# Introduction

ItyFuzz is the current state-of-the-art fuzz testing tool for smart contracts. To start using ItyFuzz, please check [Installation & Building](/installation-and-building) and [Quickstart](/quickstart).

ItyFuzz requires **no manual effort**. You don't need to write invariants or manually specify the input generation strategy. Users supply contract addresses or bytecode, and ItyFuzz autonomously generates the exploit when vulnerabilities are found. It can be easily integrated into CI/CD pipelines. It is also highly configurable and can test different aspects of smart contracts.

Technically, it leverages formal verification (concolic execution) assisted fuzzing algorithms guided by dataflow patterns and comparisons. ItyFuzz can handle DeFi with complex states and interactions and can find over 100 bugs in real-world smart contracts.

### Statistics and Comparisons

**ItyFuzz in Real-world**

Backtesting on 200 exploited projects, ItyFuzz can generate 109 exploits without manual effort or prior knowledge. More information can be found here.

**ItyFuzz vs (Harvey / Echidna / Foundry)**

On [Daedaluzz Dataset](https://github.com/Consensys/daedaluzz), ItyFuzz can find a similar amount of bugs as Consensys Diligence's Harvey tool and **20-40% more bugs** compared to Echidna and Foundry *without formal verification enabled*. In the meantime, ItyFuzz is also faster to uncover bugs at first.

<figure><img src="/files/g1LiYrQxdESq5rcIUp2q" alt="" width="563"><figcaption><p>ItyFuzz, Foundry, Echidna, and Harvey on Bug Finding Capability</p></figcaption></figure>

More figures can be found here: <https://twitter.com/vwuestholz/status/1654026298476441600>

**ItyFuzz vs SMARTIAN**

Please refer to our research paper: <https://arxiv.org/abs/2306.17135>

### Researches and Publications

Core Algorithm: <https://arxiv.org/abs/2306.17135>

LLM + Fuzzing: <https://scf.so/llm4fuzz.pdf>

Formal Verification (Concolic Testing): <https://mir.cs.illinois.edu/marinov/publications/SenETAL05CUTE.pdf>


# Installation & Building

There are several ways to install ItyFuzz. We recommend using the [ityfuzzup](#ityfuzzup-recommended) script.

### ityfuzzup **(Recommended)**

ityfuzzup is a script that automatically installs all dependencies and installs ItyFuzz.

```bash
curl -L https://ity.fuzz.land/ | bash
ityfuzzup
```

To update ItyFuzz, run `ityfuzzup` again.

### Build from Source

You first need to install Rust through <https://rustup.rs/>

You need to have `libssl-dev` (OpenSSL) and `libz3-dev` installed on your system. On Linux, you probably also need to install Clang >= 12.0.0 and use it for `CC` environment variables.

```bash
# Ubuntu:
sudo apt install libssl-dev libz3-dev pkg-config cmake build-essential clang
# macOS:
brew install openssl z3
```

Then, you can use `cargo` to build ItyFuzz. This can take seconds to hours depending on the amount of your CPU cores and memory.

```bash
git clone https://github.com/fuzzland/ityfuzz.git && cd ityfuzz
git submodule update --recursive --init
cargo build --release
```

This would create an executable at `target/release/ityfuzz`. This executable only supports offchain fuzzing (i.e., fuzzing without interacting with the blockchain). To build an executable for onchain fuzzing, run:

```bash
cargo build --release --features flashloan_v2
```

If you are developing ItyFuzz, you can create a debug build (much slower than release builds) and add the following useful features, which will enable more logs and assertions:

```bash
cargo build --features flashloan_v2,debug,flashloan_debug
```


# Quickstart

ItyFuzz supports offchain (local) fuzzing and onchain (fork) fuzzing for EVM and Move smart contracts.

## Onchain Fuzzing (EVM)

To run an onchain fuzzing campaign, specify the target contract and the chain to fork.

<pre class="language-bash"><code class="lang-bash"><strong># -t [TARGET_ADDR]: specify the target contract
</strong># --onchain-block-number [BLOCK]: fork the chain at block number [BLOCK]
# -c [CHAIN_TYPE]: specify the chain

ityfuzz evm\
    -t [TARGET_ADDR]\
    --onchain-block-number [BLOCK]\
    -c [CHAIN_TYPE]\
    --onchain-etherscan-api-key [Etherscan API Key] # (Optional) specify your etherscan api key
</code></pre>

For example, to run an onchain fuzzing campaign on Ethereum targeting WETH, run:

```bash
# -t [TARGET_ADDR]: specify the target contract
# --onchain-block-number [BLOCK]: fork the chain at block number [BLOCK]
# -c [CHAIN_TYPE]: specify the chain
# -f: (Optional) allow attack to get flashloan

ityfuzz evm\
    -t 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2\
    --onchain-block-number 0\
    -c ETH\
    --onchain-etherscan-api-key [Etherscan API Key]\
    -f
```

ItyFuzz would pull the ABI of the contract from Etherscan and fuzz it. If ItyFuzz encounters an unknown slot in the memory, it will pull the slot from chain RPC. If ItyFuzz encounters calls to an external unknown contract, it will pull the bytecode and ABI of that contract. If its ABI is unavailable, ItyFuzz will decompile and get the ABI.

