Static & Dynamic analysis tools
Using static and dynamic analysis tools, you can quickly view your code without beta-running it. At the same time, the tools can spot potential security and coding defections by scanning code structure and syntax.
In runtime, the dynamic analysis test software will find out the vulnerable parts, leaked areas and other issues incurred in certain conditions operationally.
1. Slither – For solidity & vyper
Slither is a Python-based static analysis tool designed for Solidity smart contracts and code. It boasts over 92 vulnerability detectors, including reentrancy, boolean equality and unnecessary return values.
Such extensive coverage guarantees Slither a low false-positive rate. Its fast execution and compatibility with CI pipelines are what developers adore about this free smart contract audit tool.
Slither supports various frameworks, including Hardhat, Dapp Tools, and Foundry, and features built-in ‘printers’ for quick reporting. Additionally, its Detector API allows for custom analyses in Python, further boosting auditor efficiency and trust in code security.
- GitHub Stars: 5k ⭐
- Pricing: Free
- Active status: Currently active and constantly updated
2. Manticore – Open-source for EVM bytecode
Manticore is an open-source binary analysis and security audit tool for smart contracts. Its purpose is to help developers and security auditors uncover issues in smart contracts before they are deployed on the blockchain.
Manticore uses symbolic execution to explore all routes of a smart contract and build test cases that can be used to validate the contract’s behavior. From there, the tool also inspects potential security flaws.
Yet, one of the best parts about this free smart contract audit tool is its compatibility with programming languages (Solidity, Vyper, Bamboo) to other building and testing tools such as Truffle and Mythril.
- GitHub Stars: 3.6k ⭐
- Pricing: Free
- Active status: Active, last update Feb 2022
3. Cyfrin – For solidity
Cyfrin‘s commitment to enhancing smart contract security has resulted in the development of Aderyn, an open-source, Rust-based static analyzer capable of detecting and reporting suspected flaws in Solidity-written contracts. The program scans the Abstract Syntax Trees (AST) to identify potential issues.
Aderyn analyzes a smart contract’s codebase automatically and swiftly detects potential vulnerabilities, which are then reported in an easy-to-digest markdown style. It also enables developers to create their own detectors using Nyth, customizing the tool to any codebase.
- GitHub Stars: 272 ⭐
- Active status: Currently active and constantly updated
4. Securify2 – For Ethereum
ChainSecurity and the Ethereum Foundation collaborated to create Securify, a reliable smart contract analysis tool. It can be used to analyze smart contracts created with Solidity version 0.5.8 or later.
The tool provides complete automation for the security analyzer of Ethereum smart contracts, demonstrating if the behavior of a smart contract is safe or harmful.
Here’s the 2 main steps that Securify check your code:
- It analyzes the contract’s dependency structure to extract precise semantic information from the code.
- Examine the compliance and violation patterns to validate your smart contract under various conditions.
Additionally, the tool uses a domain-specific language for its patterns, providing greater flexibility. However, Securify is not able to detect numerical vulnerabilities, such as overflows.
- Active status: Unclear. There has been no update in recent time, but users are still active.
5. Fuzzinglab’s Octopus – For WASM and blockchain smart contracts
Octopus is a vulnerability analysis framework that works with both WebAssembly modules and Blockchain Smart Contracts. Octopus’ major purpose is to make it easier to examine closed-source WebAssembly modules and bytecode for smart contracts, allowing for a better knowledge of their internal characteristics.
While it’s free to use, this smart contract audit tool requires significant computing power, which might cause delays for users with limited hardware resources.
- GitHub Stars: 479 ⭐
- Active status: Unclear. There has been no update in recent time, but users are still active.
6. OpenZeppellin
Despite being a comprehensive platform for developing, deploying and executing smart contracts, Zeppellin’s capabilities for testing is something worthwhile. The platform has a specific audit module called Audit Managers, where you can track issues and see the progress of fixing it.
- Pricing: Free version. $450/month for professional
Fuzzing tools
Fuzz testing is required for all blockchain projects. This technique shows you unforeseen issues that traditional testing might neglect by inputting unexpected or random data and see how the system will react, from there identifying vulnerabilities or weaknesses.
1. Echidna – For Ethereum
Not only is it known for versatility and broad tool set, Echidna also stands out thanks to the property-based fuzzing technique. By subjecting contracts to user-defined predicates, it uncovers vulnerabilities effectively.
At the same time, by using user-defined properties and coverage reporting, this open-source smart contract audit tool on GitHubs can deal with the toughest situations and vulnerabilities.
- GitHub Stars: 2600 ⭐
- Pricing: Free
- Active status: Currently active and constantly updated
2. Medusa – For cross-platform go-Ethereum-based
If you are looking for an experimental fuzz tester, Medusa might be the ultimate choice.
It supports parallelized fuzz testing of smart contracts via the CLI or its Go API (subject to breaking changes), as well as bespoke user-extended testing methodologies.
