From 76e415ac02917cc76c7c1508aac3d18baf312d51 Mon Sep 17 00:00:00 2001 From: Bernhard Mueller Date: Mon, 2 Oct 2017 22:56:32 +0700 Subject: [PATCH 1/5] Update README.md --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 11068383..01ae666b 100644 --- a/README.md +++ b/README.md @@ -4,10 +4,6 @@ Mythril is a reverse engineering and bug hunting framework for the Ethereum blockchain. -## Be responsible! - -The purpose of project is to aid discovery of vulnerable smart contracts on the Ethereum mainnet and support research for novel security flaws. If you do find an exploitable issue or vulnerable contract instances, please [do the right thing](https://en.wikipedia.org/wiki/Responsible_disclosure). Also, note that vulnerability branding ("etherbleed", "chainshock",...) is highly discouraged as it will annoy the author and others in the security community. - ## Installation and setup Install from Pypi: @@ -88,9 +84,9 @@ Address: 0x156d5687a201affb3f1e632dcfb9fde4b0128211, balance: 295000000000000000 (...) ``` -Note that "code hash" in the above output refers to the contract's index in the database. The following lines starting with "Address" list the addresses of contract instances in the Ethereum blockchain (all with the same code). +Note that "code hash" in the above output refers to the contract's index in the database. The following lines ("Address: ...") list instances of same contract deployed on the blockchain. -You can then use the `--xrefs` flag to find the addresses of other contracts referenced: +You can then use the `--xrefs` flag to find the addresses of referenced contracts: ``` $ myth --xrefs 07459966443977122e639cbf7804c446 @@ -116,3 +112,7 @@ I'm writing this in my spare time, so contributors would be highly welcome! ## Credit JSON RPC library is adapted from [ethjsonrpc](https://github.com/ConsenSys/ethjsonrpc) (it doesn't seem to be maintained anymore, and I needed to make some changes to it). + +## Act responsibly! + +The purpose of project is to aid discovery of vulnerable smart contracts on the Ethereum mainnet and support research for novel security flaws. If you do find an exploitable issue or vulnerable contract instances, please [do the right thing](https://en.wikipedia.org/wiki/Responsible_disclosure). Also, note that vulnerability branding ("etherbleed", "chainshock",...) is highly discouraged as it will annoy the author and others in the security community. From 30076652e45a8b08c097691548b153a1c558fcfb Mon Sep 17 00:00:00 2001 From: Bernhard Mueller Date: Mon, 2 Oct 2017 22:57:13 +0700 Subject: [PATCH 2/5] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 01ae666b..e1229db8 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ $ cd mythril $ python setup.py install ``` -You also need a [go-ethereum](https://github.com/ethereum/go-ethereum) node that is synced with the network (not that Mythril uses non-standard RPC APIs offered by go-ethereum, so other clients likely won't work). Start the node as follows: +You also need a [go-ethereum](https://github.com/ethereum/go-ethereum) node that is synced with the network (note that Mythril uses non-standard RPC APIs only supported by go-ethereum, so other clients likely won't work). Start the node as follows: ```bash $ geth --rpc --rpcapi eth,admin,debug --syncmode fast From 62e2eadacfc96efeb12b3c50ea74a6df97d1d093 Mon Sep 17 00:00:00 2001 From: Bernhard Mueller Date: Mon, 2 Oct 2017 22:59:22 +0700 Subject: [PATCH 3/5] Update README.md --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index e1229db8..8fb08629 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,8 @@ Processing block 4323000, 3 individual contracts in database (...) ``` +Note that the process doesn't take quite as long as it first seems, as the blocks get smaller towards the beginning of the chain. + The default behavior is to only sync contracts with a non-zero balance. You can disable this behavior with the `--sync-all` flag, but note that this will result in a huge (as in: dozens of GB) database. ## Command line usage From c0de669c22beeaa7d1bbdd91f2c3f9a3ff7010e2 Mon Sep 17 00:00:00 2001 From: Bernhard Mueller Date: Tue, 3 Oct 2017 08:04:02 +0700 Subject: [PATCH 4/5] Update README.md --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 8fb08629..9e0c1040 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ $ geth --rpc --rpcapi eth,admin,debug --syncmode fast ### Database initialization -Mythril builds its own contract database using RPC sync. Unfortunately, this process is slow - however, you don't need to sync the whole blockchain right away. If you abort the syncing process with `ctrl+c`, it will auto-resume the next time you run the `--init-db` command. +Mythril builds its own contract database to enable fast search operations. Unfortunately, this process is slow. You don't need to sync the whole blockchain right away though: If you abort the syncing process with `ctrl+c`, it will be auto-resumed the next time you run the `--init-db` command. ```bash $ myth --init-db @@ -37,9 +37,9 @@ Processing block 4323000, 3 individual contracts in database (...) ``` -Note that the process doesn't take quite as long as it first seems, as the blocks get smaller towards the beginning of the chain. +Note that syncing doesn't take quite as long as it first seems, because the blocks get smaller towards the beginning of the chain. -The default behavior is to only sync contracts with a non-zero balance. You can disable this behavior with the `--sync-all` flag, but note that this will result in a huge (as in: dozens of GB) database. +The default behavior is to only sync contracts with a non-zero balance. You can disable this behavior with the `--sync-all` flag, but be aware that this will result in a huge (as in: dozens of GB) database. ## Command line usage From 84d6d75c2e2435b4e320f36a1ff28d3c80bb2d90 Mon Sep 17 00:00:00 2001 From: Bernhard Mueller Date: Tue, 3 Oct 2017 08:49:49 +0700 Subject: [PATCH 5/5] Update README.md --- README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9e0c1040..5296aaad 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ Mythril is a reverse engineering and bug hunting framework for the Ethereum bloc Install from Pypi: ```bash -$ pip install mythril==0.2.9 +$ pip install mythril==0.2.10 ``` Or, clone the GitHub repo to install the newest master branch: @@ -99,7 +99,10 @@ The command-line search is useful for identifying contracts with interesting opc ## Custom scripts --- TODO: Add example(s) -- +TODO + +- Add examples for static/dynamic analysis +- API documentation ## Issues