Smart Contract Testing Core

A production-grade repository demonstrating comprehensive smart contract testing expertise using Foundry, Solidity, and modern QA practices for Smart Contract QA/SDET engineers.

🎯 Purpose

This repository showcases professional smart contract testing methodologies including unit testing, fuzz testing, invariant testing, security analysis, and CI/CD integration. It serves as a portfolio piece demonstrating deep understanding of smart contract security and testing best practices.

🛠 Tech Stack

• Solidity: 0.8.24 with latest security features
• Foundry: Complete testing and development framework
• OpenZeppelin: Industry-standard secure contracts
• Slither: Static analysis for security vulnerabilities
• GitHub Actions: Automated CI/CD pipeline

📁 Repository Structure

smart-contract-testing-core/
├── foundry.toml              # Foundry configuration
├── remappings.txt            # Import remappings
├── .gitignore               # Git ignore rules
├── .env.example             # Environment variables template
├── slither.config.json      # Slither analysis configuration
├── README.md                # This file
│
├── src/                     # Source contracts
│   ├── core/
│   │   └── Vault.sol        # Main vault contract
│   ├── interfaces/
│   │   └── IVault.sol       # Vault interface
│   └── libraries/
│       └── VaultMath.sol    # Mathematical utilities
│
├── test/                    # Test suite
│   ├── unit/
│   │   └── VaultTest.sol    # Unit tests
│   ├── fuzz/
│   │   └── VaultFuzzTest.sol # Fuzz tests
│   ├── invariant/
│   │   └── VaultInvariantTest.sol # Invariant tests
│   ├── mocks/
│   │   └── MockVault.sol    # Mock contract for testing
│   └── utils/
│       └── BaseTest.sol     # Base test utilities
│
├── script/                  # Deployment scripts
│   ├── DeployVault.s.sol    # Vault deployment
│   └── InteractWithVault.s.sol # Interaction demo
│
├── audit/                   # Security audit documentation
│   ├── threat-model.md      # Threat analysis
│   ├── manual-review-checklist.md # Review checklist
│   └── slither/
│       └── slither-findings-placeholder.md # Slither results
│
└── .github/
    └── workflows/
        └── ci.yml           # CI/CD pipeline

🚀 Quick Start

Prerequisites

• Foundry installed
• Git for version control
• Node.js (for Slither analysis)

Installation

1. Clone the repository

   git clone <repository-url>
   cd smart-contract-testing-core

2. Install Foundry dependencies

   forge install

3. Set up environment variables

   cp .env.example .env
   # Edit .env with your configuration

Running Tests

Unit Tests

# Run all unit tests
forge test --no-match-contract invariant -vvv

# Run specific test file
forge test --match-contract VaultTest -vvv

Fuzz Tests

# Run fuzz tests with default runs
forge test --fuzz-runs 256 --no-match-contract invariant -vvv

# Run fuzz tests with more runs for thorough testing
forge test --fuzz-runs 1000 --no-match-contract invariant -vvv

Invariant Tests

# Run invariant tests
forge test --match-contract invariant --invariant-runs 1000 --invariant-depth 50 -vvv

# Run invariant tests with CI profile (more runs)
forge test --match-contract invariant --profile ci -vvv

Coverage Report

# Generate coverage report
forge coverage --report lcov --report summary

# View coverage in browser
npx serve coverage/

🔧 Development Commands

Building

# Build contracts
forge build

# Build with size information
forge build --sizes

Testing

# Run all tests
forge test

# Run tests with verbosity
forge test -vvv

# Run specific test
forge test --match-test testDeposit_Success -vvv

Gas Analysis

# Generate gas report
forge test --gas-report

# Gas optimization hints
forge snapshot

Formatting

# Format code
forge fmt

# Check formatting without changes
forge fmt --check

🛡 Security Analysis

Running Slither

# Install Slither
pip3 install slither-analyzer

# Run Slither analysis
slither .

# Generate reports
slither . --json slither-results/slither-report.json
slither . --markdown slither-results/slither-report.md

# Run with custom configuration
slither . --config slither.config.json

Security Checklist

• Reentrancy protection implemented
• Integer overflow/underflow protection
• Access control mechanisms
• Input validation
• Event emission for state changes
• Emergency pause functionality
• Comprehensive test coverage

