Security analysis tool for EVM bytecode. Supports smart contracts built for Ethereum, Hedera, Quorum, Vechain, Roostock, Tron and other EVM-compatible blockchains.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
mythril/README.md

81 lines
2.6 KiB

7 years ago
# Mythril
7 years ago
Mythril is a bug hunting tool and framework for the Ethereum blockchain.
7 years ago
7 years ago
## Be responsible!
The purpose of this tool is to aid discovery of vulnerable smart contracts on the Ethereum mainnet and support research for novel security flaws. If you do find an exploitable issue, please [do the right thing](https://en.wikipedia.org/wiki/Responsible_disclosure) and don't exploit or disclose the vulnerability before the funds have been moved.
7 years ago
* Side note: Please do not attempt to brand vulnerabilities with names like "etherbleed" or "chainshock".
7 years ago
7 years ago
## Installation and setup
7 years ago
7 years ago
Install from Pypi:
```bash
$ pip install mythril
```
Or, clone the GitHub repo to install the newest master branch:
7 years ago
```bash
$ git clone https://github.com/b-mueller/mythril/
7 years ago
$ cd mythril
$ python setup.py install
7 years ago
```
7 years ago
You also need a [go-ethereum](https://github.com/ethereum/go-ethereum) node that is synced with the network (not that Mythril uses non-standard RPC APIs offered by go-ethereum, so other clients likely won't work). Start the node as follows:
```bash
$ geth --rpc --rpcapi eth,admin,debug --syncmode fast
```
### Database initialization
7 years ago
Mythril builds its own contract database using RPC sync. Unfortunately, this process is slow - however, you don't need to sync the whole blockchain right away. If you abort the syncing process with `ctrl+c`, it will auto-resume the next time you run the `--init-db` command.
7 years ago
```bash
7 years ago
$ mythril --init-db
7 years ago
Starting synchronization from latest block: 4323706
Processing block 4323000, 3 individual contracts in database
(...)
```
7 years ago
The default behavior is to only sync contracts with a non-zero balance. You can disable this behavior with the `--sync-all` flag, but note that this will result in a very large (multi-gigabyte) database.
7 years ago
7 years ago
## Command line usage
7 years ago
7 years ago
The `mythril` command line tool allows you to easily access most of Mythril's functionality.
### Searching the database
The search feature allows you to find contract instances that contain specific function calls and opcode sequences. It supports simple boolean expressions, such as:
```bash
$ mythril --search "func[changeMultisig(address)]"
$ mythril --search "code[PUSH1 0x50,POP]"
$ mythril --search "func[changeMultisig(address)] and code[PUSH1 0x50,POP]"
```
### Tracing code in the EVM
```
$ ./mythril -d -a "0x3665f2bf19ee5e207645f3e635bf0f4961d661c0"
PUSH1 0x60
PUSH1 0x40
MSTORE
CALLDATASIZE
ISZERO
PUSH2 0x00ac
JUMPI
(...)
```
7 years ago
## Custom static / dynamic analysis
7 years ago
-- TODO --
## Credit
JSON RPC library is adapted from [ethjsonrpc](https://github.com/ConsenSys/ethjsonrpc) (it doesn't seem to be maintained anymore, and I needed to make some changes to it).