
Security Fundamentals
Obfuscation 101: Unmasking the Tricks Behind Malicious Code
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
Install | Getting Started | Examples | FAQ | Chat | awesome-halmos
Halmos is a symbolic testing tool for EVM smart contracts. A Solidity/Foundry frontend is currently offered by default, with plans to provide support for other languages, such as Vyper and Huff, in the future.
You can read more in our post: "Symbolic testing with Halmos: Leveraging existing tests for formal verification."
Join the Halmos Telegram Group for any inquiries or further discussions.
uv
(recommended for most users)# install uv if you don't have it already
curl -LsSf https://astral.sh/uv/install.sh | sh
# install the latest version of halmos for the current user and add it to PATH
uv tool install --python 3.12 halmos
# or, install the development version from the repository
# uv tool install --python 3.12 git+https://github.com/a16z/halmos
# after installing, you can update halmos to the latest version with:
uv tool upgrade halmos
docker
You can download a pre-built Docker image that contains python, halmos, its dependencies, foundry, solvers, etc.:
docker pull ghcr.io/a16z/halmos:latest
pip
(for advanced users)Note: this is not recommended because of the extra work required to manage the python version and the virtual environment. But if you know what you are doing, and need the extra control, you can do it like this:
# make sure you have a suitable python version installed, e.g.:
python3.12 --version
# create and activate a virtual environment with an explicit python version
python3.12 -m venv .venv && source .venv/bin/activate
# install the latest version of halmos
pip install halmos
# or, install the development version from the repository
pip install git+https://github.com/a16z/halmos
cd /path/to/src
halmos
For more details:
halmos --help
Alternatively, you can run the latest halmos Docker image available at ghcr.io/a16z/halmos:
cd /path/to/src
# mount '.' under /workspace in the container
docker run -v .:/workspace ghcr.io/a16z/halmos:latest
Refer to the getting started guide and the examples directory.
Refer to the contributing guidelines, and explore the list of issues labeled "good first issue" or "help wanted."
These smart contracts and code are being provided as is. No guarantee, representation or warranty is being made, express or implied, as to the safety or correctness of the user interface or the smart contracts and code. They have not been audited and as such there can be no assurance they will work as intended, and users may experience delays, failures, errors, omissions or loss of transmitted information. THE SMART CONTRACTS AND CODE CONTAINED HEREIN ARE FURNISHED AS IS, WHERE IS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT OR FITNESS FOR ANY PARTICULAR PURPOSE. Further, use of any of these smart contracts and code may be restricted or prohibited under applicable law, including securities laws, and it is therefore strongly advised for you to contact a reputable attorney in any jurisdiction where these smart contracts and code may be accessible for any questions or concerns with respect thereto. Further, no information provided in this repo should be construed as investment advice or legal advice for any particular facts or circumstances, and is not meant to replace competent counsel. a16z is not liable for any use of the foregoing, and users should proceed with caution and use at their own risk. See a16z.com/disclosures for more info.
FAQs
A symbolic testing tool for EVM smart contracts
We found that halmos demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
Security News
Join Socket for exclusive networking events, rooftop gatherings, and one-on-one meetings during BSidesSF and RSA 2025 in San Francisco.
Security News
Biome's v2.0 beta introduces custom plugins, domain-specific linting, and type-aware rules while laying groundwork for HTML support and embedded language features in 2025.