Package: optik-tools
# OptikOptikis a set of symbolic execution tools that assist smart contract fuzzers, letting them run in a _hybrid_ mode. Optik couples [Echidna](https://github.com/crytic/echidna), our smart contract fuzzer, with the [Maat](https://github.com/trailofbits/maat) symbolic executor that replays the fuzzing corpus and extends it with new inputs that increase coverage.#### Current limitationsOptik is a work in progress and should not be used for real audits yet. Current limitations include:SymbolicKECCAKhashes are not supportedCREATE2,CALLCODE, andDELEGATECALLare not yet supportedGas is not taken into accountSome echidna options are not yet supported (seehybrid-echidna -h)## Hybrid Echidna<p align=”center” >
<img width=”80%” src=”.resources/hybrid_echidna.png”/> <br>
</p>Optik allows to run the [Echidna](https://github.com/crytic/echidna) smart-contract
fuzzer in _hybrid_ mode. It basically couples Echidna with the [Maat](https://github.com/trailofbits/maat) symbolic executor that replays the Echidna corpus and extends it with new inputs that increase coverage.hybrid-echidnastarts with several <i>incremental seeding</i> steps, where it seeds the corpus with short transactions sequences obtained by [Slither](https://github.com/crytic/slither)’sdataflow analysis, and uses symbolic execution more intensely to solve new inputs. The sequence length is incremented at each seeding step. Once it reaches a certain length threshold,hybrid-echidnafalls back into its normal mode, starts to limit the number of symbolic inputs to solve, and stops using dataflow analysis for seeding the corpus.### UsageHybrid echidna can be used seamlessly in place of regular Echidna by replacingechidna-testwithhybrid-echidnain your Echidna command line.
For example:`hybrid-echidnaMyContract.sol--test-modeassertion--corpus-dir/tmp/test--contractMyContract `Additionnal options are available in hybrid mode to controlhybrid-echidna’s behaviour:–max-iters: maximum number of fuzzing iterations to perform (one iteration is one Echidna campaign + one symbolic executor run on the corpus)–solver-timeout: maximum time in milliseconds to spend solving each possible new input–incremental-threshold: number of initial incremental seeding steps to perform–no-incremental: skip initial incremental seeding–cov-mode: type of coverage to increase when solving new inputs. Most coverage modes are implemented for experimental purposes. Unless you are developing/hacking on Optik, we recommend to keep the default modeDebugging, logging and terminal display:–debug: add debugging information to the log output–logs: write logs to a given file (orstdout)–no-display: disable the graphical terminal display## InstallationFor a quick installation, run:`console python3-mpip installoptik-tools`To keep up with the latest features and fixes, install Optik from itsmasterbranch:`console git clonehttps://github.com/crytic/optik&& cd optik python3-mpip install . `You can also run it from Docker:`console git clonehttps://github.com/crytic/optik&& cd optik docker build-tcrytic/optik . docker run-it--rm--mounttype=bind,source="$(pwd)",target=/workdircrytic/optik # This runs the Docker container, mounting the local directory into /workdir `