80 lines
2.4 KiB
Markdown
80 lines
2.4 KiB
Markdown
---
|
||
title: "Echidna（属性化模糊测试）"
|
||
type: concept
|
||
tags: [blockchain, security, smart-contract, fuzzing, property-based-testing]
|
||
sources: [blockchain-security-auditor]
|
||
last_updated: 2026-05-30
|
||
---
|
||
|
||
## Aliases
|
||
- Echidna
|
||
- Echidna Fuzzer
|
||
- Property-Based Fuzzing
|
||
|
||
## Definition
|
||
|
||
Echidna 是一个属性化模糊测试（Property-Based Fuzzing）工具，专门用于智能合约安全测试。它通过随机生成交易序列，持续验证协议定义的不变性（invariants）是否始终成立。当不变性被违反时，Echidna 会生成触发该违规的具体交易序列作为 PoC。
|
||
|
||
## How It Works
|
||
|
||
1. **定义不变性**：用 Solidity 编写断言或属性
|
||
2. **生成随机交易**：Echidna 以随机参数调用合约函数
|
||
3. **监控不变性**：每次状态变更后检查断言
|
||
4. **生成 PoC**：发现违规时输出触发序列
|
||
|
||
## Example Test
|
||
|
||
```solidity
|
||
// SPDX-License-Identifier: MIT
|
||
pragma solidity ^0.8.24;
|
||
|
||
import {Test} from "forge-std/Test.sol";
|
||
import {Vault} from "../src/Vault.sol";
|
||
|
||
contract EchidnaInvariantTest {
|
||
Vault public vault;
|
||
|
||
constructor() {
|
||
vault = new Vault();
|
||
}
|
||
|
||
// 不变性：任何时刻总存款 = 所有用户余额之和
|
||
function echidna_total_deposits_equals_sum() public view returns (bool) {
|
||
return vault.totalDeposits() == vault.getSumOfBalances();
|
||
}
|
||
}
|
||
```
|
||
|
||
## Configuration
|
||
|
||
```yaml
|
||
# echidna-config.yaml
|
||
testMode: assertion # 断言模式
|
||
testLimit: 500000 # 最大测试数
|
||
timeout: 3600 # 超时（秒）
|
||
sender: ["0x000...1", "0x000...2"] # 发送者地址
|
||
```
|
||
|
||
## Relationship to Other Tools
|
||
|
||
| Tool | Method | Strength |
|
||
|------|--------|----------|
|
||
| [[Slither]] | 静态分析 | 快速扫描，规则匹配 |
|
||
| [[Mythril]] | 符号执行 | 深度路径覆盖 |
|
||
| [[Echidna]] | 属性化模糊测试 | 随机交易序列，不变性验证 |
|
||
|
||
- **Echidna** 是 Slither 和 Mythril 的**补充**，不是替代
|
||
- Slither 找规则性漏洞 → Echidna 找逻辑漏洞
|
||
- Foundry 的 `forge invariant` 命令也提供类似功能
|
||
|
||
## Limitations
|
||
|
||
- 不变性定义错误会导致漏报
|
||
- 复杂状态空间难以在合理时间覆盖
|
||
- 需要开发者定义正确的不变性
|
||
|
||
## Connections
|
||
- [[Blockchain-Security-Auditor]] ← uses ← [[Echidna]]
|
||
- [[Foundry]] ← provides invariant testing ← [[Echidna]]
|
||
- [[Formal-Verification]] ← complements ← [[Echidna]]
|