Name: mythril
Owner: ConsenSys
Description: Security analysis tool for Ethereum smart contracts
Created: 2017-09-18 04:14:20.0
Updated: 2018-01-15 00:24:15.0
Pushed: 2018-01-15 03:43:58.0
Size: 1779
Language: Python
GitHub Committers
| User | Most Recent Commit | # Commits |
|---|
Other Committers
| User | Most Recent Commit | # Commits |
|---|
Mythril is a security analysis tool for Ethereum smart contracts. It uses concolic analysis to detect various types of issues. Use it to analyze source code or as a nmap-style black-box blockchain scanner (an “ethermap” if you will).
Install from Pypi:
p3 install mythril
Or, clone the GitHub repo to install the newest master branch:
t clone https://github.com/b-mueller/mythril/
mythril
thon3 setup.py install
Note that Mythril requires Python 3.5 to work.
Whenever you disassemble or analyze binary code, Mythril will try to resolve function names using its local signature database. The database must be provided at ~/.mythril/signatures.json. You can start out with the default file as follows:
dir ~/.mythril
~/.mythril
et https://raw.githubusercontent.com/b-mueller/mythril/master/signatures.json
When you analyze Solidity code, new function signatures are added to the database automatically.
Run myth -x with one of the input options described below to run the analysis. This will run the Python modules in the /analysis/modules directory.
Mythril detects a range of security issues, including integer underflows, owner-overwrite-to-Ether-withdrawal, and others. However, the analysis will not detect business logic issues and is not equivalent to formal verification.
In order to work with Solidity source code files, the solc command line compiler needs to be installed and in path. You can then provide the source file(s) as positional arguments, e.g.:
th -x myContract.sol
Alternatively, compile the code on Remix and pass the runtime binary code to Mythril:
th -x -c "0x5060(...)"
If you have multiple interdependent contracts, pass them to Mythril as separate input files. Mythril will map the first contract to address “0x0000(..)“, the second one to “0x1111(…)“, and so forth (make sure that contract addresses are set accordingly in the source). The contract passed in the first argument will be executed as the “main” contract.
th -x myContract.sol myLibrary.sol
When analyzing contracts on the blockchain, Mythril will by default query a local node via RPC. You can override the RPC settings with the --rpchost, --rpcport and --rpctls arguments. There are also several built-in presets (run the myth command line tool to get the full list).
If you don't have a node available, use the INFURA preset:
th --infura-mainnet -x -a 0x5c436ff914c458983414019195e0f4ecbef9e6dd
If you are planning to do batch operations or use the contract search features, running a go-ethereum node is recommended. Start your local node as follows:
th --rpc --rpcapi eth,debug --syncmode fast
Specify the target contract with the -a option:
th -x -a 0x5c436ff914c458983414019195e0f4ecbef9e6dd -v1
Adding the -l flag will cause Mythril to automatically retrieve dependencies, such as library contracts:
yth -x -a 0xEbFD99838cb0c132016B9E117563CB41f2B02264 -l -v1
The maximum recursion depth for the symbolic execution engine can be controlled with the --max-depth argument. The default value is 12. Lowering this value reduces the analysis time as well as the coverage / number of explored states.
th --infura-mainnet -x -a 0x5c436ff914c458983414019195e0f4ecbef9e6dd --max-depth 8
The -g FILENAME option generates an interactive jsViz graph:
th --infura-mainnet -g ./graph.html -a 0x5c436ff914c458983414019195e0f4ecbef9e6dd --max-depth 8
~~The “bounce” effect, while awesome (and thus enabled by default), sometimes messes up the graph layout.~~ Try adding the --enable-physics flag for a very entertaining “bounce” effect that unfortunately completely destroys usability.
Mythril builds its own contract database to enable fast search operations. This enables operations like those described in the legendary “Mitch Brenner” blog post in ~~seconds~~ minutes instead of days. Unfortunately, the initial sync process is slow. You don't need to sync the whole blockchain right away though: If you abort the syncing process with ctrl+c, it will be auto-resumed the next time you run the --init-db command.
th --init-db
ting synchronization from latest block: 4323706
essing block 4323000, 3 individual contracts in database
)
The default behavior is to only sync contracts with a non-zero balance. You can disable this behavior with the --sync-all flag, but be aware that this will result in a huge (as in: dozens of GB) database.
The search feature allows you to find contract instances that contain specific function calls and opcode sequences. It supports simple boolean expressions, such as:
th --search "func#changeMultisig(address)#"
th --search "code#PUSH1 0x50,POP#"
th --search "func#changeMultisig(address)# and code#PUSH1 0x50#"
You can read the contents of storage slots from a deployed contract as follows.
th --storage 0 -a "0x76799f77587738bfeef09452df215b63d2cfb08a"
00000000000000000000000000000000000000000000000000000000000003
Use the -d flag to disassemble code. The disassembler accepts a bytecode string or a contract address as its input.
th -d -c "0x6060"
SH1 0x60
Specifying an address via -a ADDRESS will download the contract code from your node.
th -d -a "0x2a0c0dbecc7e4d658f48e01e3fa353f44050c208"
SH1 0x60
SH1 0x40
TORE
)
- FUNCTION safeAdd(uint256,uint256) -
CALLVALUE
ISZERO
It is often useful to find other contracts referenced by a particular contract. E.g.:
th --search "code#DELEGATECALL#"
hed contract with code hash 07459966443977122e639cbf7804c446
ess: 0x76799f77587738bfeef09452df215b63d2cfb08a, balance: 1000000000000000
th --xrefs -a 0x76799f77587738bfeef09452df215b63d2cfb08a
8728e316bbeb692d22daaab74f6cbf2c4691
To print the Keccak hash for a given function signature:
th --hash "setOwner(address)"
af4035
JSON RPC library is adapted from ethjsonrpc (it doesn't seem to be maintained anymore, and I needed to make some changes to it).
The signature data in signatures.json was initially obtained from the Ethereum Function Signature Database.
Many features, bugfixes and analysis modules have been added by contributors.