Symbolic Execution Path Explorer Trigger

WHAT IT DOES

Symbolic Execution Path Explorer Trigger is a security-focused tool that generates symbolic execution path reports and constraint summaries from Solidity contract source code. It parses the contract to extract function signatures and state variables, then analyzes user-provided execution paths or generates default paths for common contract operations. For each path, the tool identifies constraints, determines feasibility (feasible, infeasible, or needs SMT solving), and provides confidence levels. The output includes a comprehensive path report with constraint summaries, function existence verification, and SMT solver input generation. This enables developers and auditors to explore contract behavior symbolically and identify potential vulnerabilities before running full symbolic execution tools.

HOW TO USE

Paste your Solidity source code into the input area. Enter a contract name (optional). Optionally, specify execution paths to explore in the paths input area (one per line). Paths can include function calls with constraints, e.g., "transfer(owner, recipient, amount) where amount > balance" or "mint(to, amount) where hasRole(MINTER_ROLE, msg.sender)". Click "Explore paths" to generate the path report. The tool will display a summary including the number of paths explored, feasible/infeasible paths, and a detailed breakdown of each path with constraints and feasibility analysis. The output also includes SMT solver input for full verification.

TECHNICAL NOTE: PATH CONSTRAINT GENERATION AND FEASIBILITY ANALYSIS

The tool performs static analysis on the Solidity source code using regex-based parsing to extract contract structure. It identifies state variable declarations and function signatures, then processes each user-provided or default path by parsing function names and constraint expressions. The tool checks whether each referenced function exists in the contract, providing warnings for missing functions. For each constraint, the tool analyzes its structure (e.g., balance comparisons, role checks, arithmetic conditions) and assigns a feasibility classification based on the constraint patterns. The tool generates a set of constraint blocks suitable for input to SMT solvers like Z3 or CVC4. The output includes all unique constraints across all paths, formatted as SMT-LIB assertions.

WHAT IT CANNOT SEE

The tool cannot execute actual symbolic execution without an external SMT solver; it only generates path reports and constraint summaries. It cannot guarantee that generated paths are complete or correct for the specific contract logic. It cannot detect all execution paths or vulnerabilities in the contract. The tool is limited to the accuracy of source code analysis; complex patterns may be misidentified. It cannot handle complex contract interactions with external contracts or cross-contract constraints. It cannot verify contracts with non-standard patterns that deviate from common patterns. The tool is limited by the expressiveness of path constraints; some properties may not be expressible in the generated format. It cannot perform state exploration across multiple transactions or complex state transitions.

PLEASE NOTE

This tool is designed exclusively for Solidity source code used on EVM-compatible chains. It does not support other smart contract languages. The generated path reports are preliminary analyses and should be validated with formal verification tools. The tool does not execute symbolic execution; it only generates constraints and feasibility summaries. Always verify that the generated paths and constraints match the intended contract behavior. The tool provides no warranty that the generated constraints will result in successful verification; users are responsible for validating all properties and assumptions.