web3-methodology-researchlisted

# METHODOLOGY & RESEARCH SYNTHESIS Sources: Trail of Bits, SlowMist, ConsenSys, Immunefi Web3 Security Library, Cyfrin Audit Course, Lido Audits Library, Nethermind PublicAuditReports. --- ## TRAIL OF BITS ### Their Toolset | Tool | What It Does | When to Use | |------|-------------|-------------| | **Slither** | Static analysis for Solidity/Vyper | Always — run first | | **Echidna** | Property-based fuzzer (write invariants, it breaks them) | Write 3-5 invariants before reading code | | **Medusa** | Next-gen fuzzer, multi-core, parallel corpus | Deeper campaigns after Echidna | | **Manticore** | Symbolic execution — confirms if a path is truly reachable | Specific PoC confirmation | | **Halmos** | Symbolic unit testing — proves for ALL inputs | Math-heavy functions | --- ### Slither Commands ```bash # Install pip3 install slither-analyzer # First pass — protocol overview slither . --print human-summary slither . --print contract-summary # Targeted detectors slither . --detect reentrancy-eth,reentrancy-no-eth,unchecked-lowlevel slither . --detect arbitrary-send-erc20,controlled-delegatecall slither . --detect uninitialized-state,uninitialized-storage slither . --detect suicidal,controlled-array-length # Visualization slither . --print inheritance-graph slither . --print function-summary slither . --print call-graph # Filtered run (skip tests and libs) slither . --exclude-low --filter-paths "test|lib" ``` --- ### Echidna Quick Start ```solidity // Write invarian