Symbolic Execution

Symbolic execution analyzes a contract by treating inputs as symbolic variables rather than concrete values, then using a constraint solver (an SMT solver) to determine which inputs can drive execution down each path — including paths that reach dangerous states like an assertion failure or an unexpected transfer.

How It Works

Instead of running the contract with one input, symbolic execution tracks the logical constraints along each branch. When it finds a path that reaches a target condition, the solver produces a concrete input that triggers it — effectively a proof of reachability.

Strengths and Limits

• Strength: can find deep, specific inputs that fuzzing might miss.
• Limit: "path explosion" — the number of paths grows exponentially, so analysis can be slow or incomplete on large contracts.

Symbolic execution complements static analysis (fast, pattern-based) and fuzzing (random/guided inputs). Mythril is a well-known symbolic-execution tool for EVM bytecode.

Frequently Asked Questions

Q: How is symbolic execution different from fuzzing?

A: Fuzzing runs the contract with many concrete (often randomized) inputs; symbolic execution reasons about inputs abstractly and uses a solver to compute inputs that reach specific states.

---

Q: Why can symbolic execution be slow?

A: Each branch multiplies the number of paths to analyze ("path explosion"), so large or loop-heavy contracts can produce more paths than can be explored exhaustively.