Stepan Sonsky - The perfect Solidity VS Code extension doesn’t exi…

Transcript

hey everyone happy to see you there uh and today we will learn something about solidity vs code extensions my name is shipan and I'm a team lead and ethical hacker and developer in key blockchain security we are based in prag Czech Republic and we are focused to security audits uh development of Open Source tools uh namely wake and tools for solidity we will talk about it later and we are also teaching solidity and evm on CCH Technical University these are some of our well-known uh clients and also we've received some grants for our open-

source development well uh when it comes to solidos Cod extension uh we have to ask what are our requirements and we will focus on uh two areas the first one is development are there any developers out there hands up great so uh if you're a developer you basically need syntax highlighting of course uh some basic code navigation like uh go to definition go to type definition implementation find all references uh some code completion we

don't write uh every letter in the code uh some code actions for quick fixes code formatting to make our code prettier refactoring features like rename uh of symbols and of course uh compilation and debugging because developers don't like bugs but Auditors do yeah and the second part is security and auditing are there any Auditors out there hands up cool so if you are a security engineer you need of course syntax highlighting code

navigation and here comes the interesting part stetic analyis um you can detect vulnerabilities uh in your code and uh show it directly uh in your code so vulnerability highlighting if you want to audit something you usually want to visualize the code differently than just reading the code so graphs I will show it later also when you are auditing uh you want to write some notes some bookmarks in the code for issue tracking and of course unit test fast test and uh displaying the test coverage okay now take a look to the

extensions which are exist in the market the first one the solidity by Juan Blanco it's like golden standard for solidity development it's really popular it's has more than a million of installations uh it has a basic uh code features like navigation completion formatting and actions which were we talk about before uh some linting uh using Soul hand and E link and you can also download the source and AI from The Ether skan and of course compilation the next one is solidity bomic Foundation it's really focused to

the hardhead integration uh it also features uh code stuff we've talked about and uh yeah some basic refactoring features like subol or in and uh when you hover to some part of code you can get help of functions or contracts and compilation of course the next one uh visual developer from consensus uh the name says it itself it's really visual uh it uh has a pretty nice features regarding graphs

uh which are interactive you can generate uml diagrams uh you can generate reports where you can see like uh public external view functions lines of code lines of assembly code Etc it's really complex there's a cockpit view uh which uh allows you to better navigate in larger projects there's outline view outline view uh which uh ows you to see um public external functions and um its visibility Etc you can also uh write your notes as bookmarks and yeah Cod lens we haven't

been talking about uh this feature it's like buttons above your functions and uh contracts where you can execute some actions for example go to references or generate uh graphs yeah and also there are some features uh from The Ether scan like downloading um Source ABI and for example to see balances of the address well the next one slitter it static analyzes and um this extension basically shows you the output from the Slayer itself but um it's a little bit

outdated it has a lot of false positives and um yeah not not so many features only like filtering issues by type uh the next one is MTH X by consensus uh is also static analyzer but uh unfortunately during my preparation of presentation it was discontinued uh it was really helpful for uh our early auditing days and it was great inspiration for developing wake so uh thank you consenus for your good

work and finally um tools for solidity uh which is our extension powered by wake uh I will shortly describe what the wake is uh in case you haven't been on the previous talk so vas development and testing framework based on python uh it has static analyzer inside for detecting vulnerabilities uh it has really powerful features regarding fuzzing which is uh testing using randomized values and you run it over the night and with hundreds of thousand cycles and the morning you can see that some variables if you are put uh their some specific

values it can crash it's really hard to discover these issues by manual review so fuzzing is uh really really useful we've got also very nice uh interactive debugger uh with uh detailed C traces and finally LSP server which is a back end for our vcode extension and now let's talk about the extension itself which is on the opposite front end for the Wake for vs code let's see uh some of the features uh the main feature is static analysis and detections of potential

vulnerabilities displaying uh them directly in the code uh even during the development so it's very important to care about Security even during the development uh there are uh few type of graphs I will show it uh later in detail uh test coverage uh which is visualizing uh coverage of uh your test directly in the code we'll show you later as well and vs code printers our uh brand new feature which we released uh yesterday for ethereum tric um I will show you later as well and yeah basic uh code

navigation and uh code C lens actions and of course compilation using Sol C okay now let's take a look uh at the detail of uh our features so static analyis uh as you can see directly in a vs code you can have uh output of static analysis of detections um we are evaluating impact and confidence you can filter these issues by impact and confidence you can group them by uh these criteria um by file by detector Etc and yeah here are some examples uh

of our two dimensional icons uh on the upper side it's uh impact and uh the confidence above so these are examples I impact high confidence high impact low confidence Etc uh hopefully it's understandable yeah the next one is vulnerability highlighting so you can see these vulnerabilities underlined directly in the code uh with some details for example here's reentrancy so you can see from uh which contract which function uh it is potentially exploitable

well uh graphs graphs are pretty useful during auditing process uh because you can see the code from the different view like more visualized so for example this uh inheritance chain can be transformed to the more complex overview uh of The Inheritance chain control flow graph here we have a simple transfer function where we are uh changing balances of sender and recipient and control for graph can transform this code to this graph um in some more complex

algorithms uh it's very useful you can see the uh ways how the code executes and what actions are being exec yeah for auditing uh it's it's very very useful this coverage uh as you can see when you write test you can see directly in the code highlighted uh lines uh which are covered by test and we are supporting even real time uh test coverage during the fuzzing and finally our new feature V code printers which we released today yesterday so you can uh install it and

try it and U V code printers are like um you can execute native vs code actions through the from the LSP server so for example here uh we are showing public function button on the code lens above the contract and then you can see the all public functions and you can navigate to them uh in the code uh much more features uh regarding uh V printers are coming very soon so looking forward uh what we can do with this uh powerful

stuff yeah uh and here's a summary of uh extensions we were talking about so you can have a great bigger picture uh about all of them and yeah um so here comes the answer um for the question this perfect solidity extension simply doesn't exist and uh now you have a great overview which extension have uh advantages and disadvantages and you can combine them to make uh the great combo

for uh your usage well uh thank you for your attention and uh if you are interested in fuzzing I would like to invite you to our workshop at 3:30 p.m. on merch stage yeah see you there thank you very much [Applause] perfect thank you so much Stefan is there any questions from the audience about the talk no questions okay there is one question up there you going to get the mic quickly from uh a volunteer the the just please wait for

the mic thank you uh do you use any other uh open source projects like Foundry has been said in before uh in in the uh solidity uh tools um in um tools for solidity we are using wake internally but uh yeah you can compile Foundry projects as well of course hardhead projects uh you can compile it with wake as well uh was it that question uh I'm a little bit confused

you can you can repeat you have time okay so from what I've understood uh the uh V are using Foundry in uh in base like uh from goodg go do you use any other tools like that I I don't get the question just just catch me at the lobby and we can talk about it are there any other questions okay no then please give another big round of applause to Stefan thank you