Octopus
A security analysis framework for WebAssembly modules and blockchain smart contracts (BTC/ETH/NEO/EOS).
What is Octopus?
Octopus is a security analysis framework for WebAssembly modules and blockchain smart contracts. It enables deep inspection of closed-source bytecode from platforms like Ethereum, Bitcoin, EOS, and NEO to uncover internal behaviors and potential vulnerabilities. The tool provides disassembly, control flow analysis, call flow graphs, and symbolic execution capabilities.
Security researchers, blockchain auditors, and reverse engineers who need to analyze smart contract bytecode or WebAssembly modules for vulnerabilities, logic flaws, or behavioral understanding.
Octopus offers a unified framework supporting multiple blockchain platforms and WebAssembly, with advanced analysis features like SSA conversion and symbolic execution. It is open-source, extensible, and designed for deep bytecode inspection where source code is unavailable.
Overview
Security Analysis tool for WebAssembly module (wasm) and Blockchain Smart Contracts (BTC/ETH/NEO/EOS)
Use Cases
Best For
- Analyzing Ethereum smart contract bytecode for security vulnerabilities
- Reverse engineering closed-source WebAssembly modules
- Generating control flow graphs for blockchain smart contracts
- Performing symbolic execution on EVM or WASM bytecode
- Auditing multi-platform smart contracts (BTC/ETH/NEO/EOS)
- Researching internal behaviors of blockchain applications
Not Ideal For
- Projects requiring analysis of smart contracts from newer or unsupported blockchains like Binance Smart Chain or Solana
- Teams needing a GUI-based tool for interactive vulnerability scanning without command-line expertise
- Automated audit pipelines that require out-of-the-box vulnerability detection without manual configuration
Pros & Cons
Pros
Supports analysis for WebAssembly, Bitcoin, Ethereum, EOS, and NEO smart contracts, as shown in the comprehensive platforms table with disassembly and CFG features for each.
Includes control flow graphs, call flow analysis, SSA conversion, and symbolic execution, evidenced by the detailed examples for each platform in the README.
Provides in-depth code snippets and API usage for all supported platforms, such as the WebAssembly and Ethereum EVM examples with visualization outputs.
Released under MIT license with Python codebase, allowing customization and integration, as mentioned in the license and dependencies section.
Cons
The README's feature table shows many capabilities as WIP or TODO for certain platforms, like Bitcoin lacking control flow analysis and symbolic execution.
Requires specific Linux environment (Ubuntu 16.04 ideally), Python >=3.5, and system dependencies like graphviz, making installation non-trivial on other OSes.
Primarily designed for manual analysis via command-line tools, with no built-in GUI or CI/CD integration, as indicated by the CLI-focused examples.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.