Static Code Analysis
Static code analysis is a method of debugging by examining source code before a program is run. It’s done by analyzing a set of code against a set (or multiple sets) of coding rules. Static code analysis and static analysis are often used interchangeably, along with source code analysis.
Static Analysis vs Dynamic Analysis
So, what’s the difference between static analysis and dynamic analysis?
Both types detect defects. The big difference is where they find defects in the development lifecycle. Static analysis identifies defects before you run a program (e.g., between coding and unit testing).
Dynamic code analysis identifies defects after you run a program (e.g., during unit testing). However, some coding errors might not surface during unit testing. So, there are defects that dynamic testing might miss that static code analysis can find.
List of Static and Dynamic Analysis tools
- Mythril: Security analysis tool for EVM bytecode. Supports smart contracts built for Ethereum, Hedera, Quorum, Vechain, Roostock, Tron and other EVM-compatible blockchains.
- Echidna: Echidna is a weird creature that eats bugs and is highly electrosensitive (with apologies to Jacob Stanley)
- MythX™: With MythX, you get increased scalability and performance, continual improvements to our security analysis engines, and higher vulnerability detection than locally-run security tools.
- Slither: Slither is a Solidity static analysis framework written in Python 3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to easily write custom analyses.
- Octopus: Security Analysis tool for WebAssembly module (wasm) and Blockchain Smart Contracts (BTC/ETH/NEO/EOS)
Weakness OSS Classifcation & Test Cases
- SWC-registry: SWC definitions and a large repository of crafted and real-world samples of vulnerable smart contracts.
Further reading
This article originally appeared on lightrains.com
Leave a comment
To make a comment, please send an e-mail using the button below. Your e-mail address won't be shared and will be deleted from our records after the comment is published. If you don't want your real name to be credited alongside your comment, please specify the name you would like to use. If you would like your name to link to a specific URL, please share that as well. Thank you.
Comment via email
