Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTest Solidity security by expressing the behavior your contract must preserve, then checking it with both targeted calls and sequences of calls. Use adversarial callbacks to probe reentrancy, test privileged actions with allowed and forbidden callers, and exercise arithmetic at its boundaries. Fuzzing and static analysis can reveal problems, but passing them does not establish that a contract is secure if the properties or explored behavior are incomplete.
Start with properties, not tool output
A useful security test says what must remain true, including after an unexpected caller, callback, or state transition. Adapt the properties to the protocol rather than treating these examples as universal guarantees:
As an Amazon Associate I earn from qualifying purchases.
- No account can withdraw more than its credited share.
- A privileged function rejects callers who lack the required role.
- A paused system cannot perform transitions that are prohibited while paused.
- The contract’s liabilities remain covered according to its accounting model.
Write down the relevant actors, state, and allowed transitions. A property that only checks one call may miss a failure that requires a particular sequence; a property that checks only end-state balances may miss a transient state exposed during an external call.
Pin the build and execution context
Record the exact Solidity compiler version, optimizer and other build settings, dependencies, and EVM target used for the tests. Arithmetic behavior depends on compiler version and whether an expression is inside an unchecked block. Solidity 0.8.17’s versioned security documentation describes checked arithmetic and illustrates overflow with uint8(255) + 1; do not assume that a test result applies to a different build configuration. Solidity’s 0.8.38-develop documentation is a development-version reference, not a stable-release specification.
#1 Best Overall
Test both named scenarios and call sequences
Use ordinary tests for known behaviors and regressions: normal operations, expected reverts, boundary inputs, initialization, role changes, and callback entry points. Then use fuzzing or invariant testing to explore combinations and sequences that a hand-written scenario may not anticipate.
Exercise individual calls first
For each sensitive function, test a valid call, a forbidden caller or input, and the expected resulting state or revert. Check authorization and state-transition rules at initialization, role transfer or revocation, and pause or upgrade transitions where those features exist. A passing test for one caller or one state does not cover the other rows of the authorization matrix.
Then test stateful sequences
Include multiple sender identities and actions that change roles or protocol state. A sequence can expose a problem that isolated calls do not, such as using a stale permission after a role change or reaching a sensitive operation through a different entry point. Foundry invariant testing runs randomized sequences of calls from configured contracts and checks user assertions during the run; its runs and depth settings affect how much of that campaign is explored. Echidna generates arbitrary transaction sequences in an attempt to falsify user-defined Solidity properties.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →How do I test a Solidity contract for reentrancy?
Treat each external contract call as a possible handoff of control. Solidity’s security documentation states: “Any interaction from a contract (A) with another contract (B) and any transfer of Ether hands over control to that contract (B).” The callee may call back before the original operation finishes. This risk is not limited to Ether withdrawals: token callbacks, hooks, apparently trusted contracts that invoke other code, and interactions among multiple contracts can all matter.
Map call edges and sensitive state
List every external call and what state or accounting operation surrounds it. For each edge, identify the invariants that must hold while control is away and after it returns. Include related values such as balances, shares, allowances, debt, and protocol-wide totals—not only the storage variable in the function making the call.
Use an adversarial receiver
- Arrange a test receiver that attempts to call back into the contract from its callback.
- Have it repeat the sensitive action before the original operation completes.
- Also attempt cross-function re-entry: use one entry point to trigger the external call and another entry point that can mutate related state.
- Assert the relevant accounting and permission properties after the operation, including effects across interacting contracts.
Checks-Effects-Interactions is a design guideline: validate inputs and authorization first, write the intended state changes next, and make external interactions last. Apply it where appropriate, and consider a reentrancy guard when the design calls for one. Neither is a substitute for testing the actual invariants and reachable callback paths.
Rank #3
How do I test access control in Solidity?
