Skip to content

Commit 2ae9be3

Browse files
tongshitongshi
authored
[STABLE-7559]: Migrate from Slither to Mythril for static analysis (circlefin#47)
### Summary Migrate from Slither to Mythril for static analysis ### Detail - update Makefile command and update CI - remove Slither relevant configs and add Mythril config - update Readme -- *story*: https://circlepay.atlassian.net/browse/STABLE-7559
1 parent 897f7f8 commit 2ae9be3

File tree

6 files changed

+72
-20
lines changed

6 files changed

+72
-20
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
- name: Setup Python
1616
uses: actions/setup-python@v5
1717
with:
18-
python-version: '3.10'
18+
python-version: '3.10'
1919

2020
- name: Install Node
2121
uses: actions/setup-node@v4
@@ -38,10 +38,53 @@ jobs:
3838
- name: Run v2 Integration Tests
3939
run: make anvil-test-v2
4040

41-
- name: Run Slither
42-
uses: crytic/slither-action@v0.3.0
41+
analyze-message-transmitter:
42+
runs-on: ubuntu-latest
43+
steps:
44+
- name: Check out repository code
45+
uses: actions/checkout@v4
46+
with:
47+
submodules: 'true'
48+
49+
- name: Set up Python
50+
uses: actions/setup-python@v5
4351
with:
44-
fail-on: none
52+
python-version: '3.10'
53+
54+
- name: Run Static Analysis on Message Transmitter
55+
run: make analyze-message-transmitter
56+
57+
analyze-message-transmitter-v2:
58+
runs-on: ubuntu-latest
59+
steps:
60+
- name: Check out repository code
61+
uses: actions/checkout@v4
62+
with:
63+
submodules: 'true'
64+
65+
- name: Set up Python
66+
uses: actions/setup-python@v5
67+
with:
68+
python-version: '3.10'
69+
70+
- name: Run Static Analysis on Message Transmitter V2
71+
run: make analyze-message-transmitter-v2
72+
73+
analyze-token-messenger-minter:
74+
runs-on: ubuntu-latest
75+
steps:
76+
- name: Check out repository code
77+
uses: actions/checkout@v4
78+
with:
79+
submodules: 'true'
80+
81+
- name: Set up Python
82+
uses: actions/setup-python@v5
83+
with:
84+
python-version: '3.10'
85+
86+
- name: Run Static Analysis on Token Messenger Minter
87+
run: make analyze-token-messenger-minter
4588

4689
scan:
4790
needs: lint-and-test

‎Makefile‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ deploy-address-utils-external:
5353

5454
anvil:
5555
docker rm -f anvil || true
56-
@${ANVIL} "anvil --host 0.0.0.0 -a 13 --code-size-limit 250000"
56+
@${ANVIL} "anvil --host 0.0.0.0 -a 13 --code-size-limit 250000"
5757

5858
anvil-test: anvil
5959
pip3 install -r requirements.txt
@@ -71,10 +71,21 @@ cast-call:
7171

7272
cast-send:
7373
@docker exec anvil cast send ${contract_address} "${function}" --rpc-url http://localhost:8545 --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
74-
74+
7575
clean:
7676
@${FOUNDRY} "forge clean"
7777

78-
analyze:
79-
pip3 install -r requirements.txt
80-
slither .
78+
analyze-message-transmitter:
79+
pip3 install mythril==0.24.8
80+
myth -v4 analyze src/MessageTransmitter.sol --solc-json mythril.config.json --solv 0.7.6
81+
82+
analyze-message-transmitter-v2:
83+
pip3 install mythril==0.24.8
84+
myth -v4 analyze src/v2/MessageTransmitterV2.sol --solc-json mythril.config.json --solv 0.7.6
85+
86+
analyze-token-messenger-minter:
87+
pip3 install mythril==0.24.8
88+
myth -v4 analyze src/TokenMessenger.sol --solc-json mythril.config.json --solv 0.7.6
89+
myth -v4 analyze src/TokenMinter.sol --solc-json mythril.config.json --solv 0.7.6
90+
myth -v4 analyze src/v2/TokenMessengerV2.sol --solc-json mythril.config.json --solv 0.7.6
91+
myth -v4 analyze src/v2/TokenMinterV2.sol --solc-json mythril.config.json --solv 0.7.6

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ Run `yarn lint` to lint all `.sol` files in the `src` and `test` directories.
4747

4848
### Static analysis
4949

50-
Run `make analyze` to set up Python dependencies from `requirements.txt` and run Slither on all source files, requiring the foundry cli to be installed locally. If all dependencies have been installed, alternatively run `slither .` to run static analysis on all `.sol` files in the `src` directory.
50+
Run `make analyze-{message-transmitter | message-transmitter-v2 | token-messenger-minter}` to set up Mythril dependency and run Mythril on all source files. If Mythril dependency has been installed, alternatively run `myth -v4 analyze $FILE_PATH --solc-json mythril.config.json --solv 0.7.6` to run static analysis on a `.sol` file at the given `$FILE_PATH`. Please note that this can take several minutes.
5151

5252
### Continuous Integration using Github Actions
5353

‎mythril.config.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"remappings": [
3+
"@memview-sol/=lib/memview-sol/",
4+
"@openzeppelin/=lib/openzeppelin-contracts/",
5+
"ds-test/=lib/ds-test/src/",
6+
"forge-std/=lib/forge-std/src/"
7+
]
8+
}

‎requirements.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ requests==2.28.1
3434
rlp==2.0.1
3535
semantic-version==2.10.0
3636
six==1.16.0
37-
slither-analyzer==0.8.3
3837
toolz==0.12.0
3938
urllib3==1.26.11
4039
varint==1.0.2

‎slither.config.json‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

0 commit comments

Comments
 (0)