I'm looking for the best value affordable code checkers to find vulnerabilities in solidity code. I came across on Mythril[1] but I wonder which other products are used.
-
1We have made a review and benchmark of the following tools: Manticore, Mythril, Oyente, Slither, SmartCheck, Solhint, Solium, SonarSolidity. In no way they replace human auditors but they can help in the process. The reviews are available at blog.coinfabrik.com/smart-contract-auditing-human-vs-machine and blog.coinfabrik.com/auditing-solidity-code-with-slither– sw.Commented Dec 30, 2018 at 14:28
Add a comment
|
7 Answers
Here's a few tools from ConsenSys' Best Practices, all are open source:
Static Analysis
- Manticore - Dynamic binary analysis tool with EVM support
- Mythril - Reversing and bug hunting framework for the Ethereum blockchain
- Oyente - Analyze Ethereum code to find common vulnerabilities, based on this paper.
- Solgraph - Generates a DOT graph that visualizes function control flow of a Solidity contract and highlights potential security vulnerabilities.
Test Coverage
- solidity-coverage - Code coverage for Solidity testing.
Linters
Linters improve code quality by enforcing rules for style and composition, making code easier to read and review.
- Solcheck - A linter for Solidity code written in JS and heavily inspired by eslint.
- Solint - Solidity linting that helps you enforce consistent conventions and avoid errors in your Solidity smart-contracts.
- Solium - Yet another Solidity linting.
- Solhint - A linter for Solidity that provides both Security and Style Guide validations.
answered Nov 25, 2017 at 20:08
Try SmartCheck. It is the static code analyzer. It checks the smart contract code written in Solidity for security vulnerabilities and bad practices. SmartCheck is free to use, it doesn't need the installation. We are using it in our work.
There is a tool for formal verification called Securify, developed by ETH Zürich. It checks for common security vulnerabilities.
Currently, this requires permission to redistribute your code.
-
Probably good to note that this requires you to grant permission to the company to redistribute your code. Commented Dec 23, 2018 at 20:24
-
@MikeShultz sorry, this was not the case, when I answered the question. I editet the answer!– EknoesCommented Dec 23, 2018 at 20:57
Take a look at this github project for Solidity Smart Contracts https://github.com/raineorshine/solgraph it generates a DOT graph that visualizes function control flow of a Solidity contract and highlights potential security vulnerabilities.
There is also a SonarQube community analyzer for Solidity.
SonarSolidity has rules that support Solidity’s best practices and track security vulnerabilities and code smell issues.
I have already analyzed some open source projects and very interesting issues were found.
So, I would like to invite anyone interested to take advantage of SonarSolidity’s value.
Feedback is very much appreciated.
Cheers.
Mythril is by far the best tool available, takes some getting used to though.
Great introduction and overview:
#HITB2018AMS D1T2 - Smashing Ethereum Smart Contracts for Fun and ACTUAL Profit - Bernhard Mueller
