What is Aderyn?

Aderyn is an open-source public good developer tool. It is a Rust-based solidity smart contract static analyzer designed to help protocol engineers and security researchers find vulnerabilities in Solidity code bases.

You can read the Cyfrin official documentation for an in-depth look at Aderyn's functionalities.

There is also an officially supported VSCode extension for Aderyn. Download from the Visual Studio Marketplace and start identifying vulnerabilities in your Solidity code with ease.

Features

• Off the shelf support for Foundry projects.
• Off the shelf support for Hardhat projects. (Sometimes remappings.txt maybe required)
• Configuration file (aderyn.toml) needed to support custom frameworks.
• Markdown, JSON and Sarif reports

Installation

NOTE Windows users must have WSL installed

Using Cyfrinup

Cyfrinup is the cross platform installation manager for Cyfrin tools.

One time setup.

Run aderyn --version to check the installation.

Run cyfrinup to upgrade everything to the latest version.

Using curl

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cyfrin/aderyn/releases/latest/download/aderyn-installer.sh | bash

Upgrade older versions by running: aderyn-update

Using Homebrew

brew install cyfrin/tap/aderyn

Upgrade older versions by running: brew upgrade cyfrin/tap/aderyn

Using npm

npm install @cyfrin/aderyn -g

Upgrade older versions by (re)running: npm install @cyfrin/aderyn -g

If you are installing with Curl or Homebrew or npm, ensure that the correct version of Aderyn in your path comes from either the Homebrew or npm global packages directory. If an older version exists at ~/.cyfrin/bin/aderyn, remove it using rm -f ~/.cyfrin/bin/aderyn, as this is no longer the default installation location.

Quick Start

Quick Start example with video guide.

cd path/to/solidity/project/root
aderyn

This generates a report.md

See examples using more CLI options here

VS Code extension

Officially supported VSCode extension for Aderyn. Download from Visual Studio Marketplace

Continuous Integration Assistant

Checkout Aderyn CI Assistant in the marketplace. Performs Static analysis on Solidity codebases in CI to catch potential vulnerabilities before committing code.

Contributing & License

Help us build Aderyn 🦜 Please see our contribution guidelines for in-depth developer environment setup and PR approval process. Aderyn is an open-source software licensed under the GPL-3.0 License.

Building a custom Aderyn detector

Aderyn makes it easy to build Static Analysis detectors that can adapt to any Solidity codebase and protocol. This guide will teach you how to build, test, and run your custom Aderyn detectors. To learn how to create your custom Aderyn detectors, checkout the official docs

Solidity AST Generation Backend

Aderyn relies on a custom backend to generate AST for Solidity codebases. It leverages foundry-compilers

Credits

This project exists thanks to all the people who contribute.

Attribution

• Initial inspiration for AST Visitor code from solc-ast-rs.
• Original detectors based on 4naly3er detectors.
• Shoutout to the original king of static analysis slither.