Try our new dimensional analysis Claude plugin
Trail of Bits has released a new Claude plugin that leverages LLMs to perform dimensional analysis on arithmetic-heavy codebases, such as smart contracts. By annotating code with dimensional types and mechanically flagging mismatches, the tool achieved a 93% recall rate in identifying bugs during testing, significantly outperforming baseline LLM prompts.
Authors: Trail of Bits
Key Takeaways
- Trail of Bits released a new Claude plugin (dimensional-analysis) designed to find bugs in arithmetic-heavy codebases like smart contracts.
- The plugin uses LLMs to annotate code with dimensional types and mechanically flags mismatches, achieving a 93% recall rate in testing.
- The analysis process consists of four phases: dimension discovery, annotation, propagation, and validation.
- The tool generates a Dimensional Grammar document (DIMENSIONAL_UNITS.md) defining base units (e.g., {L} for Uniswap liquidity, {tok0} for Token 0 amounts) to standardize analysis.
Affected Systems
- Smart contracts
- Blockchain nodes
- Arithmetic-heavy codebases
Attack Chain
This report details a defensive code auditing tool rather than an attack chain. The dimensional-analysis plugin operates in four phases to audit code. First, it performs dimension discovery to identify fundamental base units and saves them to DIMENSIONAL_UNITS.md. Next, subagents annotate the codebase using this vocabulary. Finally, dimensions are propagated across files and validated to mechanically flag mismatches in assignments, arithmetic, and external calls.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided as this article discusses a static analysis and code auditing tool rather than a cyber threat.
Detection Engineering Assessment
EDR Visibility: None — This is a static code analysis tool used during development and auditing, not a runtime threat. Network Visibility: None — The tool operates locally on codebases and interacts with the Claude API, which does not generate network traffic relevant to threat detection. Detection Difficulty: N/A — Not applicable as this is a defensive code auditing tool.
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Monitor for the execution of the Claude CLI tool running the dimensional-analysis plugin to track internal adoption of the security tool by engineering teams. | Process execution logs (Event ID 4688 or Sysmon Event ID 1) | N/A | High (This is a benign developer activity) |
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Install and run the dimensional-analysis Claude plugin on arithmetic-heavy codebases like smart contracts to identify potential logic bugs.
Infrastructure Hardening
- N/A
User Protection
- N/A
Security Awareness
- Commit the generated DIMENSIONAL_UNITS.md file to version control to improve human and LLM understanding of the project's arithmetic expressions.
Additional IOCs
- File Paths:
DIMENSIONAL_UNITS.md- File generated by the plugin to persist the dimensional vocabulary for the codebase.
- Command Lines:
- Purpose: Add Trail of Bits skills to the Claude plugin marketplace | Tools:
claude| Stage: Installation |claude plugin marketplace add trailofbits/skills - Purpose: Install the dimensional analysis plugin | Tools:
claude| Stage: Installation |claude plugin install dimensional-analysis@trailofbits - Purpose: Execute the dimensional analysis plugin | Tools:
claude| Stage: Execution |claude /dimensional-analysis
- Purpose: Add Trail of Bits skills to the Claude plugin marketplace | Tools:
