Skip to content

Commit db4c8d5

Browse files
committed
Restructure README
1 parent 97af38f commit db4c8d5

File tree

2 files changed

+278
-256
lines changed

2 files changed

+278
-256
lines changed

README.md

Lines changed: 16 additions & 256 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,22 @@ An Analysis Tool for Smart Contracts
1010

1111
*This repository is currently maintained by Thomas Fenninger ([@zariliv](https://github.com/zariliv)). If you encounter any bugs or usage issues, please feel free to create an issue on [our issue tracker](https://github.com/smartbugs/oyente_plus/issues).*
1212

13-
**Oyente+** is a modernized version of the [original Oyente](https://github.com/enzymefinance/oyente) symbolic execution tool for Ethereum smart contracts. It performs a comprehensive security analysis to detect vulnerabilities including reentrancy, integer overflow, timestamp dependence, and more.
13+
**Oyente+** is a modernized version of the [original Oyente](https://github.com/enzymefinance/oyente) symbolic execution tool for Ethereum smart contracts. Oyente and Oyente+ are designed to detect smart-contract weaknesses like reentrancy, integer overflow, and timestamp dependence.
1414

1515
## ✨ Features
1616

17-
- **Symbolic Execution**: Deep analysis using Z3 constraint solving
18-
- **Multi-format Support**: Analyze Solidity source code, EVM bytecode, or remote contracts
19-
- **Modern Python**: Built for Python 3.8+ with comprehensive type hints
20-
- **Comprehensive Testing**: 513 test functions with 100% pass rate and property-based testing
21-
- **Code Quality**: Enforced with Black, Ruff, mypy, and pytest
22-
- **Complete Type Safety**: 0 mypy errors across 15/17 modules
23-
- **Latest EVM Support**: Compatible with recent opcodes (PUSH0, TLOAD, TSTORE)
17+
- **Symbolic Execution**: Deep analysis using the Z3 constraint solver
18+
- **Multi-format Support**: Analyze Solidity source code, EVM bytecode, or remote on-chain contracts
19+
20+
As one of the earliest tools in the field, Oyente has been served as a foundation for extensions and as a reference point for evaluating new approaches. Over time, however, it has become increasingly difficult to use: it cannot analyze newer contracts that rely on EVM instructions introduced after its initial release (for example, the shift opcodes or PUSH0), and it depends on Python 2 and outdated libraries, which complicates installation.
21+
22+
Oyente+ preserves Oyente's analysis capabilities while providing full support for the complete EVM instruction set. The codebase has been ported to Python 3 and updated to follow contemporary software-engineering practices. In particular, Oyente+ offers:
23+
24+
- **Latest EVM Support**: Compatible with recent opcodes (e.g., PUSH0, TLOAD, TSTORE)
25+
- **Modern Python**: Implemented in Python 3.8+ with comprehensive type hints
26+
- **Comprehensive Testing**: 513 test functions with a 100% pass rate, including property-based tests
27+
- **High Code Quality**: Enforced through Black, Ruff, mypy, and pytest
28+
- **Strong Type Safety**: Zero mypy errors across 15 of 17 modules
2429

2530
## 🚀 Quick Start
2631

@@ -60,7 +65,7 @@ make setup
6065
# Virtual environment detection is automatic
6166
```
6267

63-
#### Option 3: Manual Setup
68+
#### Option 3: Manual Setup (Poetry Required)
6469

6570
```bash
6671
# Install all dependencies (development, testing, linting)
@@ -97,8 +102,6 @@ sudo apt-get install solc
97102

98103
## 🔧 Usage
99104

100-
### Command Line Interface
101-
102105
```bash
103106
# Analyze Solidity contract
104107
python oyente/oyente.py -s contract.sol
@@ -116,250 +119,14 @@ python oyente/oyente.py -ru https://example.com/contract.sol
116119
python oyente/oyente.py --help
117120
```
118121