## Offchain Fuzzing (EVM)

To run a local fuzzing campaign, specify the target contract (only needs bytecode and ABIs).

```bash
# -t [BUILD DIRECTORY GLOB]: specify the targets directory
# -f: (Optional) allow attack to get flashloan
# --concolic: (Optional) enable concolic execution
# --concolic-caller: (Optional) enable concolic execution to change caller to anyone

ityfuzz evm\
    -t "[BUILD DIRECTORY GLOB]"\
    -f\
    --concolic --concolic-caller
```

For example, run a simple fuzzing campaign on a compiled single contract:

```bash
ityfuzz evm -t './build/*'
```

ItyFuzz would attempt to deploy all artifacts in the directory to a blockchain with no other smart contracts.

Specifically, the project directory should contain a few `[X].abi` and `[X].bin` files. For example, to fuzz a contract named `main.sol`, you should ensure `main.abi` and `main.bin` exist in the project directory. The fuzzer will automatically detect the contracts in the directory and the correlation between them (see [`tests/evm/multi-contract`](https://github.com/fuzzland/ityfuzz/tree/master/tests/evm/multi-contract)), and fuzz them.

Optionally, if ItyFuzz fails to infer the correlation between contracts, you can add a `[X].address`, where `[X]` is the contract name to specify the address of the contract.

To define a custom invariant, check out Custom Invariant or Echidna / Scribble Support.

**Caveats:**

* Remember that ItyFuzz is fuzzing on a clean blockchain, so you should ensure all related contracts (e.g., ERC20 token, Uniswap, etc.) are deployed to the blockchain before fuzzing.
* If your smart contract requires constructor arguments, please refer to the Constructor Arguments section.

## Offchain Fuzzing (MoveVM)

> Move support is still under development. Please contact us if you want to try it out.

Compile the contracts with `sui move build` and run ItyFuzz:

```bash
# build example contract that contains a bug
cd ./tests/move/share_object
sui move build

# get back to ItyFuzz and run fuzzing on the built contract
cd ../../../
ityfuzz move -t "./tests/move/share_object/build"

```

#### Defining Invariants

You can emit an event of `AAAA__fuzzland_move_bug` in your contract to report a condition when the bug is found.

```rust
// define the event struct
use sui::event;

struct AAAA__fuzzland_move_bug has drop, copy, store {
    info: u64
}

... 
    // inside function
    event::emit(AAAA__fuzzland_move_bug { info: 1 });
...

```

An example contract that reports a bug can be found in [`tests/move/share_object/sources/test.move`](https://github.com/fuzzland/ityfuzz/tree/master/tests/move/share_object).


# \[Exp] Hacking BEGO

BEGO on Binance Smart Chain has a bug in the contract allowing arbitrary mint.

Full exploit: <https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/BEGO_exp.sol>

### Using ItyFuzz to Solve

BEGO contract that is vulnerable:

* [0xc342774492b54ce5F8ac662113ED702Fc1b34972](https://bscscan.com/address/0xc342774492b54ce5F8ac662113ED702Fc1b34972)

The contracts are exploitable before block number 22315678. We'll fork the chain at block number 22315678 and let ItyFuzz find the exploit.

To conduct an ItyFuzz campaign, run the following command:

```
ityfuzz evm\
 -t 0xc342774492b54ce5F8ac662113ED702Fc1b34972\
 -f -c BSC\
 --onchain-block-number 22315678\
 --onchain-etherscan-api-key <your etherscan api key> # (Optional) specify your BSC etherscan api key
```


# \[Exp] Hacking AES

AES on Binance Smart Chain has experienced a price manipulation attack requiring flash loan. It is one of the most complex attacks we have seen so far.

Full exploit: <https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/AES_exp.sol>

### Using ItyFuzz to Solve

AES LP contract that is vulnerable:

* [0x40eD17221b3B2D8455F4F1a05CAc6b77c5f707e3](https://bscscan.com/address/0x40eD17221b3B2D8455F4F1a05CAc6b77c5f707e3)

The contracts are exploitable before block number 23695904. We'll fork the chain at block number 23695904 and let ItyFuzz find the exploit.

To conduct an ItyFuzz campaign, run the following command:

```bash
ityfuzz evm\
 -t 0x40eD17221b3B2D8455F4F1a05CAc6b77c5f707e3\
 -f -c BSC\
 --onchain-block-number 23695904\
 --onchain-etherscan-api-key <your etherscan api key> # (Optional) specify your BSC etherscan api key

```


# \[CTF] Verilog CTF (Onchain)

### Introduction

Source code of the challenge: <https://github.com/Verilog-Solutions/CTF-2022-wMaticV2>

The project consists of a buggy WMATICv2 token contract containing a function `redeem` allowing reentrancy attack. Additionally, there is a `Bounty.sol` contract, which rewards the first person who successfully calls its `getBounty` function.

There are two trackers of the total supply of WMATICv2 tokens and our goal is to successfully call `getBounty`, which requires these two trackers to be significantly deviated.

Below is the intended solution that conducts flash loan and reentrancy attacks:

```
0. Borrow k MATIC such that k > balance() / 10
1. depositMATIC() with k MATIC
2. redeem(k * 1e18) -- reentrancy contract --> getBounty()
3. Return k MATIC
```

### Using ItyFuzz to Solve

Here are the contracts we are interested in:

* WMATICV2: [0x5d6c48f05ad0fde3f64bab50628637d73b1eb0bb](https://polygonscan.com/address/0x5d6c48f05ad0fde3f64bab50628637d73b1eb0bb)
* Bounty: [0xbcf6e9d27bf95f3f5eddb93c38656d684317d5b4](https://polygonscan.com/address/0xbcf6e9d27bf95f3f5eddb93c38656d684317d5b4)

The contracts are exploitable before block number 35690977. We'll fork the chain at block number 35690976 and let ItyFuzz find the exploit.

