Skip to content

Commit c0ae23a

Browse files
mattaerealmattaereal
authored
Merge pull request #19 from theredguild/develop
(fix): fixed eth-security-toolbox
2 parents 47030c8 + 045b848 commit c0ae23a

4 files changed

Lines changed: 276 additions & 1 deletion

File tree

‎.devcontainer/eth-security-toolbox‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎.devcontainer/eth-security-toolbox/README.md‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
# Ethereum Security Toolbox
2+
3+
This repository contains scripts to create a Docker container preinstalled and
4+
preconfigured with all of Trail of Bits’ Ethereum security tools, including:
5+
6+
* [Echidna](https://github.com/crytic/echidna) property-based fuzz tester
7+
* [Medusa](https://github.com/crytic/medusa) fuzz tester based on go-ethereum
8+
* [Slither](https://github.com/crytic/slither) static analysis tool
9+
* [solc-select](https://github.com/crytic/solc-select) to quickly switch between Solidity compiler versions
10+
* [Building secure contracts](https://github.com/crytic/building-secure-contracts) repository
11+
12+
Other useful tools developed by third-parties are also included:
13+
14+
* [Foundry](https://github.com/foundry-rs/foundry), a toolkit for Ethereum app development
15+
* [Vyper](https://github.com/vyperlang/vyper), a Pythonic Smart Contract language for the EVM
16+
* [n](https://github.com/tj/n), a Node version manager
17+
* npm and Yarn
18+
* Python
19+
20+
## Quickstart
21+
22+
Use our prebuilt Docker container to quickly install and run the toolkit:
23+
24+
```shell
25+
docker pull ghcr.io/trailofbits/eth-security-toolbox:nightly
26+
docker run -it ghcr.io/trailofbits/eth-security-toolbox:nightly
27+
```
28+
29+
Alternatively, build the image from scratch:
30+
31+
```shell
32+
git clone https://github.com/trailofbits/eth-security-toolbox.git
33+
cd eth-security-toolbox
34+
docker build -t eth-security-toolbox .
35+
```
36+
37+
## Usage
38+
39+
Simply start an instance of the Docker container:
40+
41+
```shell
42+
docker run -it ghcr.io/trailofbits/eth-security-toolbox:nightly
43+
```
44+
45+
Several Solidity versions are preinstalled via `solc-select`. By default, `solc`
46+
corresponds to the latest release. This can be changed using the `solc-select`
47+
tool:
48+
49+
```shell
50+
$ solc --version
51+
solc, the solidity compiler commandline interface
52+
Version: 0.8.22+commit.4fc1097e.Linux.g++
53+
$ solc-select use 0.4.26
54+
$ solc --version
55+
solc, the solidity compiler commandline interface
56+
Version: 0.4.26+commit.4563c3fc.Linux.g++
57+
```
58+
59+
You can also view the installed versions and install new ones:
60+
61+
```shell
62+
$ solc-select versions
63+
0.8.22 (current, set by /home/ethsec/.solc-select/global-version)
64+
0.7.6
65+
0.6.12
66+
0.5.17
67+
0.4.26
68+
ethsec@f95fb29a709d:~$ solc-select install 0.8.0
69+
Installing solc '0.8.0'...
70+
Version '0.8.0' installed.
71+
ethsec@f95fb29a709d:~$ solc-select use 0.8.0
72+
Switched global version to 0.8.0
73+
$ solc --version
74+
solc, the solidity compiler commandline interface
75+
Version: 0.8.0+commit.c7dfd78e.Linux.g++
76+
```
77+
78+
The toolbox comes preinstalled with a LTS version of Node, and
79+
[n](https://github.com/tj/n), the Node version manager. You can install other
