{"id":400,"date":"2022-11-11T08:00:33","date_gmt":"2022-11-11T06:00:33","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=400"},"modified":"2022-11-14T01:04:25","modified_gmt":"2022-11-13T23:04:25","slug":"testing-axelar-contracts-using-open-source-tools","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/testing-axelar-contracts-using-open-source-tools\/","title":{"rendered":"Testing Axelar contracts using open-source tools"},"content":{"rendered":"

Building projects on top of cross-chain solutions like Axelar<\/a> can sometimes be tricky and may lead to security issues in the code. Fortunately, open-source tools can automatically detect many issues or help test the implementation.<\/p>\n

Static analysis tools<\/h2>\n

Static analysis tools can detect vulnerabilities and code quality issues without executing the code<\/strong>. A tool typically implements detectors that often use heuristics to perform the analysis. There are a few static analysis tools for Solidity<\/a>. We will demonstrate further the most well-known tool Slither<\/strong> and an alternative tool Wake<\/strong>, that implements Axelar-specific detectors.<\/p>\n

Slither<\/h4>\n

The Slither<\/a> tool can be installed with Python\u2019s integrated installer using:<\/p>\n

pip3 install slither-analyzer<\/pre>\n
It offers numerous detectors (80 at the time of writing). Nevertheless, many of the detectors are not relevant to the latest versions of Solidity<\/strong>, and some of the detectors are only informative (e.g. an inline assembly block is used). The tool can be run using the following command:<\/p>\n
slither project-directory<\/pre>\n
Slither usually prints out a lot of information that is not very well formatted<\/strong>.<\/p>\n
\"\"<\/p>\n
There is also a Slither extension<\/span><\/a> for VS Code, but it requires the developer to run the detectors manually.<\/p>\n
Wake<\/h4>\n
Wake<\/a><\/span> is a development and testing framework for Solidity developed by Ackee Blockchain<\/a>. Like Slither, Wake can perform static analysis using a prepared set of detectors<\/strong>, with detectors written especially for projects built on Axelar. Wake can be installed using the following command:<\/p>\n
pip3 install wake<\/pre>\n
The number of detectors is limited, the tool does not aim to catch all possible issues, but a few specific ones. More detectors are being actively developed; all are relevant to the latest versions of Solidity<\/strong>, and it prints fewer false positive detections. Analysis of a project can be performed with the following command:<\/p>\n
wake detect project-directory\r\n\"\"<\/pre>\n
Among other detectors, there is also a detector that checks whether Axelar Proxy\/Upgradeable<\/strong> contracts are used in the correct way. Specifically, it checks that:<\/p>\n