Try our new dimensional analysis Claude plugin

Key Takeaways

• Trail of Bits released a new Claude plugin (dimensional-analysis) designed to find bugs in arithmetic-heavy codebases like smart contracts.
• The plugin uses LLMs to annotate code with dimensional types and mechanically flags mismatches, achieving a 93% recall rate in testing.
• The analysis process consists of four phases: dimension discovery, annotation, propagation, and validation.
• The tool generates a Dimensional Grammar document (DIMENSIONAL_UNITS.md) defining base units (e.g., {L} for Uniswap liquidity, {tok0} for Token 0 amounts) to standardize analysis.

Affected Systems

• Smart contracts
• Blockchain nodes
• Arithmetic-heavy codebases

Attack Chain

This report details a defensive code auditing tool rather than an attack chain. The dimensional-analysis plugin operates in four phases to audit code. First, it performs dimension discovery to identify fundamental base units and saves them to DIMENSIONAL_UNITS.md. Next, subagents annotate the codebase using this vocabulary. Finally, dimensions are propagated across files and validated to mechanically flag mismatches in assignments, arithmetic, and external calls.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided as this article discusses a static analysis and code auditing tool rather than a cyber threat.

Detection Engineering Assessment

EDR Visibility: None — This is a static code analysis tool used during development and auditing, not a runtime threat. Network Visibility: None — The tool operates locally on codebases and interacts with the Claude API, which does not generate network traffic relevant to threat detection. Detection Difficulty: N/A — Not applicable as this is a defensive code auditing tool.

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Monitor for the execution of the Claude CLI tool running the dimensional-analysis plugin to track internal adoption of the security tool by engineering teams.	Process execution logs (Event ID 4688 or Sysmon Event ID 1)	N/A	High (This is a benign developer activity)

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Install and run the dimensional-analysis Claude plugin on arithmetic-heavy codebases like smart contracts to identify potential logic bugs.

Infrastructure Hardening

• N/A

User Protection

• N/A

Security Awareness

• Commit the generated DIMENSIONAL_UNITS.md file to version control to improve human and LLM understanding of the project's arithmetic expressions.

Additional IOCs

• File Paths:
  • DIMENSIONAL_UNITS.md - File generated by the plugin to persist the dimensional vocabulary for the codebase.
• Command Lines:
  • Purpose: Add Trail of Bits skills to the Claude plugin marketplace | Tools: claude | Stage: Installation | claude plugin marketplace add trailofbits/skills
  • Purpose: Install the dimensional analysis plugin | Tools: claude | Stage: Installation | claude plugin install dimensional-analysis@trailofbits
  • Purpose: Execute the dimensional analysis plugin | Tools: claude | Stage: Execution | claude /dimensional-analysis