INVARIANT TESTING
23 articles tagged "invariant testing"
Why Invariant Testing Matters for DeFi Security
Unit tests check what you think of. Invariant tests check what you don't. Here's why every DeFi protocol needs invariant testing and how it has saved millions in real engagements.
The Anatomy of a Critical DeFi Bug: Insolvency Through Incorrect Accounting
A single rounding error in share accounting can drain an entire vault. Walk through the anatomy of a real critical DeFi bug and learn why invariant testing is the only reliable way to catch it.
Property Design Patterns for DeFi Lending Protocols
A practical catalog of invariant property patterns for lending protocols — from solvency and utilization bounds to liquidation health checks — with Solidity code for each.
5 Smart Contract Vulnerabilities That Unit Tests Will Never Catch
Unit tests check what you expect. But the most dangerous vulnerabilities hide in the unexpected — cross-function reentrancy, rounding accumulation, and more. Here are five categories unit tests will never catch.
Understanding Rounding Errors in DeFi: How Small Bugs Lead to Big Exploits
In Solidity, there are no decimals — only integers and the illusion of precision. Learn how 1 wei rounding errors compound into protocol-draining exploits and how to defend against them.
From Zero to Fuzzing: A Beginner's Guide to the Chimera Framework
A hands-on beginner tutorial for the Chimera framework. Go from an empty project to running invariant tests with Foundry, Echidna, and Medusa — no prior fuzzing experience required.
Towards the Scientific Audit
Audits today are artisanal. Two auditors reviewing the same code follow different paths and produce different results. This inconsistency is the gap attackers exploit. Here is how we make audits scientific.
AI Smart Contract Audits: Beyond the Hype
Everyone claims AI auditing. Most mean they ran an LLM on your code. Here is what AI-powered smart contract auditing actually looks like when built on top of invariant testing and formal methods.
How to write your first invariant test
A hands-on tutorial that walks you through writing three invariant properties for a simple ERC-20 vault, then running them with Foundry and Echidna. Working test suite in 30 minutes.
Smart contract fuzzing tools compared: Echidna, Medusa, Halmos, and Foundry
Four tools dominate smart contract fuzzing. Each approaches the problem differently, and picking the wrong one wastes time. Here's how to match the right fuzzer to your project — or use all four together.
What is smart contract fuzzing?
Smart contract fuzzing throws millions of random inputs at your contracts to find states that violate your security assumptions. Here's how it works, what it catches, and how to get started.
7 common smart contract fuzzing mistakes (and how to fix them)
Your fuzzer ran for 24 hours and found nothing. That doesn't mean your code is safe — it might mean your campaign was broken. Here are the seven mistakes we see most often and how to fix each one.
How to fuzz ERC-4626 vaults: a step-by-step guide
ERC-4626 defines a clean vault interface and a set of guarantees that are surprisingly easy to break. This guide walks through identifying invariants, writing properties, and running fuzzing campaigns.
Foundry fuzz testing: from basic fuzzing to invariant tests
Foundry's built-in fuzzer goes well beyond what most developers use. This guide covers the full spectrum from basic input fuzzing to stateful invariant tests to bridging into dedicated fuzzing tools.
How to fuzz ERC-6909 multi-token contracts
ERC-6909 is the minimal multi-token standard powering Uniswap v4. This guide walks through identifying invariants, writing properties for per-ID accounting and dual approvals, and running fuzzing campaigns.
How to fuzz ERC-7540 async vaults
ERC-7540 adds async deposit and redemption flows on top of ERC-4626. This guide covers the lifecycle invariants, handler patterns for operator fulfillment, and campaigns that stress the request-claim state machine.
How to fuzz ERC-4337 account abstraction wallets
ERC-4337 wallets validate their own transactions and manage gas accounting. This guide covers the invariants that matter for account abstraction, from signature validation to paymaster solvency.
How to fuzz ERC 2535 diamond proxies: storage, selectors, and upgrades
Diamond proxies delegate calls to multiple facets, and the bugs live in upgrade sequences and storage collisions. This guide covers selector, storage, and loupe invariants with full Chimera properties.
How to fuzz ERC-1155 multi-token contracts
ERC-1155 combines batch operations with mandatory receiver callbacks, creating a reentrancy surface that single-token testing misses. This guide covers the invariants and handler patterns that catch the real bugs.
Flash loan exploits: how they work and how invariant testing catches them
Flash loans let anyone borrow millions for a single transaction. When combined with reentrancy or oracle manipulation, they drain protocols in one block. Here's how invariant testing catches what unit tests can't.
Access control bugs in Solidity: real hacks and property-based defense
A missing modifier. A delegatecall to an untrusted address. Access control bugs have caused some of the largest losses in DeFi history. Here's how to find them with property-based testing.
Halmos symbolic execution for smart contracts: setup, limitations, and when it beats fuzzing
Fuzzers sample randomly. Symbolic execution explores every path. Halmos brings symbolic execution to Foundry — but it's not always the right tool. Here's when it wins and when fuzzing is better.
ZK circuit security: constraint bugs, witness leaks, and audit patterns
ZK circuits aren't programs — they're constraint systems. The bugs look different: under-constrained signals, witness malleability, missing range checks. Here's how to audit them.