80+
versions of Node if needed by using `n`. Refer to their website for further
81+
instructions.
82+
83+
```shell
84+
$ sudo n 14
85+
installing : node-v14.21.3
86+
mkdir : /usr/local/n/versions/node/14.21.3
87+
fetch : https://nodejs.org/dist/v14.21.3/node-v14.21.3-linux-arm64.tar.gz
88+
copying : node/14.21.3
89+
installed : v14.21.3 (with npm 6.14.18)
90+
$ node --version
91+
v14.21.3
92+
```
93+
94+
## Usage in CI
95+
96+
A variant of the image is published on GitHub Container Registry as
97+
[`ghcr.io/trailofbits/eth-security-toolbox/ci`](https://github.com/trailofbits/eth-security-toolbox/pkgs/container/eth-security-toolbox%2Fci).
98+
This variant is meant to be slightly lighter, and better suited for its use in
99+
CI contexts such as [GitHub workflow jobs](https://docs.github.com/en/actions/writing-workflows/choosing-where-your-workflow-runs/running-jobs-in-a-container):
100+
101+
102+
```yaml
103+
# workflow triggers, ...
104+
105+
jobs:
106+
tests:
107+
runs-on: ubuntu-latest
108+
container: ghcr.io/trailofbits/eth-security-toolbox/ci:nightly
109+
steps:
110+
# other steps ...
111+
- run: medusa fuzz # or any tool from the image
112+
```
113+
114+
The main differences are:
115+
* The container does not have a dedicated non-root user. All tools are
116+
installed under the root user.
117+
* Most autocompletions are not installed.
118+
* No solc binaries are preinstalled. You may continue to use `solc-select` to
119+
install any binaries you may need.
120+
* pyevmasm and the building secure contracts repository are not included.
121+
122+
## Container image labels
123+
124+
Both `eth-security-toolbox` and `eth-security-toolbox/ci` use the following
125+
label convention:
126+
127+
| Label | Description
128+
|--------------------|--------------------------------------------------------
129+
| `nightly-YYYYMMDD` | Image built from the code in `master` on day YYYY-MM-DD
130+
| `nightly` | Alias for the latest `nightly-YYYYMMDD` container image
131+
| `testing-BRANCH` | Image built when the tip of `BRANCH` was last updated
132+
| `edge` | Alias for `testing-master`
133+
| `TAG` | Image built when `TAG` was tagged
134+
| `latest` | Alias for the latest `TAG` container image
135+
136+
To keep tooling in CI predictable, we recommend picking a `nightly-YYYYMMDD`
137+
image and pinning it by hash on your workflow file. Then, establish a process
138+
to review the changes and update the container reference on a regular cadence,
139+
so that you can continue to benefit from tool improvements. The following
140+
snippet shows the syntax used to pin the image on a GitHub Actions workflow;
141+
the hashes may be obtained from the [container registry page](https://github.com/orgs/trailofbits/packages?repo_name=eth-security-toolbox).
142+
143+
```yaml
144+
container: ghcr.io/trailofbits/eth-security-toolbox/ci:nightly-YYYYMMDD@sha256:HASH_GOES_HERE
145+
```
146+
147+
## Getting Help
148+
149+
Feel free to stop by our [Slack channel](https://slack.empirehacking.nyc/) for
150+
help on using or extending this toolbox.
151+
152+
## License
153+
154+
The Ethereum Security Toolbox is licensed and distributed under the
155+
[AGPLv3](LICENSE) license. [Contact us](mailto:opensource@trailofbits.com) if
156+
you’re looking for an exception to the terms.

