Dmytro Khimchenko - Wake Framework - Swiss Knife to Ethereum Tooling

scans and quality check for your code. Uh it's a pleasure to introduce you to the video. Uh I hope you're going to enjoy it. So let's start. Hello Eran.

It's my pleasure to be here to present you V framework. Um who am I? I'm Kimchinko. I'm head of static analysis tooling at Aki blockchain and also uh I'm audit at Aki blockchain or ethereum smart contracts. Uh it's a pleasure to work with uh such clients as a Axelar, Lido and layer zero.

And also uh our company receives grants from Ethereum Foundation, Coinbase, Optimism. And uh some of these grants um is supposed to uh has been like given to us for developing web framework and it is for a reason. Okay, one more time about aim. We are blockchain security auditors. Uh we also love to develop uh opensource tooling and uh we also on board new developers and auditors to our ecosystem.

Uh we are doing it we are teaching in Czech technical university and also uh we teach at school of salam. So let's go into the web framework. Uh it's framework for testing um your smart contracts, your codebase. Uh it is done via unit test and also it can be done via integrational uh testing uh where we want to test also um integrational stuff for example with already um uh deployed contracts on chain and protocols. Also uh with V framework you can fuss uh but um I will speak about it a little bit later.

What's also uh V framework provides it's static analysis. Uh we discover interesting and common attack vectors uh using uh detectors. Uh we have uh some common uh static analysis detectors um and also some specific one for example for um for example with integration of AxelR or specific one um with integration with other protocols also what we have it is printers printers helps us uh to get an idea of code base and to understand it But what it's really nice to have it's language server actually be needed to develop it uh with purpose of enabling uh solidity extension. It is called solidity bake uh you can download it on VS code uh on some marketplaces. Okay.

Uh let's go here to um to compare uh which tools already are um on chain and on community and are developed. Uh this way for example here you can see slitter it is maintained uh it's mainly used for static analysis and detectors but it doesn't have uh another features for example testing another framework it is a um it is used for testing and it is also maintained and it is write writing in python another framework unfortunately ly unmaintained. It is brownie. It is also Pent framework. It is used for testing purposes and also um it provides opportunity to developer to use fuzzing but with the hypothesis plug-in which is not built in in brownie initial.

Also it is hard hat uh which is writing in typescript. It is the maintained and it is used for uh testing uh and not it doesn't have passing another tools another framework it is foundry it is written in rust and it maintain it is maintained it is used for testing it used for ping it's also has um it also enables developer to uh create detectors. But um there is uh no detectors in the current time which is uh written in founder and v framework. It is written in python but also with some parts of this implementation uh implemented in rust. It used for testing.

It is used for buzzing. Also, it has detectors and also it has its own language server that enables uh that gives opportunity to developer to use bake framework uh as an extension. We will talk about B framework capabilities and extension a little bit later. Okay. W stops.

Uh here you can see the table uh that um provides information about which hacks uh has have been found by VM. Um some of them are found by also by puzzing and static analysis. So you can choose which um approach you like better. Let's go for uh let's go to deployment and testing. How it is done.

Here you can see got snippet where you need uh firstly to import packages from deployment. After that uh you need to uh import py types. This is the actually P type Python types for better interaction with contracts because it's uh also enables highlighting uh of these contracts and also it reports when a parameter of uh not valid type is passed uh to the function of um contract. Uh so here we import account from treasure. With framework it is um it is possible to deploy smart contracts directly from uh treasure.

Uh here you can see deploy and u also some information about contracts have been has been deployed. And here uh you can see um testing script. It's a little bit similar and it is intentional to be in this way. Here you can see the difference between them. Here you can in deployment scripts you import B development but in testing scripts you import B and also by types you should import in first and second case and uh also testing it's also pretty similar you import account admin you deploy smart contracts to locally to local chain and uh you assert some assumptions.

So everything is in order and also what is really really nice that we have cheat codes in way that really makes life of developer easier. For example here developer doesn't needs to rewrite some storage variables. it can use mint er and mint tokens to his account. Of course, it's in test environment and after that we can do some assertions. Okay, what's is really cool?

