forefy / eburger

eBurger is a static analysis tool that provides a way to quickly query and analyze solidity smart contracts.

Template Based Smart Contracts Static Analyzer

Discord | Discussions | Feature request | Wiki | Twitter DM

What is eBurger

eBurger is a static analysis tool that provides a way to quickly query and analyze solidity smart contracts.

Create your template

Run your template

Running static analyzers won't win you competitions. What we provide instead with eburger is the ability to spin up custom templates tailored to your current audited project in minutes (Wiki) allowing you to orchestrate unique lookups through the codebase to empower your audits.

• How to install
• How to run
  • How to run - simple
  • How to run - advanced
• How it looks like 👀
• SARIF support
• GitHub Action
• Contributing templates
• Comparison table
• Features
• What is missing

How to install

From PyPi

pip3 install eburger
eburger -h

From source

git clone https://github.com/forefy/eburger.git
cd eburger
pip3 install .
eburger -h

How to run

Simple examples

Simplest

cd MyProject/
eburger
cat eburger-output.json

SARIF output

eburger -f MyProject/ -o sarif

Markdown output (running from the project's directory)

eburger -o markdown

Focused scan of a single file and its dependencies

eburger -f ../ProjectToScan/src/SomeContract.sol

Only print nsloc count

eburger -f MyProject/ --nsloc

Run custom YAML templates

eburger -t MyCustomYAMLs/ -f MyProject/

Advanced usage

Refer to the Wiki.

How it looks like

Here's a demo video

eburger.mov

Besides eburger-output.json, above example will also generate extended info under the folder .eburger.

SARIF support

SARIF (Static Analysis Results Interchange Format) is a standard format for static analysis tool results.

To have an interactive GUI open up in VSCode that can organinze and interact with the results found, follow these steps:

• Install Microsoft's SARIF Viewer VSCode extenstion
• Run eburger --output sarif
• From within VSCode, click the resulted eburger-output.sarif file placed in the working directory

This will open an interactive vscode menu with the issues, description, navigation of vulnerable code lines, etc.

GitHub Action

CI pipelines are supported via the eburger-action GitHub Action, it helps continuously assessing your code and viewing the raised insights on your repo's security pane.

Visit the action's page for more information.

Contributing templates

Templates can be added by creating new YAML files and either load them with eburger -t mytemplate.yaml . or by placing them under the templates/ directory.

If you prefer playing with eburger on the browser before installation, you can try the dedicated Jupyter notebook instance:

If you are using eburger as a python package (installed via pip install), the existing templates location can be found with running pip3 show eburger or by running the tool on a contract and seeing the templates path printed to the console.

For template writing and documentation refer to the Wiki.

Comparison table

Comparison of actively maintained / popular solidity smart contract static analyzers

Static Analyzer	Language	2 Minutes to write a custom template with ChatGPT	GitHub Action	Many findings that are already found before the contest began	Would want to eat
eBurger	Python	✅	✅		✅
Slither	Python		✅	✅
4naly3er	TypeScript 🤮			✅
Mythril	Python
Aderyn	Rust

Forgot one or made a mistake? open a pull request or an issue :)

Features

• YAML template support to query contract structure and raise insights for any matches
• Fast learning curve for creating templates, ability to customize templates to the current ongoing audit project
• Foundry and Hardhat support ❣️
• SARIF support & VSCode GUI integration
• GitHub Actions integration through eburger-action
• Markdown report
• Quick custom template generation via the eBurger Templates Generator GPT
• Community and free support via Discord

What is missing

What features would you like to see? let us know!