119-
### Development Workflow
120-
121-
```bash
122-
# Format, lint, type-check, and test (run before commits)
123-
make all && pre-commit run -a
124-
125-
# Individual commands
126-
make format # Format with Black
127-
make lint # Check with Ruff
128-
make type-check # Verify with mypy
129-
make test # Run unit tests (excludes integration)
130-
make test-cov # Run tests with coverage
131-
```
132-
133-
## 🧪 Testing
134-
135-
**Status**: 513 test functions executed with 100% pass rate across comprehensive test infrastructure
136-
137-
```bash
138-
# Quick commands
139-
make test # Run unit tests only (default excludes integration)
140-
make test-unit # Unit tests only (explicit)
141-
make test-integration # Integration tests only
142-
make test-cov # Tests with coverage
143-
make all # Format, lint, type-check, test
144-
145-
# Running single tests
146-
make test TEST=tests/unit/test_vulnerability.py # Single test file
147-
make test TEST=tests/unit/test_vulnerability.py::TestReentrancy # Single test class
148-
make test TEST=tests/unit/test_vulnerability.py::TestReentrancy::test_basic_detection # Single test method
149-
150-
# Running single tests with coverage
151-
make test-cov TEST=tests/unit/test_vulnerability.py # Single file with coverage
152-
```
153-
154-
**📋 For detailed testing guide**: See `docs/testing.md`
155-
156-
## 📊 Architecture Overview
157-
158-
### Core Components
159-
160-
- **`oyente/oyente.py`**: Main CLI entry point and configuration
161-
- **`oyente/input_helper.py`**: Input handling for Solidity/bytecode using crytic-compile
162-
- **`oyente/symExec.py`**: Symbolic execution engine with Z3 constraint solving
163-
- **`oyente/vulnerability.py`**: Vulnerability detection classes (100% test coverage ✅)
164-
- **`oyente/ast_helper.py`**: AST processing and contract analysis (comprehensive test coverage ✅)
165-
- **`oyente/analysis.py`**: Analysis state management and vulnerability reporting
166-
167-
### Analysis Flow
168-
169-
1. **Input Processing**: Compile Solidity or parse bytecode
170-
2. **CFG Construction**: Build control flow graph from EVM opcodes
171-
3. **Symbolic Execution**: Explore paths with constraint solving
172-
4. **Vulnerability Detection**: Apply security analysis patterns
173-
5. **Report Generation**: Output findings with source mapping
174-
175-
### Supported Vulnerabilities
176-
177-
- **Reentrancy**: External call state manipulation
178-
- **Integer Overflow/Underflow**: Arithmetic boundary violations
179-
- **Timestamp Dependence**: Block timestamp manipulation
180-
- **Callstack Attack**: Call depth limitations
181-
- **Concurrency Issues**: Transaction ordering dependencies
182-
- **Assertion Failures**: Solidity assert statement violations
183-
184-
## 🛠️ Development
185-
186-
### Project Status
187-
188-
**✅ Completed**:
189-
- **Code Quality**: 0 linting errors (fully resolved from 483)
190-
- **Testing Infrastructure**: 513 tests with 100% pass rate
191-
- **PEP 621 compliant packaging** with Poetry integration
192-
- **Comprehensive pyproject.toml configuration** for all tools
193-
- **Security-first code quality tooling** (Black, Ruff, mypy)
194-
- **Complete test coverage** for core modules
195-
- **Type hints** for 15/17 modules with comprehensive docstrings
196-
- **Robust mocking infrastructure** for Z3, filesystem, and external dependencies
197-
198-
- **Critical Bug Fixes**: Major reliability improvements with 5+ critical bugs fixed
199-
- **Type Safety**: 0 mypy errors - complete type coverage achieved
200-
- **Pre-commit hooks**: Automated quality checks configured
201-
- **CI/CD pipeline**: GitHub Actions with multi-stage testing and automation
202-
203-
### Code Quality Standards
204-
205-
All code must pass these checks before committing:
206-
207-
```bash
208-
make all # Runs format, lint, type-check, test
209-
```
210-
211-
- **Black**: Code formatting (120 char lines)
212-
- **Ruff**: Linting with security focus (Bandit rules)
213-
- **mypy**: Static type checking
214-
- **pytest**: Unit and integration testing
215-
216-
### Contributing Guidelines
217-
218-
1. **Setup Development Environment**:
219-
```bash
220-
./scripts/setup-venv.sh
221-
source venv/bin/activate
222-
```
223-
224-
2. **Make Changes**: Follow existing code patterns and conventions
225-
226-
3. **Run Quality Checks**:
227-
```bash
228-
make all # Must pass before committing
229-
```
230-
231-
4. **Add Tests**: All new functionality requires tests
232-
233-
5. **Documentation**: Update docstrings and README as needed
234-
235-
### Pre-commit Hooks
236-
237-
Automated quality checks run before each commit to ensure consistent code quality:
238-
239-
#### Setup
240-
241-
Pre-commit hooks are automatically installed when using the setup script:
242-
243-
```bash
244-
./scripts/setup-venv.sh # Installs and configures pre-commit hooks
245-
```
246-
247-
Or install manually:
248-
249-
```bash
250-
# Install pre-commit (included in dev dependencies)
251-
poetry install --with dev
252-
253-
# Install the hooks (run once after cloning)
254-
poetry run pre-commit install
255-
```
256-
257-
#### What Runs Automatically
258-
259-
Each commit triggers:
260-
261-
- **File Checks**: Trailing whitespace, file endings, YAML/JSON/TOML syntax
262-
- **Code Formatting**: `make format` (Black formatting)
263-
- **Linting**: `make lint` (Ruff code quality checks)
264-
- **Type Checking**: `make type-check` (mypy static analysis)
265-
- **Unit Tests**: `make test-unit` (fast unit tests)
266-
- **Integration Tests**: `make test-integration` (comprehensive tests)
267-
268-
#### Usage Tips
269-
270-
```bash
271-
# Run manually on all files
272-
poetry run pre-commit run --all-files
273-
274-
# Run specific hooks
275-
poetry run pre-commit run format
276-
poetry run pre-commit run test-unit
277-
278-
# Skip hooks (emergency only)
279-
git commit --no-verify -m "emergency commit"
280-
```
281-
282-
If any check fails, fix the issues and commit again. The hooks ensure all code meets quality standards before entering the repository.
283-
284-
## 🔄 CI/CD Pipeline
285-
286-
### Streamlined Three-Stage Pipeline
287-
288-
The project uses a focused GitHub Actions pipeline with three essential stages:
289-
290-
#### **Pipeline Stages** (< 15 minutes total)
291-
292-
1. **Code Quality** (~5 minutes)
293-
- Black formatting validation
294-
- Ruff linting with security focus
295-
- mypy type checking (0 errors required)
296-
297-
2. **Unit Tests** (~5 minutes)
298-
- Matrix testing across Python 3.8-3.11
299-
- 513 test functions with 100% pass rate
300-
- Coverage reporting via Codecov
301-
302-
3. **Integration Tests** (~10 minutes)
303-
- Real Solidity compilation testing
304-
- End-to-end contract analysis validation
305-
- Sample contract verification
306-
307-
#### **Quality Gates**
308-
309-
All code must pass:
310-
- ✅ 100% test success rate
311-
- ✅ Zero linting errors
312-
- ✅ Zero type checking errors
313-
- ✅ >80% code coverage
314-
315-
#### **Development Integration**
316-
317-
```bash
318-
# Local pipeline simulation (matches CI exactly)
319-
make all # Complete quality check
320-
321-
# Individual stages
322-
make format lint type-check # Code quality
323-
make test-unit # Unit tests
324-
make test-integration # Integration tests
325-
```
326-
327-
**📋 Pipeline Focus**: Streamlined for essential quality gates with fast feedback
328-
329-
### Automated Dependency Management
330-
331-
A separate workflow (`dependencies.yml`) handles dependency updates:
332-
333-
**Weekly Dependency Updates:**
334-
- **Schedule:** Mondays at 8:00 AM UTC
335-
- **Process:** Check outdated dependencies → Update → Test → Create PR
336-
- **Validation:** Full quality checks using `make` targets
337-
- **Output:** Automated pull requests with update summaries
338-
339-
**Manual Trigger:** Available via GitHub Actions UI
340-
341-
**Token Configuration:**
342-
- Uses `GITHUB_TOKEN` (automatically provided by GitHub Actions)
343-
- No manual configuration required
344-
- Permissions: `contents: write`, `pull-requests: write`
345-
346-
## 📈 Performance & Benchmarks
347-
348-
### Performance Testing
349-
350-
Benchmark analysis performance:
351-
352-
```bash
353-
python -m pytest tests/performance/ --benchmark-only
354-
```
355-
356122
### Sample Contracts
357123

