Solar: Context-free, interactive analysis for Solidity

Summary: A Trail of Bits intern built Solar, a proof-of-concept static analysis framework for interactive, context-free analysis of Solidity smart contracts, with an IDE-like interface split into source and IR panels. Solar uses three strategies (concrete, symbolic, constraint) and three primitives (simplify, downcall, upcall) to let a user pick program paths and apply polynomial constraints, demonstrated by showing that will_it_overflow cannot overflow when called from z.
What's compelling: The tool's own example shows that whether a 32-bit multiplication overflows depends entirely on the call site, so an auditor who analyzes a function in isolation can reach the wrong conclusion about a contract's safety.

Read the original at Trail of Bits Blog ↗