‎.devcontainer/eth-security-toolbox/devcontainer.json‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
// For format details, see https://aka.ms/devcontainer.json.
3+
// This is a Dev Container based on eth-security-toolbox image created by Trail of Bits
4+
// check https://github.com/trailofbits/eth-security-toolbox for more information.
5+
"name": "eth-security-toolbox",
6+
7+
// Build configuration - uses the eth-security-toolbox image
8+
"image": "ghcr.io/trailofbits/eth-security-toolbox:nightly",
9+
// Configure tool-specific properties for VS Code
10+
"customizations": {
11+
"vscode": {
12+
// Specialized extensions for smart contract auditing and development
13+
"extensions": [
14+
// check out https://marketplace.visualstudio.com/items?itemName=tintinweb.ethereum-security-bundle for more information
15+
"tintinweb.ethereum-security-bundle", // includes what is listed above ^
16+
"tintinweb.vscode-ethover",
17+
"trailofbits.weaudit",
18+
"trailofbits.contract-explorer",
19+
"trailofbits.sarif-explorer"
20+
],
21+
// VS Code settings optimized for auditing workflows
22+
"settings": {
23+
// Security settings - killswitch for automated tasks
24+
"task.autoDetect": "off", // Disable automatic task detection
25+
"task.problemMatchers.autoDetect": "off", // Disable automatic problem matchers
26+
27+
// Trust and security configuration
28+
"security.workspace.trust.enabled": false, // Trust no one by default
29+
30+
// Privacy settings - killswitch for telemetry
31+
"telemetry.telemetryLevel": "off", // Disable all telemetry collection
32+
33+
// Terminal configuration
34+
"terminal.integrated.defaultProfile.linux": "bash"
35+
}
36+
}
37+
},
38+
39+
// Mount copying host folder into container, no isolation.
40+
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=cached",
41+
// Sets a workspace path entirely isolated within the container
42+
"workspaceFolder": "/workspace",
43+
44+
// Docker run arguments for security hardening and resource management
45+
"runArgs": [
46+
// Read only filesystem except for explicitly writable volumes (check mounts)
47+
// For a dev environment this is more a hussle than a feature.
48+
// "--read-only",
49+
50+
// Temporary filesystem mounts with security restrictions
51+
// These provide isolated, size-limited temporary storage
52+
"--tmpfs=/tmp:rw,noexec,nosuid,size=512m", // Main temporary directory
53+
"--tmpfs=/var/tmp:rw,noexec,nosuid,size=512m", // System temporary directory
54+
"--tmpfs=/dev/shm:rw,noexec,nosuid,size=64m", // Shared memory directory
55+
56+
// Security hardening - drop all Linux capabilities
57+
// This reduces the attack surface by removing unnecessary privileges
58+
"--cap-drop=ALL",
59+
60+
// Security options for container isolation
61+
// A few security additions (AppArmor & no new privileges)
62+
"--security-opt", "no-new-privileges", // Prevent privilege escalation
63+
"--security-opt", "apparmor:docker-default", // Use Docker's default AppArmor profile
64+
65+
// Use seccomp's default security profile
66+
// seccomp provides system call filtering for additional security
67+
// "--security-opt", "seccomp=default",
68+
69+
// Network security configuration
70+
// If you really want to isolate it, just disconnect it from the internet.
71+
// You should COPY your working files inside before, otherwise you'll have to mount them manually.
72+
// "--network=none",
73+
74+
// IPv6 security - disable IPv6 to reduce attack surface
75+
"--sysctl=net.ipv6.conf.all.disable_ipv6=1", // Disable IPv6 globally
76+
"--sysctl=net.ipv6.conf.default.disable_ipv6=1", // Disable IPv6 by default
77+
78+
// Network capability restrictions
79+
"--cap-drop=NET_RAW", // Disable raw packet access
80+
"--network=bridge", // Use bridge networking
81+
82+
// DNS configuration for security and reliability
83+
"--dns=1.1.1.1", // Primary DNS (Cloudflare)
84+
"--dns=1.0.0.1", // Secondary DNS (Cloudflare)
85+
86+
// Resource limits for container performance and security
87+
// Play a little bit with resources to prevent resource exhaustion
88+
// "--memory=512m", // Memory limit (commented out)
89+
// "--cpus=2" // CPU limit (commented out)
90+
]
91+
}

‎.devcontainer/eth-security-toolbox/motd‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
2+
┌── ┌──┐ ──┬──
3+
├─ └──┐ │
4+
└──THEREUM─┴──┴ECURITY─┴OOLBOX
5+
6+
https://github.com/trailofbits/eth-security-toolbox
7+
8+
by ################
9+
##########TRAIL#
10+
####
11+
#### ###########
12+
#### ###########
13+
\### #### ####
14+
/\\# of #### ####
15+
/ \ ############
16+
\__/ #### ####
17+
\### ####
18+
/\\#########
19+
/__\\##BITS#
20+
21+
Security Tools and Resources Installed:
22+
23+
https://github.com/crytic/echidna
24+
https://github.com/crytic/medusa
25+
https://github.com/crytic/slither
26+
https://github.com/crytic/building-secure-contracts
27+
28+
Use `solc-select` to switch between different versions of `solc`
29+

0 commit comments

Comments
 (0)