Find the failure before someone exploits it.
Exploring how automated checks can uncover ways a smart contract breaks its own rules—before those mistakes become someone else’s opportunity.
Explore how it works ↓Explore the project
Open the design and demonstrations, then follow the references for more detail.
Explore the concept
EVM security analysis workbench and symbolic invariant testing environment with an interactive 4-pane opcode stepper, Anvil state caching, and 103 codified exploit invariants.
The design, in more detail
Definition
An automated 103-invariant formal verification and multi-agent mutation fuzzing engine that uncovers catastrophic economic and state-corruption vulnerabilities in EVM smart contracts.
The problem
Smart contract security audits are historically manual, slow, and non-exhaustive. Static analysis tools generate massive false-positive noise, while naive fuzzers fail to discover complex multi-transaction sequence bugs like sandwich arbitrage, reentrancy flash loans, and cross-contract state desynchronization.
The approach
ChainForge PRO unifies AST static extraction (Slither), symbolic execution (Halmos), and live state RPC mainnet forks (Anvil/Foundry) under an autonomous 103-invariant verification fleet. It continuously generates stateful mutation sequences designed to violate mathematical invariants governing liquidity pools, collateralization ratios, and token balances.
How it works
- AST Extraction: Decompiles bytecode and Solidity ASTs via Slither to map call graphs, internal state transitions, and external dependency points.
- Sub-Second Semantic Triage: Executes 5 offline deterministic AST detectors (< 1s latency, zero API calls) to filter unviable targets before fuzzing.
- Persistent Zero-RPC Air-Gapped Enclave: Proxies live state through an eRPC Redis memory cache to deliver 100% cache hit rates with zero upstream network RPC leakage, preventing mempool sniffing.
- 103 Invariant Fleet & Z3 SMT Prover: Pre-configured battery of mathematical invariants paired with Z3 SMT constraint solving and Halmos symbolic execution to mathematically prove solvency and reentrancy boundaries.
- OllyDbg EVM Stepper (EVM X-Ray): 4-pane interactive opcode stepper with symbolic storage decoding and ghost variable invariant verification.
- Automated Exploit Generation: Automatically outputs executable Foundry test harnesses and Immunefi-ready forensic vulnerability packets.
Project notes
- Invariant Fleet
- 103 Codified Properties
- Offline Triage
- 5 Detectors (< 1s Latency)
- Upstream RPC Cost
- $0.00 (100% eRPC Cache Hit)
These are the project’s documented design notes. Consult the linked implementation and its version before relying on a specific capability.
Development history & next steps
Invariant Catalog Design
Codified standard DeFi invariants across AMMs, lending pools, and cross-chain bridges.
Hybrid Symbolic Pipeline
Integrated Halmos symbolic engine with live mainnet state forking via Anvil.
PRO 103-Invariant Fleet & OllyDbg Stepper
Engineered the 4-pane EVM X-Ray debugger, sub-second semantic triage, and zero-RPC eRPC caching layer.
What comes next
Extending invariant fuzzing coverage to Move and Rust-based Solana programs with zero modifications to target source code.
Source material & related links
Follow the documentation, repositories, and related sites behind this project.
Interactive 4-pane OllyDbg EVM Stepper with symbolic storage layout and ghost invariant tracking.
Theoretical foundations of sub-second AST triage, zero-RPC caching, and SMT constraint solving.
Institutional capability brief for air-gapped simulation enclaves and formal verification.
Complete fuzzing harness, Slither AST adapters, and Halmos invariant specifications.
Topics: EVM · Security · Fuzzing · Formal Verification · Solidity · Foundry · DeFi