To conduct an ItyFuzz campaign, run the following command:

```bash
ityfuzz evm\
 -t 0x5d6c48f05ad0fde3f64bab50628637d73b1eb0bb,0xbcf6e9d27bf95f3f5eddb93c38656d684317d5b4\
 -f -c POLYGON\
 --onchain-block-number 35690976\
 --onchain-etherscan-api-key <your etherscan api key> # (Optional) specify your Polygon etherscan api key
```

Optionally, you can also use your RPC instead of the default public RPC by setting environment variable `ETH_RPC_URL`. For instance, to use your local RPC, run:

```bash
export ETH_RPC_URL=http://polygon_rpc.xxx.com
```

After a few seconds to minutes, you should see ItyFuzz exit with the full exploit to take the fund.


# \[CTF] Verilog CTF (Offchain)

### Introduction

Source code of the challenge: <https://github.com/Verilog-Solutions/CTF-2022-wMaticV2>

The project consists of a buggy WMATICv2 token contract containing a function `redeem` allowing reentrancy attack. Additionally, there is a `Bounty.sol` contract, which rewards the first person who successfully calls its `getBounty` function.

There are two trackers of the total supply of WMATICv2 tokens and our goal is to successfully call `getBounty`, which requires these two trackers to be significantly deviated.

Below is the intended solution that conducts flash loan and reentrancy attacks:

```
0. Borrow k MATIC such that k > balance() / 10
1. depositMATIC() with k MATIC
2. redeem(k * 1e18) -- reentrancy contract --> getBounty()
3. Return k MATIC
```

### Using ItyFuzz to Solve

We have modified some code to make it easier to deploy: <https://ityfuzz.assets.fuzz.land/verilog.zip>

**Step 1: Add Invariants**

Download the above contracts and modify the contracts to insert an invariant, determining whether the logic breaks. Here, the logic holds if the two trackers are equal and break otherwise.

Modify `Bounty.sol` as follows:

```solidity
...

+ event AssertionFailed(string message);

function getBounty() public returns (bool) {
    uint256 delta = WMATICV2.totalSupply() >= WMATICV2.balance()
        ? WMATICV2.totalSupply() - WMATICV2.balance()
        : WMATICV2.balance() - WMATICV2.totalSupply();
    uint256 tolerance = WMATICV2.balance() / 10;
    if (delta > tolerance) {
        // reward the first finder
        isHacked = true;
+       emit AssertionFailed("we hacked it!");

-       IERC20(WMATIC).transfer(msg.sender, IERC20(WMATIC).balanceOf(address((this))));
        winner = address(msg.sender);
    }
    return isHacked;
}

```

We inserted an event `AssertionFailed` to indicate that the invariant is broken and the challenge is solved. ItyFuzz uses `AssertionFailed(string)` events to determine whether the challenge is solved.

We also remove the transfer of WMATIC token to the winner since we will not deploy the WMATIC token contract. Instead, we will use ItyFuzz to simulate the execution of the contract and determine whether the invariant is broken.

**Step 2: Build**

Ensure you have installed `solc >= 0.8.0`. Then, run the following command to build the contracts:

```
solc *.sol -o . --bin --abi --overwrite
```

**Step 3: Run ItyFuzz**

Use the following command to run ItyFuzz:

```
ityfuzz evm -f -t "[YOUR BUILD DIRECTORY]/*"
```

The above command will run ItyFuzz in offchain mode and specify the target contracts (`-t`). `-f` enables the fuzzer to conduct flash loan operations. It will automatically detect the invariant violation and generate exploits in less than 10 seconds.


# \[Exp] Known Working Hacks

Here, we document vulnerabilities that can be found by ItyFuzz in 30 minutes:

### BSC

You need to set BSC Etherscan API keys to `BSC_ETHERSCAN_API_KEY` environmental variables before running. For better performance, please also set `ETH_RPC_URL` to your local **archive node** RPC or private RPC (by QuickNode, for example).

#### SEAMAN

**Vulnerability: Fund Loss; Time Take: 0h-0m-3s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x6bc9b4976ba6f8C9574326375204eE469993D038,0x6637914482670f91F43025802b6755F27050b0a6,0xDB95FBc5532eEb43DeEd56c8dc050c930e31017e -c bsc --onchain-block-number 23467515 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### RES02

**Vulnerability: Price Manipulation; Time Take: 0h-0m-2s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0xD7B7218D778338Ea05f5Ecce82f86D365E25dBCE,0x05ba2c512788bd95cd6D61D3109c53a14b01c82A,0x1B214e38C5e861c56e12a69b6BAA0B45eFe5C8Eb,0xecCD8B08Ac3B587B7175D40Fb9C60a20990F8D21,0xeccd8b08ac3b587b7175d40fb9c60a20990f8d21,0x04C0f31C0f59496cf195d2d7F1dA908152722DE7,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c -c bsc --onchain-block-number 21948016 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### LPC

