdraw(uint amt) external {
13 (bool ok,) = msg.sender.call{value: amt}(""); balances[msg.sender] -= amt; // effects before interaction
14 balances[msg.sender] -= amt;
15}
16
Reentrancy
ExploitA contract re-enters and drains the vault
FixSmallest change suggested
Shiba is watching$ /watchdog-go-web30 found · 0 fixed
What it does
On duty while you build.
The Web3 dog. Audits smart contracts in Solidity and Rust: reentrancy, access control, oracle manipulation, arithmetic and upgrade proxies.
The always-on lens watches Solidity, Vyper, Rust (Anchor/Solana), Foundry, Hardhat, DeFi, NFTs.
What it checks
7 things Shiba looks for.
Access control
missing `onlyOwner`/role checks, unprotected initialisers, `tx.origin` auth.
Oracles and pricing
spot prices from a single pool, flash-loan manipulable values, stale feeds.
Arithmetic and precision
rounding direction, unchecked blocks, decimals mismatch.
Upgrades
storage collisions, uninitialised implementations, unrestricted upgrade functions.
Token handling
fee-on-transfer/rebasing tokens, unchecked return values, approval races.
Denial of service
unbounded loops, push payments that can revert.
Commands
Send Shiba out.
Runs these scanners when installed, then reads the code they can't understand:
- slither
- aderyn
- mythril
Solidity/Rust contracts: reentrancy, access control, oracles, upgrades
- /watchdog-go-defi
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds a Foundry DeFi project (vault, oracle, proxy, token, deploy script): 18 planted issues, 3 decoys and an answer key.
found
Haiku 5.516/18
Sonnet 5.517/18
Opus 5.517/18
Rules of engagement
What Shiba will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Shiba, answered.
What does Shiba check for?
Shiba is Watchdog's web3 dog for Claude Code. It looks for Reentrancy, Access control, Oracles and pricing, Arithmetic and precision, Upgrades, Token handling and Denial of service. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Shiba in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-web3. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Shiba use?
When they're installed, Shiba runs slither, aderyn and mythril, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Shiba safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).