• Stars
    star
    330
  • Rank 127,657 (Top 3 %)
  • Language
    Python
  • License
    GNU Affero Genera...
  • Created over 6 years ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Simplify Ethereum security analysis and testing

Etheno

Slack Status PyPI version


Etheno is the Ethereum testing Swiss Army knife. It’s a JSON RPC multiplexer, analysis tool wrapper, and test integration tool. It eliminates the complexity of setting up analysis tools like Echidna on large, multi-contract projects.

If you are a smart contract developer, you should use Etheno to test your contracts. If you are an Ethereum client developer, you should use Etheno to perform differential testing on your implementation.

Etheno is named after the Greek goddess Stheno, sister of Medusa, and mother of Echidna—which also happens to be the name of our EVM property-based fuzz tester.

Features

  • JSON RPC Multiplexing: Etheno runs a JSON RPC server that can multiplex calls to one or more clients
    • API for filtering and modifying JSON RPC calls
    • Enables differential testing by sending JSON RPC sequences to multiple Ethereum clients
    • Deploy to and interact with multiple networks at the same time
  • Integration with Test Frameworks like Ganache and Truffle
    • Run a local test network with a single command

Quickstart

Use our prebuilt Docker container to quickly install and try Etheno:

docker pull trailofbits/etheno
docker run -it trailofbits/etheno

NOTE: Many of Etheno's capabilities will require publishing one or more ports and persisting data using volumes as part of the docker run command.

  • To learn about publishing ports, click here
  • To learn more about persisting data using volumes, click here

Alternatively, natively install Etheno in a few shell commands:

# Install system dependencies
sudo apt-get update && sudo apt-get install python3 python3-pip -y

# Install Etheno
pip3 install --user etheno

# Use the Etheno CLI
cd /path/to/a/truffle/project
etheno --ganache --truffle

Usage

Etheno can be used in many different ways and therefore has numerous command-line argument combinations.

Ganache Integration

A Ganache instance can automatically be run within Etheno:

etheno --ganache
  • --ganache-port will set the port on which Ganache is run; if omitted, Etheno will choose the lowest port higher than the port on which Etheno’s JSON RPC server is running
  • --ganache-args lets you pass additional arguments to Ganache
  • --accounts or -a sets the number of accounts to create in Ganache (default is 10)
  • --balance or -b sets the default balance (in Ether) to seed to each Ganache account (default is 1000.0)
  • --gas-price or -c sets the default gas price in wei for Ganache (default is 20_000_000_000)

Running a Ganache instance via Etheno can be used to deploy large, multi-contract projects in tandem with Echidna. To learn more on how to use Echidna and Ganache together, click here.

NOTE: We recommend using the latest version of Ganache (v7.3.2) and Node 16.x. After the upstream bug (see below) is fixed, the Ganache package should be upgraded.

NOTE: Currently, there is an upstream bug in the latest version of Ganache (v7.3.2) that prevents the Etheno integration from working if the contract size that is being tested is very large (trufflesuite/ganache#3332).

JSON RPC Server and Multiplexing

This command starts a JSON RPC server and forwards all messages to the given clients:

etheno https://client1.url.com:1234/ https://client2.url.com:8545/ http://client3.url.com:8888/
  • --port or -p allows you to specify a port on which to run Etheno’s JSON RPC server (default is 8545)
  • --run-publicly allows incoming JSON RPC connections from external computers on the network
  • --debug will run a web-based interactive debugger in the event that an internal Etheno client throws an exception while processing a JSON RPC call; this should never be used in conjunction with --run-publicly
  • --master or -s will set the “master” client, which will be used for synchronizing with Etheno clients. If a master is not explicitly provided, it defaults to the first client listed.
  • --raw, when prefixed before a client URL, will cause Etheno to auto-sign all transactions and submit them to the client as raw transactions

Geth and Parity Integration

A Geth and/or Parity instance can be run as a private chain with

  • --geth or -go for Geth
  • --parity or -pa for Parity

Each will be instantiated with an autogenerated genesis block. You may provide a custom genesis.json file in Geth format using the --genesis or -j argument. The genesis used for each run will automatically be saved to the log directory (if one is provided using the --log-dir option), or it can be manually saved to a location provided with the --save-genesis option.

The network ID of each client will default to 0x657468656E6F (equal to the string etheno in ASCII). This can be overridden with the --network-id or -i option.

EIP and hard fork block numbers can be set within a custom genesis.json as usual, or they may be specified as command-line options such as --constantinople.

Differential Testing

Whenever two or more clients are run within Etheno, the differential testing plugin will automatically be loaded. This plugin checks for a variety of different discrepancies between the clients, such as gas usage differences. A report is printed when Etheno exits.

This plugin can be disabled with the --no-differential-testing option.

Truffle Integration

Truffle migrations can automatically be run within a Truffle project:

etheno --truffle

Additional arguments can be passed to Truffle using --truffle-args.

Logging

By default, Etheno only prints log messages to the console with a log level defaulting to INFO. An alternative log level can be specified with --log-level or -l. You can specify a log file with the --log-file option. In addition, you can provide the path to a logging directory with --log-dir in which the following will be saved:

  • a complete log file including log messages at all log levels;
  • separate log files for each Etheno client and plugin;
  • the genesis file used to instantiate clients;
  • a subdirectory in which each client and plugin can store additional files such as test results;
  • a script to re-run Geth and/or Parity using the same genesis and chain data that Etheno used.

