Echidna Enters a New Era of Symbolic Execution

Echidna Enters a New Era of Symbolic Execution(gustavo-grieco.github.io)

23 points by galapago 271 days ago | 6 comments

mac-monet 267 days ago |

Started using this recently, extremely impressed with this tool's capabilities. The only issue is the TUI is absolutely miserable to use.

One of the biggest pain points for debugging failures that Echidna finds is the path of getting the failure into a forge test that I can replay, and then slowly diagnosing where the bug is stemming from. An alternative path that could be useful is to stream the function call sequence (with the option to disable traces as well) to a file. This would allow easily creating a forge test from it. This file could even be used to generate a test and be diagnosed by a coding agent. Resolving the "last mile" of finding these failures would make the DX absolutely top tier.

hackhomelab 267 days ago | |

What are you missing from the TUI? The latest version has improved it a bit, it's more responsive now and you can navigate around the UI with the keyboard more easily (tab, up/down arrows, and pgup/pgdown). If you don't like it though, you can also use `--format text` for a UI-less experience that just prints things to stdout.

As for converting failures into forge tests, there's multiple tools offering a solution to that problem; check out (in no particular order):

  * the Recon VSCode extension (https://github.com/Recon-Fuzz/recon-extension)
  * fuzz-utils (https://github.com/crytic/fuzz-utils)
  * runes (https://github.com/Enigma-Dark/runes)
  * fuzz_parser (https://github.com/Enigma-Dark/fuzz-trace-parser)

Some of them use the Echidna trace output, while others (like runes and fuzz-utils) take advantage of the fact that Echidna saves these sequences as part of the corpus during runtime (particularly, in the `reproducers` and `reproducers-unshrunk` corpus subdirectories)

mac-monet 266 days ago | | |

Wow these would have saved my team and I a ton of time. Thanks for the links.

For what's missing from the TUI. The fact that the outputs in the main window are not selectable makes it difficult to keep the fuzzer running but copy the call sequence. I have to ctrl+c to get it into my terminal output and copy from there. I think these tools might help here though.

homarp 268 days ago |

echidna is an Ethereum smart contract fuzzer

rich_sasha 268 days ago |

When I saw the headline, I thought the poor creatures are being executed, in a symbolic way.

cwmoore 267 days ago | |

Somehow I read execution as “extinction” and immediately blamed the platypus. Not my area.

* the Recon VSCode extension (https://github.com/Recon-Fuzz/recon-extension) * fuzz-utils (https://github.com/crytic/fuzz-utils) * runes (https://github.com/Enigma-Dark/runes) * fuzz_parser (https://github.com/Enigma-Dark/fuzz-trace-parser)