📊 Contract Overview

Vault Contract Features

The Vault contract is a simple yet secure ETH vault with the following features:

• ETH Deposits: Users can deposit ETH with proper balance tracking
• ETH Withdrawals: Users can withdraw their deposited ETH
• Emergency Pause: Owner can pause/unpause operations in emergencies
• Reentrancy Protection: All critical functions protected against reentrancy
• Access Control: Owner-only admin functions
• Event Emission: All operations emit appropriate events
• Zero Amount Protection: Rejects zero-amount operations

Key Functions

// Deposit ETH
function deposit() external payable;

// Withdraw ETH
function withdraw(uint256 amount) external;

// Get user balance
function getBalance(address user) external view returns (uint256);

// Emergency pause (owner only)
function emergencyPause() external;

// Unpause (owner only)
function unpause() external;

🧪 Testing Strategy

Unit Testing

• Coverage: All public functions and edge cases
• Focus: Correct behavior, error handling, state changes
• Tools: Foundry's testing framework with custom assertions

Fuzz Testing

• Coverage: Arbitrary input validation
• Focus: Boundary conditions, unexpected inputs
• Tools: Foundry's fuzz testing with vm.assume()

Invariant Testing

• Coverage: System-level properties
• Focus: State consistency, business rules
• Tools: Foundry's invariant testing with handler pattern

Security Testing

• Coverage: Common vulnerability patterns
• Focus: Reentrancy, access control, arithmetic
• Tools: Slither static analysis, manual review

🚀 Deployment

Local Deployment

# Deploy to local Anvil node
anvil
forge script script/DeployVault.s.sol --rpc-url http://localhost:8545 --broadcast

Testnet Deployment

# Deploy to Sepolia testnet
forge script script/DeployVault.s.sol --rpc-url $SEPOLIA_RPC_URL --private-key $PRIVATE_KEY --broadcast --verify

Interaction Script

# Run interaction demo
forge script script/InteractWithVault.s.sol --rpc-url $RPC_URL --private-key $PRIVATE_KEY --broadcast

🔄 CI/CD Pipeline

The repository includes a comprehensive GitHub Actions pipeline that:

1. Builds contracts and verifies compilation
2. Runs unit tests with high verbosity
3. Executes fuzz tests with extensive runs
4. Performs invariant testing with deep analysis
5. Analyzes gas consumption and optimization
6. Runs Slither security analysis
7. Generates coverage reports
8. Deploys to testnet on main branch merges
9. Performs integration testing

Pipeline Jobs

• Build & Test: Core testing and validation
• Security: Comprehensive security analysis
• Deploy: Automated testnet deployment
• Integration: End-to-end testing
• Performance: Gas optimization benchmarks

📈 Why This Repository Matters

For QA/SDET Engineers

This repository demonstrates:

1. Testing Excellence: Comprehensive test coverage across unit, fuzz, and invariant testing
2. Security Mindset: Proactive security analysis and vulnerability prevention
3. Modern Tooling: Mastery of Foundry, Slither, and industry-standard tools
4. CI/CD Discipline: Automated testing and deployment pipelines
5. Clean Architecture: Well-structured, maintainable codebase
6. Documentation: Clear, comprehensive documentation for all components

Key Learning Points

• Foundry Mastery: Advanced testing patterns and techniques
• Security Best Practices: Real-world security implementation
• Professional Standards: Production-ready code quality
• Testing Methodologies: Systematic approach to smart contract testing
• DevOps Integration: CI/CD pipeline for smart contracts

Portfolio Value

This repository serves as a comprehensive demonstration of:

• Technical expertise in smart contract development
• Deep understanding of security principles
• Professional testing methodologies
• Modern development practices
• Problem-solving capabilities

🤝 Contributing

This is a demonstration repository. For production use, consider:

• Multi-sig ownership for enhanced security
• Rate limiting for deposits/withdrawals
• Upgradeability patterns for future enhancements
• Comprehensive monitoring and alerting

📄 License

MIT License - feel free to use this code for learning and reference.

🔗 Resources

• Foundry Documentation
• OpenZeppelin Contracts
• Slither Static Analyzer
• Solidity Security Considerations

📞 Contact

For questions about this repository or smart contract testing practices, feel free to reach out or open an issue.

---

Built with ❤️ for the Smart Contract QA/SDET community