**Vulnerability: Fund Loss; Time Take: 0h-0m-4s**

Run

```
ityfuzz evm -t 0x1e813fa05739bf145c1f182cb950da7af046778d,0x1E813fA05739Bf145c1F182CB950dA7af046778d,0x2ecD8Ce228D534D8740617673F31b7541f6A0099,0xcfb7909b7eb27b71fdc482a2883049351a1749d7 -c bsc --onchain-block-number 19852596 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### BIGFI

**Vulnerability: Price Manipulation; Time Take: 0h-8m-31s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x28ec0B36F0819ecB5005cAB836F4ED5a2eCa4D13,0xd3d4B46Db01C006Fb165879f343fc13174a1cEeB,0xA269556EdC45581F355742e46D2d722c5F3f551a -c bsc --onchain-block-number 26685503 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### BEGO

**Vulnerability: Fund Loss; Time Take: 0h-0m-18s**

Run

```
ityfuzz evm -t 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x88503F48e437a377f1aC2892cBB3a5b09949faDd,0xc342774492b54ce5F8ac662113ED702Fc1b34972 -c bsc --onchain-block-number 22315679 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Yyds

**Vulnerability: Fund Loss; Time Take: 0h-0m-4s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x970A76aEa6a0D531096b566340C0de9B027dd39D,0xB19463ad610ea472a886d77a8ca4b983E4fAf245,0xd5cA448b06F8eb5acC6921502e33912FA3D63b12,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xe70cdd37667cdDF52CabF3EdabE377C58FaE99e9 -c bsc --onchain-block-number 21157025 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### EGD-Finance

**Vulnerability: Fund Loss; Time Take: 0h-0m-2s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x202b233735bF743FA31abb8f71e641970161bF98,0xa361433E409Adac1f87CDF133127585F8a93c67d,0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE,0x34Bd6Dba456Bc31c2b3393e499fa10bED32a9370,0xc30808d9373093fbfcec9e026457c6a9dab706a7,0x34bd6dba456bc31c2b3393e499fa10bed32a9370,0x93c175439726797dcee24d08e4ac9164e88e7aee -c bsc --onchain-block-number 20245522 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### BBOX

**Vulnerability: Price Manipulation; Time Take: 0h-0m-4s**

Run

```
ityfuzz evm -t 0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x5DfC7f3EbBB9Cbfe89bc3FB70f750Ee229a59F8c -c bsc --onchain-block-number 23106506 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### FAPEN

**Vulnerability: Fund Loss; Time Take: 0h-0m-2s**

Run

```
ityfuzz evm -t 0xf3f1abae8bfeca054b330c379794a7bf84988228,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xf3F1aBae8BfeCA054B330C379794A7bf84988228 -c bsc --onchain-block-number 28637846 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### AUR

**Vulnerability: Fund Loss; Time Take: 0h-5m-36s**

Run

```
ityfuzz evm -t 0x73A1163EA930A0a67dFEFB9C3713Ef0923755B78,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x70678291bDDfd95498d1214BE368e19e882f7614 -c bsc --onchain-block-number 23282134 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### LocalTrader2

**Vulnerability: Fund Loss; Time Take: 0h-16m-53s**

Run

```
ityfuzz evm -t 0x0567F2323251f0Aab15c8dFb1967E4e8A7D42aeE,0xcE3e12bD77DD54E20a18cB1B94667F3E697bea06,0x5C65BAdf7F97345B7B92776b22255c973234EfE7,0x303554d4D8Bd01f18C6fA4A8df3FF57A96071a41,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c -c bsc --onchain-block-number 28460897 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Annex

**Vulnerability: Fund Loss; Time Take: 0h-5m-59s**

Run

```
ityfuzz evm -t 0xe65E970F065643bA80E5822edfF483A1d75263E3,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73 -c bsc --onchain-block-number 23165446 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### ARA

**Vulnerability: Arbitrary Call; Time Take: 0h-0m-5s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x7BA5dd9Bb357aFa2231446198c75baC17CEfCda9,0x13f4EA83D0bd40E75C8222255bc855a974568Dd4,0x5542958FA9bD89C96cB86D1A6Cb7a3e644a3d46e,0x98e241bd3be918e0d927af81b430be00d86b04f9,0x7ba5dd9bb357afa2231446198c75bac17cefcda9 -c bsc --onchain-block-number 29214010 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### PLTD

**Vulnerability: Price Manipulation; Time Take: 0h-10m-27s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0xD7B7218D778338Ea05f5Ecce82f86D365E25dBCE,0x4397C76088db8f16C15455eB943Dd11F2DF56545,0x29b2525e11BC0B0E9E59f705F318601eA6756645 -c bsc --onchain-block-number 22252045 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Sheep

**Vulnerability: Price Manipulation; Time Take: 0h-2m-5s**

Run

```
ityfuzz evm -t 0x0025B42bfc22CbbA6c02d23d4Ec2aBFcf6E014d4,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4,0x912DCfBf1105504fB4FF8ce351BEb4d929cE9c24 -c bsc --onchain-block-number 25543755 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### SUT

**Vulnerability: Arbitrary Call; Time Take: 0h-0m-0s**

Run

```
ityfuzz evm -t 0xF075c5C7BA59208c0B9c41afcCd1f60da9EC9c37,0x13f4EA83D0bd40E75C8222255bc855a974568Dd4,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xf075c5c7ba59208c0b9c41afccd1f60da9ec9c37,0x70E1bc7E53EAa96B74Fad1696C29459829509bE2,0x9be508ce41ae5795e1ebc247101c40da7d5742db -c bsc --onchain-block-number 30165901 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### ApeDAO

**Vulnerability: Price Manipulation; Time Take: 0h-0m-2s**

Run

