Registry / security / mythril

mythril

JSON →
library0.24.8pypypiunverified

Mythril is a security analysis tool for Ethereum smart contracts. It detects common vulnerabilities using symbolic execution, taint analysis, and SMT solving. Current version 0.24.8 targets Solidity 0.8.x and is released with moderate cadence (every few months).

securitydevops
pip install mythril
github ↗homepage ↗
INSTALL
IMPORT
SIG · MYTHRIL
M
mythril
securitypythonv0.24.8
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Mythril
✓ from mythril import Mythril
✗ from mythril.mythril import Mythril
Prior to v0.23.0, Mythril was inside mythril package as mythril.mythril.Mythril. Now it's exposed at top level.
MythrilDisassembler
✓ from mythril import MythrilDisassembler
✗ mythril.disassembler.MythrilDisassembler
The disassembler class moved to top-level import.

Initialize Mythril with a Web3 provider, then analyze a deployed contract by address or raw bytecode.

from mythril import Mythril from web3 import Web3 rpc = os.environ.get('ETH_RPC_URL', 'http://localhost:8545') w3 = Web3(Web3.HTTPProvider(rpc)) myth = Mythril(ether=w3.eth) # Analyze a contract from address address = '0x...' analysis = myth.analyze(address) print(analysis.vulnerabilities) # Or analyze from bytecode bytecode = '0x60806040...' analysis = myth.analyze_bytecode(bytecode) print(analysis.vulnerabilities)
Debug
Known issues
breakingIn v0.22.x, the class `Mythril` was removed; use `MythrilAnalyzer` instead. In v0.23.0, `Mythril` was reinstated as the primary API.
fix
If on v0.22.x, use `from mythril import MythrilAnalyzer`. If on v0.23+, use `from mythril import Mythril`.
affects: >=0.22.0, <0.23.0
gotchaMythril requires a running Ethereum node or the `--infura` flag. Without a provider, analysis will hang or fail with connection errors.
fix
Provide a valid RPC URL via environment variable `ETH_RPC_URL` or use `--rpc` in CLI. For Infura, use `--infura-mainnet`.
affects: all
deprecatedThe `--execution-timeout` flag is deprecated; use `--timeout` instead.
fix
Replace `--execution-timeout` with `--timeout`.
affects: >=0.23.0
gotchaSymbolic execution can be very slow on complex contracts. Default timeout (600s) may not be enough.
fix
Increase timeout via `--timeout 1200` or set `analysis_timeout` in the Mythril constructor.
affects: all
breakingThe `mythril.mythril.MythrilAnalyzer` import path was removed in v0.24.0. Always use `from mythril import MythrilAnalyzer`.
fix
Update imports to top-level: `from mythril import MythrilAnalyzer`.
affects: >=0.24.0
Upgrade
Version history
0.24.8latest on PyPI · released Mar 27, 2024
Audit
Dependencies
solc-selectoptionalMythril uses solc-select to manage Solidity compiler versions; missing solc will cause analysis failures.
graphvizoptionalRequired to generate control flow graph (CFG) visualizations via --graph.
Agent activity
20 hits · last 30 days
node
18
Resources
githubhttps://github.com/ConsenSys/mythril ↗
homepagehttps://github.com/ConsenSys/mythril ↗
mythril — pip install mythril · libregistry