Skip to content

Commit fe3def2

Browse files
Add wana code and update README
1 parent 73d6d9d commit fe3def2

13 files changed

+5806
-2
lines changed

.gitignore

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
__pycache__
2+
.vscode
3+
*.txt
4+
.vs/
5+
.idea/
6+
.output/

README.md

+57-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,57 @@
1-
# WANA
2-
A Symbolic Execution Engine for Wasm Bytecode and A Cross-Platform Smart Contract Vulnerability Detector
1+
# WANA
2+
A Symbolic Execution Engine for Wasm Bytecode and A Cross-Platform Smart Contract Vulnerability Detector
3+
4+
## Smart Contract
5+
To evaluate a smart contract, the wasm smart contract is needed. The wasm bytecode file generated from two sources
6+
as following.
7+
8+
+ EOSIO smart contract. Using official development kit, developer could compile cpp or rust source code to wasm
9+
+ Ethereum smart contract. By compiling solidity source code via [soll](https://github.com/second-state/SOLL) or
10+
[solang](https://github.com/hyperledger-labs/solang), developer could get the corresponding wasm file.
11+
12+
Of course, WANA could execute any wasm file other than smart contract. Therefore, any valid wasm file will be
13+
symbolic executed correctly.
14+
15+
## Project Structure
16+
The main components of WANA is as follow.
17+
+ `wana.py` is the entry point, and it read a wasm file or directory include wasm files to symbolic execution.
18+
+ `sym_exec.py` is the logic of symbolic execution, it includes the function-level and instruction-level execution.
19+
+ `bug_analyzer.py` is the vulnerability analysis unit, therefor all record or pattern matching logic are here.
20+
+ `global_variables.py` save states while symbolic execution, includes vulnerability count, loop depth and etc.
21+
+ `bin_format.py` and `bin_reader.py` include bytecode binary representation and reading approach respectively.
22+
+ `structure.py` and `runtime.py` represent WebAssembly bytecode structure and virtual machine runtime structure.
23+
+ `number.py`, `utils.py` and `logger.py` are helper modules.
24+
25+
## Usage
26+
Firstly, the prerequisites in [requirements.txt](./requirements.txt) should be correctly installed.
27+
28+
The following command will analyze the EOSIO smart contract `contract.wasm` with timeout 20 seconds. The `-t` is
29+
optional, the symbolic execution won't be interrupted until complete analysis if `-t` not set.
30+
```bash
31+
python3 wana.py -t 20 -e contract.wasm
32+
```
33+
34+
Using the follow command, WANA will analyze all smart contracts in the directory `contracts_directory`.
35+
```bash
36+
python3 wana.py -a contracts_directory/
37+
```
38+
39+
To analyze Ethereum smart contract, the option `--sol` is needed.
40+
```bash
41+
python3 wana.py --sol -e ethereum_contract.wasm
42+
```
43+
44+
## Input and Output
45+
At present, WANA only support wasm file as its input. The output, namely vulnerability report, is stdout. The output
46+
format is as follow.
47+
```bash
48+
contract.wasm: fake eos found
49+
contract.wasm: forged transfer notification found
50+
```
51+
52+
## Reference Website
53+
1. https://webassembly.org/
54+
2. https://github.com/WebAssembly/
55+
3. https://developer.mozilla.org/en-US/docs/WebAssembly
56+
57+

0 commit comments

Comments
 (0)