Requirements

  • Python 3.7 or newer

Optional Requirements

  • Node 16.x or newer to install various integrations
  • Ganache 7.3.2 or newer for its associated integrations
  • Truffle for its associated integrations
  • Geth and/or Parity, if you would like to have Etheno run them

Getting Help

Feel free to stop by our Slack channel for help on using or extending Etheno.

License

Etheno is licensed and distributed under the AGPLv3 license. Contact us if you’re looking for an exception to the terms.

More Repositories

1

slither

Static Analyzer for Solidity and Vyper
Python
5,270
star
2

echidna

Ethereum smart contract fuzzer
Haskell
2,714
star
3

building-secure-contracts

Guidelines and training material to write secure smart contracts
Solidity
2,208
star
4

not-so-smart-contracts

Examples of Solidity security issues
Solidity
2,150
star
5

awesome-ethereum-security

A curated list of awesome Ethereum security references
1,318
star
6

evm-opcodes

Ethereum opcodes and instruction reference
1,300
star
7

ethersplay

EVM dissassembler
Python
836
star
8

solc-select

Manage and switch between Solidity compiler versions
Python
747
star
9

blockchain-security-contacts

Directory of security contacts for blockchain companies
400
star
10

pyevmasm

Ethereum Virtual Machine (EVM) disassembler and assembler
Python
353
star
11

rattle

evm binary static analysis
Python
349
star
12

ida-evm

IDA Processor Module for the Ethereum Virtual Machine (EVM)
Python
307
star
13

medusa

Parallelized, coverage-guided, mutational Solidity smart contract fuzzing, powered by go-ethereum
Go
292
star
14

properties

Pre-built security properties for common Ethereum operations
Solidity
281
star
15

crytic-compile

Abstraction layer for smart contract build systems
Python
150
star
16

amarna

Amarna is a static-analyzer and linter for the Cairo programming language.
Python
148
star
17

caracal

Static Analyzer for Starknet smart contracts
Cairo
130
star
18

slither-action

Shell
128
star
19

evm_cfg_builder

EVM CFG recovery
Python
118
star
20

echidna-streaming-series

A 6-part series on how to use Echidna on real-world codebases
Solidity
97
star
21

optik

Optik is a set of symbolic execution tools that assist smart-contract fuzzers
Python
89
star
22

fuzz-utils

A tool to automatically generate Foundry unit test cases from Echidna and Medusa failed properties
Solidity
89
star
23

roundme

Rust
86
star
24

tayt

StarkNet smart contract fuzzer
Python
75
star
25

diffusc

Experimental tool to ease the review of smart contracts upgrades
Solidity
74
star
26

tealer

Static Analyzer for Teal
Python
61
star
27

echidna-action

GitHub Action to run Echidna, the Ethereum smart contract fuzzer
Shell
59
star
28

attacknet

Tool and testing methodology for subjecting blockchain devnets to simulated network and side channel attacks
Go
54
star
29

fluxture

A crawling framework for blockchains and peer-to-peer systems
Python
46
star
30

secureum-medusa

Solidity
43
star
31

echidna-spearbit-demo

Example code for testing using Echidna explained during the Spearbit presentation
Solidity
39
star
32

slither-docs-action

Write documentation for your code in pull requests using Slither and OpenAI.
TypeScript
36
star
33

solana-lints

Lints based on the Sealevel Attacks
Rust
30
star
34

contract-explorer

Visual Studio Code integration for Slither, a Solidity static analysis framework
TypeScript
30
star
35

echidna-parade

Python
28
star
36

trailofbits-security

The Trail of Bits Truffle Security Toolbox
JavaScript
24
star
37

whipstaff

A specification of the CBC Casper consensus protocols written in TLA+ and PlusCal (transpiled to TLA+)
TLA
20
star
38

cloudexec

A general purpose foundation for cloud-based fuzzing and mutation testing jobs
Go
17
star
39

damn-vulnerable-defi-echidna

Solidity
12
star
40

slither-docs-demo

A demo on how to use the slither-docs actions (https://github.com/crytic/slither-docs-action)
Solidity
11
star
41

medusa-geth

A go-ethereum fork enabling additional testing capabilities for medusa
10
star
42

amarna-action

Github action for the Amarna static analyzer
Shell
9
star
43

slightly-smarter-contracts

Python
7
star
44

vscode-starknet-explorer

StarkNet support extension for VSCode. Visualize StarkNet contracts: view storage variables, external and view functions, and events.
TypeScript
6
star
45

solc

4
star
46

fuzz-vs-fv

TypeScript
4
star
47

embark-contract-info

embark-contract-info
JavaScript
3
star
48

addressarrayutils_demo

Demonstration for using echidna to test a Solidity library
Solidity
2
star
49

remix-plugin-8000

JavaScript
2
star
50

ethdam

2
star
51

slither-workshop

Slither workshop (secureum)
Python
1
star
52

slither-lsp

Python
1
star