# TODO #a friendly name to identify what is being fuzzed. Shown next to the echidna version in the UI projectName: null #select the mode to test, which can be property, assertion, overflow, exploration, optimization testMode: "property" #check if some contract was destructed or not testDestruction: false #psender is the sender for property transactions; by default intentionally #the same as contract deployer psender: "0x10000" #prefix is the prefix for Boolean functions that are properties to be checked prefix: "echidna_" #propMaxGas defines gas cost at which a property fails propMaxGas: 12500000 #testMaxGas is a gas limit; does not cause failure, but terminates sequence testMaxGas: 12500000 #maxGasprice is the maximum gas price maxGasprice: 0 #testLimit is the number of test sequences to run testLimit: 50000 #stopOnFail makes echidna terminate as soon as any property fails and has been shrunk stopOnFail: false #seqLen defines how many transactions are in a test sequence seqLen: 100 #shrinkLimit determines how much effort is spent shrinking failing sequences shrinkLimit: 5000 #coverage controls coverage guided testing coverage: true #format can be "text" or "json" for different output (human or machine readable) #default is interactive if running on an interactive tty or text mode if not format: null #contractAddr is the address of the contract itself contractAddr: "0x00a329c0648769a73afac7f9381e08fb43dbea72" #deployer is address of the contract deployer (who often is privileged owner, etc.) deployer: "0x30000" #sender is set of addresses transactions may originate from sender: ["0x10000", "0x20000", "0x30000"] #balanceAddr is default balance for addresses balanceAddr: 0xffffffff #balanceContract overrides balanceAddr for the contract address balanceContract: 0 #codeSize max code size for deployed contracts (default 0xffffffff) codeSize: 0xffffffff #whether or not to disable running slither (default false, uses slither) disableSlither: false #solcArgs allows special args to solc solcArgs: "" #solcLibs is solc libraries solcLibs: [] #cryticArgs allows special args to crytic cryticArgs: [] #quiet produces (much) less verbose output quiet: false #initialize the blockchain with some predeployed contracts in some addresses deployContracts: [] #initialize the blockchain with some bytecode in some addresses deployBytecodes: [] #whether ot not to fuzz all contracts allContracts: false #timeout controls test timeout settings timeout: null #seed not defined by default, is the random seed #seed: 0 #dictFreq controls how often to use echidna's internal dictionary vs random #values dictFreq: 0.40 maxTimeDelay: 604800 #maximum time between generated txs; default is one week maxBlockDelay: 60480 #maximum number of blocks elapsed between generated txs; default is expected increment in one week # timeout: #campaign timeout (in seconds) # list of methods to filter filterFunctions: [] # by default, blacklist methods in filterFunctions filterBlacklist: true # enable or disable ffi HEVM cheatcode allowFFI: false #directory to save the corpus; by default is disabled corpusDir: null #directory to save coverage reports; by default is disabled coverageDir: null # list of file formats to save coverage reports in; default is all possible formats coverageFormats: ["txt","html","lcov"] # list of glob patterns for files to exclude from coverage reports # patterns are matched against relative paths from the common project root # examples: ["lib/**/*.sol", "test/mocks/**/*"] coverageExcludes: [] # constants for corpus mutations (for experimentation only) mutConsts: [1, 1, 1, 1] # maximum value to send to payable functions maxValue: 100000000000000000000 # 100 eth # URL to fetch contracts over RPC rpcUrl: null # block number to use when fetching over RPC rpcBlock: null # Etherscan API key etherscanApiKey: null # Disable on-chain coverage reports and fetching of sources from Sourcify and Etherscan disableOnchainSources: false # number of workers. By default (unset) its value is the clamp of the number cores between 1 and 4 workers: null # show all events from all the transactions, not just the last one allEvents: false # events server port server: null # whether to add an additional symbolic execution worker symExec: false # number of SMT solvers used in symbolic execution # only relevant if symExec is true symExecNSolvers: 1 # timeout for symbolic execution SMT solver queries # only relevant if symExec is true symExecTimeout: 30 # Number of times we may revisit a particular branching point # only relevant if symExec is true symExecMaxIters: 5 # Number of times we may revisit a particular branching point before we consult the smt solver to check reachability # only relevant if symExec is true symExecAskSMTIters: 1 # List of whitelisted functions for using symbolic exploration # only relevant if symExec is true symExecTargets: null # List the max number of states to explore when using symbolc execution # only relevant if symExec is true symExecMaxExplore: 10 # Select the SMT solver when using symbolic execution. Valid values are: "cvc5", "z3" and "bitwuzla" # only relevant if symExec is true symExecSMTSolver: bitwuzla