ERCx, Fast Checking of ERC standards and Beyond

Transcript

[Music] hello everyone Amelia's from runtime verification and today I'm going to present trcx which is our tool suite for testing and evaluating the conformance of ERC tokens and security properties all right so let me tell you what the rcx can provide you with essentially it provides you with two features the first one is to let you evaluate any token that is deployed on testnet or mandate against the conformance and security properties the second one is to let you build better quality tokens by providing you with very complete test Suite that

allows you ensuring that your token has all the essential properties it needs so we believe that ercx is mainly intended for developers but it can be also used by investors and expert Auditors let me tell you how so an investor in front of a token she is rightfully asking the question is this token safe should I put my money in it and she is rightfully scared of scams bug pools or even honeypots so we need to provide them with tools that allow the to evaluate the token from a behavioral perspective not only the economics us as developers we want to spend as

least times possible testing we want to make sure that our token has all the functionality it needs we want to make sure that it achieves its mission and moreover if we are a newcomer to a token standard we don't know from which token to inspire from there is so many tokens outside ercx can also be used by expert Auditors the tool can be shipped as a Foundry Library that is quite comprehensive in the completeness of the checks that it makes I will say more about that in a minute it also it is also very fast it executes in less than a minute

and it is also customizable and extendable customizable in the sense that you can tweak the parameters you can evaluate or test from different initial States but you can also extend by adding more tests to check for the special token that you are in front of so let me tell you more about our test Suite we are now supporting gear C20 and erc4626 with respectively 116 175 tokens and we have structured or tested into different levels so we have the ABI level which essentially consists in syntactic checks we have also minimal and recommended for conformance to the standard so minimal would correspond to

the must recommended to the shot of the standard but we went beyond the standout we saw that it's not enough and we are lucky to have expert Auditors in our company Who provided us with security property so in desirable we put all the tests for the properties that were violated during hacks we have two more levels add-on and fingerprint add-on are tests that involve functions going beyond the standards such as minting transfer proxy batch transfer burning Etc and fingerprint are for implementation choices so these are not necessarily bad no good properties but maybe for instance does these tokens report the

infinite approval pattern Network which is an implementation choice all right so we wrote the test suite and we wanted to compare it to what exists out there so we checked out open the print test Suite we checked slitter and we even tried Chad DPT to write to test it so we don't have the most tests we have 116 tests but those tests are parametric so that means that we can do fuzzing and we wanted to evaluate how good these are tested at finding bugs so we partnered with Satora we generated some mutants which as you know are modification in the source code of a contract to introduce bugs and as you can see we

performed quite well open Zeppelin performed also good and these very good detection capability we provided from source code that means you can test from source code you can check an address from console from a website we have also an API and a vscon plugin already for you all right before moving on to the demo let me tell you about the benefit of having such a comprehensive test Suite so we have a huge database of tokens I believe the most comprehensive one with more than 200k tokens and using our evaluator we can now evaluate the token from a beer review world's perspective that means that we are able now to answer the kind of simple questions that

are on the slides but no much more also so which tokens meets the standout which what are the properties that are mostly most respected and also you can look at things like correlation between properties and also between tokens all right so I hope now you want to check your CX and you can do it from Three locations you can go to our website verification.com you can check out our API us you got slash API and we have a vs code plugin coming very soon all right so now we'll move to the demo to give you a feel about the tool and in the meantime if you want you can

reproduce what I'm doing you get the QR code and you can you can also do that all right so Go full screen so this is a website as you can see it's pretty simple on the left we have testing from address on the right we have testing from source code we hear just input some address in the in the field we select the corresponding Network and we click test and after a few seconds we get a report so what is this report about as you can see we you get some information you can bookmark the token you can have a list of tokens you have information

whether the token is behind the proxy and you have also some listing of functions so these are functions that you will find in the standard and you have a summary of the test result with the different levels that I showed you before you have also some Json file that you can pass and analyze automatically and you have in the different tabs the different levels and so you can see different problems that this token has so this token I forgot to say but this is Teter and as you can see even though it meets the standard it has it is not passing or tested so yeah so this is it we have also some more

token information and at the bottom of the page we have scores about the token so if you are aiming to build services to evaluate tokens this could be useful I hope this is readable for you but we have also scope our categories so we have categories like approval event emission total Supply balance so this gives you a very very precise description of how the token is behaving all right so that's a website we have also a vs code plugin that I can show you here so essentially you have your test code here you click on this generate test and on the left of your screen you have a list of tests you can

click to execute them all and within a few seconds you get this evaluation so we inspired a lot from unit testing to to do that and as you can see whenever you have failing tests you get explanation about why this test is failing and you have also a relationship between the failing tests and the problem so we point you to the correct location in the code all right um let me just now I have one more thing which is or API and I guess you guys all know what an API is but I will just tell you that we have a lot of endpoints that allow you

to execute tested or test remotely we have also endpoints for or different tokens so you can also access a database of tokens you can get the report that I show you in a very past possible way and if you are a service that evaluate tokens you can build also your token list and run your tests privately um okay so I think that's that's it for me I would like to now take questions thank you [Applause] so uh very cool actually quite well uh

done uh what ercs do you support so right now we are supporting 20 and for six to six um 721 is coming in August and we would like also to hear from you what TRC do you need so we are very open to discussing with developers and hearing link needs hey thanks for the presentation are you planning on supporting other kind of uh ercs not just tokens um why not at the moment this is not planned but as I was saying we if you have an ERC you want us to test and have a test Suite just let us know no more question

okay all right thanks [Applause] [Music] foreign