Skip to content
/ eburger Public

eBurger is a static analysis tool that provides a way to quickly query and analyze solidity smart contracts.

License

Notifications You must be signed in to change notification settings

forefy/eburger

Repository files navigation

Template Based Smart Contracts Static Analyzer

eBurger

eBurger releases eBurger GitHub repo size GitHub Actions Workflow Status eBurger GitHub commit activity GitHub last commit PyPI - Downloads Issues eBurger Jupyter Notebook Templates Playground Forefy Discord Forefy Twitter

Discord | Discussions | Feature request | Wiki | Twitter DM

What is eBurger

eBurger is a static analysis tool that provides a way to quickly query and analyze solidity smart contracts.

Create your template

eBurger YAML Template

Run your template

eBurger YAML Template

Running static analyzers won't win you competitions. What we provide instead with eburger is the ability to spin up custom templates tailored to your current audited project in minutes (Wiki) allowing you to orchestrate unique lookups through the codebase to empower your audits.

How to install

From PyPi

pip3 install eburger
eburger -h

From source

git clone https://github.com/forefy/eburger.git
cd eburger
pip3 install .
eburger -h

How to run

Simple examples

Simplest

cd MyProject/
eburger
cat eburger-output.json

SARIF output

eburger -f MyProject/ -o sarif

Markdown output (running from the project's directory)

eburger -o markdown

Focused scan of a single file and its dependencies

eburger -f ../ProjectToScan/src/SomeContract.sol

Only print nsloc count

eburger -f MyProject/ --nsloc

Run custom YAML templates

eburger -t MyCustomYAMLs/ -f MyProject/

Advanced usage

Refer to the Wiki.

How it looks like

Here's a demo video

eburger.mov

Besides eburger-output.json, above example will also generate extended info under the folder .eburger.

SARIF support

SARIF (Static Analysis Results Interchange Format) is a standard format for static analysis tool results.

To have an interactive GUI open up in VSCode that can organinze and interact with the results found, follow these steps:

  • Install Microsoft's SARIF Viewer VSCode extenstion
  • Run eburger --output sarif
  • From within VSCode, click the resulted eburger-output.sarif file placed in the working directory

This will open an interactive vscode menu with the issues, description, navigation of vulnerable code lines, etc. eburger SARIF view

GitHub Action

CI pipelines are supported via the eburger-action GitHub Action, it helps continuously assessing your code and viewing the raised insights on your repo's security pane.

eburger-action

eburger-action

Visit the action's page for more information.

Contributing templates

Templates can be added by creating new YAML files and either load them with eburger -t mytemplate.yaml . or by placing them under the templates/ directory.

If you prefer playing with eburger on the browser before installation, you can try the dedicated Jupyter notebook instance:

eBurger Jupyter Notebook Templates Playground

If you are using eburger as a python package (installed via pip install), the existing templates location can be found with running pip3 show eburger or by running the tool on a contract and seeing the templates path printed to the console.

For template writing and documentation refer to the Wiki.

Comparison table

Comparison of actively maintained / popular solidity smart contract static analyzers

Static Analyzer Language 2 Minutes to write a custom template with ChatGPT GitHub Action Many findings that are already found before the contest began Would want to eat
eBurger Python
Slither Python
4naly3er TypeScript 🤮
Mythril Python
Aderyn Rust

Forgot one or made a mistake? open a pull request or an issue :)

Features

  • YAML template support to query contract structure and raise insights for any matches
  • Fast learning curve for creating templates, ability to customize templates to the current ongoing audit project
  • Foundry and Hardhat support ❣️
  • SARIF support & VSCode GUI integration
  • GitHub Actions integration through eburger-action
  • Markdown report
  • Quick custom template generation via the eBurger Templates Generator GPT
  • Community and free support via Discord

What is missing

What features would you like to see? let us know!