Build an authorization matrix for every privileged function. Record the required role, the caller expected to succeed, callers expected to fail, and any relevant protocol state. Test both the positive and negative case; a suite that only proves an administrator can act does not show that an ordinary account cannot.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Cover authority changes and indirect paths
- Test initialization exactly once and check who receives initial authority.
- Test role or ownership transfer, including the former holder’s permissions after transfer.
- Test revoked roles and calls made by addresses that never held a role.
- Test pause-related restrictions and other state-dependent permissions.
- For proxy-based systems, test initialization and upgrade-related authority where applicable.
- Inspect public helper functions and other indirect paths that could change authority.
For stateful property testing, encode a property such as “the attacker never becomes owner or gains a privileged capability,” adapted to the contract’s actual role model. Ethereum.org’s Echidna tutorial uses attacker ownership as an example access-control invariant. Include role-changing calls in the generated sequences so the property is tested across transitions, not just in the initial state.
How do I test integer overflow and underflow?
First determine the compiler version and whether each relevant expression uses checked arithmetic or is inside unchecked. Solidity’s default checked arithmetic reverts on overflow and underflow; arithmetic in an unchecked block wraps. Write tests for the intended behavior rather than assuming that a revert or wrap is automatically correct.
Rank #4
Choose boundaries for the actual expression
Test zero and one, maximum representable values, values immediately around limits, signed minimum and maximum, and intermediate computations. Pay particular attention to narrow types and casts, multiplication before division, fees, loop bounds, and accumulated totals. A final value fitting in a storage type does not show that an intermediate expression is safe.
- For checked arithmetic, assert the expected result or revert path, and verify that a required operation cannot leave the protocol stuck.
- For intentional wrapping, assert the exact modulo result and check that the wrap cannot bypass authorization, balance, or supply constraints.
- Exercise division by zero and any application-specific handling of that input.
A checked revert can still be a functional failure if the operation is unavoidable and leaves the system unable to progress. Test the protocol-level outcome as well as the arithmetic expression.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Which testing tools fit these checks?
Use tools for different kinds of evidence rather than treating them as interchangeable security verdicts.
Best Value
| Approach | Useful for | What it does not establish by itself |
|---|---|---|
| Scenario and unit tests | Clear, repeatable cases for known callbacks, unauthorized callers, expected reverts, and boundary values. | Behavior outside the scenarios the authors wrote. |
| Foundry fuzz and invariant testing | Randomized inputs and sequences against user assertions, including stateful accounting or authorization transitions when the harness configures them. | Coverage of actors, targets, calls, or sequences the test setup cannot reach. Campaign breadth depends in part on runs and depth. |
| Echidna | Searching transaction sequences for counterexamples to user-written Solidity properties. | All possible behavior or correctness of a property simply because a run passes. |
| Slither | A static, pattern-based review; its detectors include reentrancy checks with differing scopes and severities. | A contextual judgment about whether a flagged path violates the contract’s actual properties, or a guarantee that unflagged code is safe. |
| Solidity SMTChecker and formal analysis | Checking specified properties under supported modeling assumptions and settings, including some arithmetic and contract properties when tractable. | That the specification captures intended behavior, or that every property and execution model is covered. |
Foundry’s invariant-testing documentation describes randomized call sequences and campaign settings; Echidna’s project documentation explains its property formats and testing modes. Slither’s detector documentation describes detector scope and recommendations. Solidity’s formal-verification guidance emphasizes that a proof can show code fulfills a formal specification, but the specification itself still needs to be checked against intent. Static findings should prompt code-path review, not an automatic conclusion. These approaches complement one another: property-based behavior exploration and pattern-based analysis answer different questions.
Turn every counterexample into a regression test
When a fuzzing campaign or property search finds a failure, preserve the concrete evidence: actors, inputs, preconditions, call order, and state transitions. Reduce the sequence to a readable scenario that still reproduces the violation, add it to the ordinary test suite, and rerun both the regression suite and the relevant campaign. Review whether the property and harness model the behavior the protocol actually intends; a passing campaign only speaks to the properties and paths that were implemented and explored.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