```
ityfuzz evm -t 0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d,0x55d398326f99059fF775485246999027B3197955,0x45aa258ad08eeeb841c1c02eca7658f9dd4779c0,0xb47955b5b7eaf49c815ebc389850eb576c460092,0xee2a9D05B943C1F33f3920C750Ac88F74D0220c3,0xB47955B5B7EAF49C815EBc389850eb576C460092 -c bsc --onchain-block-number 30072293 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Axioma

**Vulnerability: Fund Loss; Time Take: 0h-0m-4s**

Run

```
ityfuzz evm -t 0x2C25aEe99ED08A61e7407A5674BC2d1A72B5D8E3,0xB6CF5b77B92a722bF34f6f5D6B1Fe4700908935E,0x6a3Fa7D2C71fd7D44BF3a2890aA257F34083c90f -c bsc --onchain-block-number 27620320 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### ValueDefi

**Vulnerability: Fund Loss; Time Take: 0h-13m-29s**

Run

```
ityfuzz evm -t 0x4269e4090FF9dFc99D8846eB0D42E67F01C3AC8b,0xD4BBF439d3EAb5155Ca7c0537E583088fB4CFCe8,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x7Af938f0EFDD98Dc513109F6A7E85106D26E16c4,0xd7D069493685A581d27824Fc46EdA46B7EfC0063 -c bsc --onchain-block-number 7223029 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Novo

**Vulnerability: Price Manipulation; Time Take: 0h-1m-21s**

Run

```
ityfuzz evm -t 0xEeBc161437FA948AAb99383142564160c92D2974,0xa0787daad6062349f63b7c228cbfd5d8a3db08f1,0x3463a663de4ccc59c8b21190f81027096f18cf2a,0x6Fb2020C236BBD5a7DDEb07E14c9298642253333,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x128cd0Ae1a0aE7e67419111714155E1B1c6B2D8D -c bsc --onchain-block-number 18225002 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### RADT

**Vulnerability: Price Manipulation; Time Take: 0h-10m-27s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0xDa26Dd3c1B917Fbf733226e9e71189ABb4919E3f,0xDC8Cb92AA6FC7277E3EC32e3f00ad7b8437AE883,0xaF8fb60f310DCd8E488e4fa10C48907B7abf115e,0x01112eA0679110cbc0ddeA567b51ec36825aeF9b -c bsc --onchain-block-number 21572418 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### LaunchZone

**Vulnerability: Arbitrary Call; Time Take: 0h-0m-13s**

Run

```
ityfuzz evm -t 0x6D8981847Eb3cc2234179d0F0e72F6b6b2421a01,0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56,0xDb821BB482cfDae5D3B1A48EeaD8d2F74678D593,0x3a6d8cA21D1CF76F653A67577FA0D27453350dD8,0x0ccee62efec983f3ec4bad3247153009fb483551,0x3B78458981eB7260d1f781cb8be2CaAC7027DbE2 -c bsc --onchain-block-number 26024419 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Thena

**Vulnerability: Price Manipulation; Time Take: 0h-0m-6s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x2952beb1326acCbB5243725bd4Da2fC937BCa087,0x8AC76a51cc950d9822D68b83fE1Ad97B32Cd580d,0xF4C8E32EaDEC4BFe97E0F595AdD0f4450a863a11,0x39E29f4FB13AeC505EF32Ee6Ff7cc16e2225B11F,0x20a304a7d126758dfe6B243D0fc515F83bCA8431,0x618f9Eb0E1a698409621f4F487B563529f003643,0xA99c4051069B774102d6D215c6A9ba69BD616E6a -c bsc --onchain-block-number 26834149 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### PancakeHunny

**Vulnerability: Price Manipulation; Time Take: 0h-9m-59s**

Run

```
ityfuzz evm -t 0x12180BB36DdBce325b3be0c087d61Fce39b8f5A4,0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xb9b0090aaa81f374d66d94a8138d80caa2002950,0x109Ea28dbDea5E6ec126FbC8c33845DFe812a300,0x515Fb5a7032CdD688B292086cf23280bEb9E31B6,0x565b72163f17849832A692A3c5928cc502f46D69 -c bsc --onchain-block-number 7962338 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### BGLD

**Vulnerability: Price Manipulation; Time Take: 0h-2m-52s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0xE445654F3797c5Ee36406dBe88FBAA0DfbdDB2Bb,0x429339fa7A2f2979657B25ed49D64d4b98a2050d,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xC2319E87280c64e2557a51Cb324713Dd8d1410a3,0x169f715CaE1F94C203366a6890053E817C767B7C,0x559D0deAcAD259d970f65bE611f93fCCD1C44261,0x7526cC9121Ba716CeC288AF155D110587e55Df8b,0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4,0xC632F90affeC7121120275610BF17Df9963F181c -c bsc --onchain-block-number 23844529 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### HPAY

**Vulnerability: Fund Loss; Time Take: 0h-11m-38s**

Run

```
ityfuzz evm -t 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xF8bC1434f3C5a7af0BE18c00C675F7B034a002F0,0xC75aa1Fa199EaC5adaBC832eA4522Cff6dFd521A -c bsc --onchain-block-number 22280853 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### THB

**Vulnerability: Fund Loss; Time Take: 0h-1m-7s**

Run

```
ityfuzz evm -t 0x72e901F1bb2BfA2339326DfB90c5cEc911e2ba3C,0xae191Ca19F0f8E21d754c6CAb99107eD62B6fe53 -c bsc --onchain-block-number 21785004 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### CS

**Vulnerability: Price Manipulation; Time Take: 0h-0m-26s**

Run