It is called tricks. Here you can see initial goal and you can see sub calls with parameters and uh it's um really effective for debugging session because you don't uh need to iterate over the whole transaction. Uh and in debugging uh you just print uh this transaction and you see all sub quotes and also you can see the place uh where this error could how does look like you run testing script uh with the it is run and uh here you can see that error occurs and uh that we can print uh all call trace of the last transaction has been executed also what is really interesting that you can print uh some Python state also in the back mode. So in this way you can uh get information from uh some testing environments and also from local chain. What about performance?

Uh we decided to test it on unis swap v3 codebase. It's initial is this codebased test initially have been writing in typescript in archet uh yeah and we took it as a uh here you can see some of performance stats we also use different uh let's say background chains local chains as the envir ganache uh with uh different frameworks for example example brownie ape art and yeah and uh here you can see which times it's been segment also u this testing is the open source and you can u found it in python testing framework benchmark on github yeah let's call uh let's talk about fas what is fas it is a random function sequences with random uh inputs. This random can be imagined. Um for example in unit test you uh write specific case and uh verify also on specific case but with fing you can uh do it as a magician. we will see it's not simple.

Um but actually what is passing it's random function sequences. So we run function in a random order with random input parameters to test how codebase reacts in it and how base behaves. Um um please raise your hands who has ever write a pass test or who knows what is passive. Okay, cool. See?

Okay, for example, here you can uh see simple unit uh test where sender is specified uh here and uh receiver also specified and uh also we pass here specific value. So in this case it's 1,000 and after that it is a surfer as commonly used in unit tests. But what we can do with puzzle, we can randomize sender, receiver and amount. We can uh say to our script please uh choose from random accounts that are available uh sender and recipient both. And also you can take random amount from 0 to uh 10,000 and please execute token transfer.

What is interesting it is that this fast test also by default test cases where sender and recipient uh recipient can be the same account and also it tests that amount can be zero. So how uh codebase or smart contracts uh contract reacts when in token transfer value amount is specified to zero. This cases like uh tested by default and sometimes developers just forget to test them in test but with sping it is done by default. Okay. Uh let's go uh to speak about pas performance.

Uh we um took the Dallas benchmark which is initially developed by consensus. It is um uh we run our fuzzing on uh one CPU during uh 20 minutes and uh it has been done on uh five m uh 7 * 7. Yeah. Uh let's see. Uh here you can see uh this cycle with the box that pass test run and try to pop this box.

It can it can left right top bottom and also it has some stop space that it can go like B spaces. Okay. And uh uh this is how this function um in north for example uh looks like. Here is eight parameters that puzzle needs to choose and it's actually passing data here and to find the B. Uh we I will decide if for example this bug has been bumped.

one of this formal. For example, uh pass test needs to be in in um fields x = 5 and epsilon= 3. And also it needs to choose this kind of parameters, this kind of eight parameters that um can pass this all checks. Okay. Yeah.

Here you can see the results um compared with B with BS and with B anvil and with Akidna. Uh here you can see some as the solidity uh VS code extension and uh here what it enables you to do with it. Uh you can deploy smart contracts and interact with them. So it is the remix actually on poly extension on yeah VS code. Yeah.

And uh also what is really really nice and I like that you can uh do uh onchain contract fain you can uh for contracts uh from uh onchain and you don't need to deploy it locally uh it's a web framework does it for you and after that you can um uh play with it you can pass different parameters There also what it does it's vulnerability highlighting um during session um developers uh can see vulnerabilities and don't need to do it after they finish their work on codebase. Also it provides some printers which is uh useful for understanding the codebase and one of the printers it is inheritance graph. Okay. And uh here if you want to try this extension you are welcome and it's on VS code marketplace and here is QR code. Yeah, thank you.

Any questions?

Okay, cool. Guess that's it.

Yeah. Yes. Um yeah, one um Yeah. Um you say about uh part of comparison with testing.

Yeah. Okay. Okay. Okay. Cool.