This smart contract audit tool is currently under development. However, here’s one of the few things you can do with it:
- Parallel fuzzing and testing
- Assertion and property testing
- Mutational value generation
- Coverage collecting
- Coverage-increasing call sequences
- Extensible low-level testing API through events and hooks
Other details:
- GitHub Stars: 259 ⭐
- Active status: Currently active and constantly updated
3. Diligence – Gray-box fuzzing
Diligence Fuzzing is another smart contract fuzz testing tool that had to be included on this list. Developed by Consensys, it’s a fully-fledged smart contract fuzzing as a service platform for Ethereum’s bytecode.
Its auditing technique goes deep into the contract scripts, modifying and testing numerous inputs to find any flaws. Additionally, you can integrate Foundry test to minimize your setup hassles or annotate contracts and prepare testing environment with Scribble
- GitHub Stars: 33 ⭐
- Pricing: Free version. From $250 to $2000 for professionals
- Active status: Currently active and constantly updated
Mutation testing tools
To enhance your test coverage, you can use mutation testing, in which you introduce small and controlled changes to the source code. Then, you can evaluate how the test suite adapts and its effectiveness.
1. SuMo – Open-source for Solidity
Designed for Solidity smart contracts, SuMo will check if its injected minor flaws are found by your test suites or not.
However, the best thing about SuMo is its customization, where you can tailor it to the needs of any project, from traditional operators to Solidity. It also supports Truffle, Hardhat, Brownie, and Foundry projects. The biggest downside of SuMo is that it takes time to run mutation tests, especially for moderately sized projects.
- GitHub Stars: 68 ⭐
- Active status: Unclear. There has been no update in recent time, but users are still active.
2. Certora Gambit and Vertigo
Vertigo is a significant tool for improving the quality and effectiveness of test suites in smart contract development by creating mutants and determining whether the tests can detect potential bugs. Furthermore, it provides an objective statistic known as mutation score to determine the success of test suites in discovering faults.
Gambit, an open-source mutation generator for Solidity, has comparable features. It is multi-purpose and can be used with a variety of verifiers and testing tools.
Code coverage tools
Using code coverage tool to check which parts of your code are tested and not tested. It acts as a quality assurance, measuring the extent to which code is executed when a particular test suite runs.
1. Wasmcov – For wasm projects
Wasmcov is a customized code coverage tool created for WebAssembly (Wasm) environments. It consists of a Rust library and a binary that automates coverage analysis of Wasm executables.
This tool uses powerful LLVM functionality to overcome the constraints of current Wasm compilation procedures. Its major purpose is to give developers exact and efficient code coverage statistics, which is critical for identifying untested code portions and potential vulnerabilities in smart contracts.
A few other things that people love about Wasmcov:
- Its accurate data coverage for host and target environment
- Automatic test coverage analysis
2. Solidity-Coverage – For Solidity smart contracts
Solidity-Coverage, often known as Solcover, is a tool for measuring the test coverage of Ethereum smart contracts written in Solidity. It assists writers in identifying untested pathways in their code.
This smart contract security audit tool simplifies test coverage tracking thanks to automated instrumentation and detailed reporting. First, it modifies source code to include execution markers. Second, it generates comprehensive reports to identify untested parts of the contract.
Solcover offers advanced configuration options for tailored testing experiences, including target testing, custom paths, and JSON object generation.
Despite all the tools, you shouldn’t skip manual auditing
All these above smart contract audit tools are great and surely help you speed up the process, but you shouldn’t rely too much on them.
Most security tools can only detect 20% exploitable bugs of smart contracts. They mostly neglect asset lock, oracle manipulation and logical errors, due to limited capabilities.
Another reason is that these vulnerabilities involve logical thinking and can be affected by non-technical factors such as human, economy, uncommon vulnerabilities and unethical hacks. Machines can’t analyze these situations accurately since they lack nuanced understanding like humans.
What should we do? Well, a good audit should combine manual methods with automated tools. Leveraging smart contracts audit tools to find standard coding mistakes in a large batch in the shortest time. Then, you should involve humans for contextual insights and broader considerations for in-depth analysis.
In cases like these, an experienced smart contract auditor will help. And that’s what we do at Synodus!
Working with many clients in smart contract development and auditing, our team consists of both Blockchain developers and Legal experts. From there, we not only check your contracts’ security and code quality, but also make sure it’s legally binding and protect your benefits.
That’s what a good smart contract audit should be like!
Bonus document: Checklist of dealing with smart contracts hack
To ensure a seamless and high-quality smart contract audit, here are 6 steps you should have:
- Step 1: Understanding the project requirements and the goals of the audit.
- Step 2: Performing Static and Dynamic Code Analysis with automated tools to find bugs in batches and identify the key areas for audit.
- Step 3: Code testing
- Step 4: Using manual method to check your code line-by-line.
- Step 5: Preparing the Initial Audit Report
- Step 6: Creating and Submitting the Final Audit Report
With or without the tools, auditing smart contracts is still a complex challenge. For the best accuracy and making sure you don’t miss anything, here is a detailed checklist and handbook to deal with smart contract hacks!
Wrapping up
Each smart contracts audit tool has unique strengths that address different issues of smart contract security. Remember, the tools are only those tools. The most critical aspect of a successful audit is not the instrument, but the auditor. Including tools in your audit stack will increase your performance, uncover additional vulnerabilities, and streamline your procedures.