```
ityfuzz evm -t 0x382e9652AC6854B56FD41DaBcFd7A9E633f1Edd5,0x55d398326f99059fF775485246999027B3197955,0x7EFaEf62fDdCCa950418312c6C91Aef321375A00,0x8BC6Ce23E5e2c4f0A96429E3C9d482d74171215e -c bsc --onchain-block-number 28466976 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Melo

**Vulnerability: Fund Loss; Time Take: 0h-0m-12s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x9A1aEF8C9ADA4224aD774aFdaC07C24955C92a54,0x6a8C4448763C08aDEb80ADEbF7A29b9477Fa0628 -c bsc --onchain-block-number 27960445 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### GSS

**Vulnerability: Price Manipulation; Time Take: 0h-8m-23s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0xB4F4cD1cc2DfF1A14c4Aaa9E9434A92082855C64,0x1ad2cB3C2606E6D5e45c339d10f81600bdbf75C0,0x37e42B961AE37883BAc2fC29207A5F88eFa5db66,0x69ed5b59d977695650ec4b29e61c0faa8cc0ed5c -c bsc --onchain-block-number 31108558 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### CFC

**Vulnerability: Fund Loss; Time Take: 0h-0m-24s**

Run

```
ityfuzz evm -t 0xdd9b223aec6ea56567a62f21ff89585ff125632c,0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d,0x55d398326f99059fF775485246999027B3197955,0x595488F902C4d9Ec7236031a1D96cf63b0405CF0,0x8213e87bb381919b292ace364d97d3a1ee38caa4,0xdd9B223AEC6ea56567A62f21Ff89585ff125632c,0x4d7Fa587Ec8e50bd0E9cD837cb4DA796f47218a1 -c bsc --onchain-block-number 29116478 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### cftoken

**Vulnerability: Price Manipulation; Time Take: 0h-0m-54s**

Run

```
ityfuzz evm -t 0x8B7218CF6Ac641382D7C723dE8aA173e98a80196,0x7FdC0D8857c6D90FD79E22511baf059c0c71BF8b -c bsc --onchain-block-number 16841980 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### AES

**Vulnerability: Price Manipulation; Time Take: 0h-0m-1s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x40eD17221b3B2D8455F4F1a05CAc6b77c5f707e3,0xdDc0CFF76bcC0ee14c3e73aF630C029fe020F907 -c bsc --onchain-block-number 23695904 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Utopia

**Vulnerability: Price Manipulation; Time Take: 0h-11m-26s**

Run

```
ityfuzz evm -t 0xfeEf619a56fCE9D003E20BF61393D18f62B0b2D5,0xb1da08c472567eb0ec19639b1822f578d39f3333,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x6191203510c2a6442faecdb6c7bb837a76f02d23,0xb1da08C472567eb0EC19639b1822F578d39F3333 -c bsc --onchain-block-number 30119396 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### MintoFinance

**Vulnerability: Fund Loss; Time Take: 0h-0m-1s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x0d116ed40831fef8e21ece57c8455ae3b1e4041b,0xdbf1c56b2ad121fe705f9b68225378aa6784f3e5,0xDbF1C56b2aD121Fe705f9b68225378aa6784f3e5,0x13f4EA83D0bd40E75C8222255bc855a974568Dd4,0x410a56541bD912F9B60943fcB344f1E3D6F09567,0xba91db0b31d60c45e0b03e6d515e45fcabc7b1cd -c bsc --onchain-block-number 30214253 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### BabyDogeCoin02

**Vulnerability: Fund Loss; Time Take: 0h-20m-22s**

Run

```
ityfuzz evm -t 0xc748673057861a797275CD8A068AbB95A902e8de,0x55d398326f99059fF775485246999027B3197955,0x4f3126d5DE26413AbDCF6948943FB9D0847d9818,0xA07c5b74C9B40447a954e1466938b865b6BBea36,0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56,0xC9a0F685F39d05D835c369036251ee3aEaaF3c47,0x9a6b926281b0c7bc4f775e81f42b13eda9c1c98e,0x95c78222B3D6e262426483D42CfA53685A67Ab9D,0x9869674E80D632F93c338bd398408273D20a6C8e,0xd8B6dA2bfEC71D684D3E2a2FC9492dDad5C3787F,0xc736cA3d9b1E90Af4230BD8F9626528B3D4e0Ee0,0x0536c8b0c3685b6e3C62A7b5c4E8b83f938f12D1,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0xfD36E2c2a6789Db23113685031d7F16329158384,0xfD5840Cd36d94D7229439859C0112a4185BC0255 -c bsc --onchain-block-number 29295010 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### MBC\_ZZSH

**Vulnerability: Fund Loss; Time Take: 0h-0m-34s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x4E87880A72f6896E7e0a635A5838fFc89b13bd17,0x2170Ed0880ac9A755fd29B2688956BD959F933F8,0x5b1Bf836fba1836Ca7ffCE26f155c75dBFa4aDF1,0x33CCA0E0CFf617a2aef1397113E779E42a06a74A,0xeE04a3f9795897fd74b7F04Bb299Ba25521606e6 -c bsc --onchain-block-number 23474460 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### WGPT