358124
The `samples/` directory contains test contracts including:
359125
- `SimpleDAO.sol` - Reentrancy vulnerability
360126
- `EtherLotto.sol` - Randomness issues
361127
- `Government.sol` - Access control patterns
362128

129+
363130
## 📚 Resources
364131

365132
- **Original Paper**: [Oyente: Making Smart Contracts Safer](https://www.comp.nus.edu.sg/~prateeks/papers/Oyente.pdf)
@@ -372,15 +139,8 @@ We welcome contributions! Please:
372139
2. **Submit PRs**: Feel free to send us a PR for changes you want to see!
373140
3. **Follow Standards**: Ensure all quality checks pass with `make all`
374141

375-
### Development Setup
142+
See the [development guide](https://github.com/smartbugs/oyente_plus/development.md) for more information on the architecture of Oyente+ and the development environment.
376143

377-
```bash
378-
git clone https://github.com/smartbugs/oyente_plus.git
379-
cd oyente_plus
380-
./scripts/setup-venv.sh
381-
source venv/bin/activate
382-
make all # Verify everything works
383-
```
384144

385145
[license-badge]: https://img.shields.io/badge/License-GPL%20v3-blue.svg?style=flat-square
386146
[license-badge-url]: ./LICENSE

0 commit comments

Comments
 (0)