**Vulnerability: Fund Loss; Time Take: 0h-0m-40s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0xe1272a840F574b68dE861eC5009784e3411cb96c,0xaa07222e4c3295C4E881ac8640Fbe5fB921D6840,0x81917eb96b397dFb1C6000d28A5bc08c0f05fC1d,0x5336a15f27b74f62cc182388c005df419ffb58b8,0x4f3126d5DE26413AbDCF6948943FB9D0847d9818,0x5a596eAE0010E16ed3B021FC09BbF0b7f1B2d3cD,0x1f415255f7E2a8546559a553E962dE7BC60d7942,0x1f415255f7e2a8546559a553e962de7bc60d7942 -c bsc --onchain-block-number 29891709 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### ROI

**Vulnerability: Fund Loss; Time Take: 0h-0m-1s**

Run

```
ityfuzz evm -t 0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56,0xe48b75dc1b131fd3a8364b0580f76efd04cf6e9c,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x745D6Dd206906dd32b3f35E00533AD0963805124,0x216FC1D66677c9A778C60E6825189508b9619908,0xE48b75dc1b131fd3A8364b0580f76eFD04cF6e9c,0x158af3d23d96e3104bcc65b76d1a6f53d0f74ed0 -c bsc --onchain-block-number 21143795 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### HEALTH

**Vulnerability: Price Manipulation; Time Take: 0h-0m-3s**

Run

```
ityfuzz evm -t 0xF375709DbdE84D800642168c2e8bA751368e8D32,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x32B166e082993Af6598a89397E82e123ca44e74E,0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4 -c bsc --onchain-block-number 22337425 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Shadowfi

**Vulnerability: Price Manipulation; Time Take: 0h-29m-17s**

Run

```
ityfuzz evm -t 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x10bc28d2810dD462E16facfF18f78783e859351b,0xF9e3151e813cd6729D52d9A0C3ee69F22CcE650A -c bsc --onchain-block-number 20969095 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### MetaPoint

**Vulnerability: Fund Loss; Time Take: 0h-20m-18s**

Run

```
ityfuzz evm -t 0x5923375f1a732FD919D320800eAeCC25910bEdA3,0x55d398326f99059fF775485246999027B3197955,0x807d99bfF0bad97e839df3529466BFF09c09E706,0x8acb88F90D1f1D67c03379e54d24045D4F6dfDdB,0x435444d086649B846E9C912D21E1Bc651033A623,0x724DbEA8A0ec7070de448ef4AF3b95210BDC8DF6,0xA56622BB16F18AF5B6D6e484a1C716893D0b36DF,0xe8d6502E9601D1a5fAa3855de4a25b5b92690623,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x68531F3d3A20027ed3A428e90Ddf8e32a9F35DC8,0x9117df9aA33B23c0A9C2C913aD0739273c3930b3,0x52AeD741B5007B4fb66860b5B31dD4c542D65785,0xE5cBd18Db5C1930c0A07696eC908f20626a55E3C,0x3B5E381130673F794a5CF67FBbA48688386BEa86,0xC254741776A13f0C3eFF755a740A4B2aAe14a136 -c bsc --onchain-block-number 27264383 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### Carrot

**Vulnerability: Arbitrary Call; Time Take: 0h-0m-1s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x6863b549bf730863157318df4496eD111aDFA64f,0xcFF086EaD392CcB39C49eCda8C974ad5238452aC,0x5575406ef6b15eec1986c412b9fbe144522c45ae,0x6863b549bf730863157318df4496ed111adfa64f -c bsc --onchain-block-number 22055611 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### RES

**Vulnerability: Price Manipulation; Time Take: 0h-0m-3s**

Run

```
ityfuzz evm -t 0x55d398326f99059fF775485246999027B3197955,0x05ba2c512788bd95cd6D61D3109c53a14b01c82A,0x1B214e38C5e861c56e12a69b6BAA0B45eFe5C8Eb,0xff333de02129af88aae101ab777d3f5d709fec6f,0xeccd8b08ac3b587b7175d40fb9c60a20990f8d21,0x04C0f31C0f59496cf195d2d7F1dA908152722DE7,0x16b9a82891338f9bA80E2D6970FddA79D1eb0daE,0xecCD8B08Ac3B587B7175D40Fb9C60a20990F8D21 -c bsc --onchain-block-number 21948016 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```

#### RFB

**Vulnerability: Fund Loss; Time Take: 0h-0m-16s**

Run

```
ityfuzz evm -t 0x26f1457f067bF26881F311833391b52cA871a4b5,0x03184AAA6Ad4F7BE876423D9967d1467220a544e,0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c,0x0fe261aeE0d1C4DFdDee4102E82Dd425999065F4 -c bsc --onchain-block-number 23649423 -f --onchain-etherscan-api-key $BSC_ETHERSCAN_API_KEY
```


# Constructor for Offchain Fuzzing

When fuzzing a contract offchain, you may need to provide constructor arguments to initialize the contract state. ItyFuzz provides two methods to pass in constructor arguments. These arguments are necessary for initializing the state of the contract when deployed.

**Method 1: CLI Arguments**

The first method is to pass in the constructor arguments directly as CLI arguments.

When you run ItyFuzz using the CLI, you can include the `--constructor-args` flag followed by a string that specifies the arguments for each constructor.

The format is as follows:

```bash
ityfuzz evm -t 'build/*'\
    --constructor-args "ContractName:arg1,arg2,...;AnotherContract:arg1,arg2,..;"
```

For example, if you have two contracts, `main` and `main2`, both having a `bytes32` and a `uint256` as constructor arguments, you would pass them in like this:

```bash
ityfuzz evm -t 'build/*'\
    --constructor-args "main:1,0x6100000000000000000000000000000000000000000000000000000000000000;main2:2,0x6200000000000000000000000000000000000000000000000000000000000000;"
```

**Method 2: Server Forwarding**

The second method is to use our server to forward requests to a user-specified RPC, and cli will fetch the constructor arguments from the transactions sent to the RPC.

Firstly, go to the `/server` directory, and install the necessary packages:

```bash
cd /server
npm install
```

Then, start the server using the following command:

```bash
node app.js
```

By default, the server will forward requests to `http://localhost:8545`, which is the default address for [Ganache](https://github.com/trufflesuite/ganache), if you do not have a local blockchain running, you can use Ganache to start one. If you wish to forward requests to another location, you can specify the address as a command-line argument like so:

```bash
node app.js http://localhost:8546
```

Once the server is running, you can deploy your contract to `localhost:5001` using a tool of your choice.

For example, you can use Foundry to deploy your contract through the server:

```bash
forge create src/flashloan.sol:main2 --rpc-url http://127.0.0.1:5001 --private-key 0x0000000000000000000000000000000000000000000000000000000000000000 --constructor-args "1" "0x6100000000000000000000000000000000000000000000000000000000000000"
```

Finally, you can fetch the constructor arguments using the `--fetch-tx-data` flag:

```bash
ityfuzz evm -t 'tests/evm/multi-contract/*' --fetch-tx-data
```

ItyFuzz will fetch the constructor arguments from the transactions forwarded to the RPC through the server.


# Writing Invariants

ItyFuzz, by default, supports finding [Echidna](https://github.com/crytic/echidna) and [Scribble](https://docs.scribble.codes/) invariant violations. You do not need to change the code if it works for Echidna, Mythril, Harvey, etc. ItyFuzz also supports [`bug()`](#bug-support), which indicates the current code shall not be reached.&#x20;

### Echidna Support

Any contracts bearing functions starting with `echidna_` will be treated as invariants and will be tested by ItyFuzz. If it returns `false`, the fuzzer will report a bug.

```solidity
function echidna_test() public {
    assert(false);
}
```

### Scribble Support

Scribble is a tool for writing specifications for Solidity contracts. ItyFuzz supports Scribble annotations after it is compiled by `scribble`.

For example, the following contract has a Scribble annotation that specifies the return value of `inc`:

```bash
contract Foo {
    /// #if_succeeds {:msg "P1"} y == x + 2;
    function inc(uint x) public pure returns (uint y) {
        return x+1;
    }
}
```

You need to compile the contract using `scribble` and pass the compiled contract to ItyFuzz

Note that you must add `--no-assert` to the `scribble` command. Otherwise, ItyFuzz will not detect any bugs.

```bash
scribble test.sol --output-mode flat --output compiled.sol --no-assert
```

Then compile with `solc` and run ItyFuzz:

```bash
solc compiled.sol --bin --abi --overwrite -o build
ityfuzz evm -t "build/*" [More Arguments]
```

### `bug()` Support

You can insert `bug()` or `typed_bug(string message)` in your contract to report a condition when the bug is found.

For instance, a simple case can be written as follows:

```solidity
function buy_token() public {
    if (msg.sender != owner) {
        bug();
    }
}
```

The implementation of `bug()` is as follows:

```solidity
library FuzzLand {
    event AssertionFailed(string message);
  
    function bug() internal {
        emit AssertionFailed("Bug");
    }
  
    function typed_bug(string memory data) internal {
        emit AssertionFailed(data);
    }

}

function bug()  {
    FuzzLand.bug();
}

function typed_bug(string memory data)  {
    FuzzLand.typed_bug(data);
}
```

You can either paste the code above into your contract or import it from [`solidity_utils/lib.sol`](https://github.com/fuzzland/ityfuzz/blob/master/solidity_utils/lib.sol), if you are using `bug` or `typed_bug`.


# Detecting Common Vulns

### Balance Extraction

*Confidence: 100%*

Detect whether the attackers can steal ETH / native tokens from the contract.

Example:

```solidity
function buggy() public {
    payable(msg.sender).transfer(1 ether);
}
```

### **Token Extraction**&#x20;

*Confidence: 100%*

Detect whether the attackers can steal ERC20 / ERC721 tokens from the contract, determined by the positive earnings of the attackers. The earning is calculated by liquidating the token on related Uniswap V2 pairs.&#x20;

Example:

```solidity
function buggy() public {
    // the price of tokenAddr2 is higher than tokenAddr1
    SomeToken(tokenAddr1).transferFrom(msg.sender, address(this), 1000);
    SomeToken(tokenAddr2).transfer(msg.sender, 1000);
}
```

### **Uniswap Pair Issues**&#x20;

*Confidence: Medium*

Identify misuse of Uniswap pair that could lead to price manipulation attacks.

Example:

```solidity
function buggy() public {
    burn(IUniswapPair(pairAddr), 1000000);
}
```

### **Arbitrary Selfdestruct**&#x20;

*Confidence: 100%*

Detect whether the contract can be selfdestructed by anyone.

Example:

```solidity
function buggy() public {
    selfdestruct(msg.sender);
}
```

### Integer Overflow / Underflow

*Confidence: Low*

Detect whether the contract add / multiply / subtract leading to overflow and underflow.&#x20;

Example:

```solidity
function buggy() public {
    return type(uint256).max * 2;
}

```