Scribble Specification & Property-Based Verification

Consensys Diligence provides a comprehensive formal verification toolkit combining the Scribble specification language with advanced property-based fuzzing and automated security analysis to mathematically prove smart contract correctness.

Scribble Specification Language

Scribble is a specification language and runtime verification tool that enables developers to write high-level security properties and invariants directly into their Solidity smart contracts. Developers annotate their smart contracts with Scribble specifications describing how the code should behave - for example, "user token balance never exceeds total supply" or "only authorized addresses can withdraw funds." Scribble then translates these high-level properties into concrete Solidity code that verifies the specifications at runtime during testing.

Key Benefits

Easy to Learn: Scribble is based on Solidity syntax, making it intuitive for smart contract developers to adopt without learning a completely new language.

Widely Compatible: Uses standard Solidity assertions, so specifications work with most automatic testing tools including fuzzers, symbolic execution engines, and static analyzers.

Accessible Documentation: Properties are written where the code lives, making specifications easy to find, understand, and maintain alongside implementation changes.

Property-Based Fuzzing

Scribble properties integrate seamlessly with Diligence Fuzzing platform, an enterprise-grade gray-box property-based fuzzing system that automatically tests smart contracts by generating and executing millions of transaction sequences. The fuzzer uses coverage-guided testing, input prediction algorithms, and transaction sequence simulation to systematically explore all possible execution paths and find edge cases that violate defined properties.

Coverage-Guided Fuzzing: Builds a corpus of inputs that systematically increases code coverage, exploring all possible execution paths through your smart contract system.

Time Machine: Simulates different time intervals between transactions to test functionality that may break in the future or depend on specific timing conditions.

Incremental Fuzzing: Provides quick feedback when running campaigns on previously fuzzed code by focusing on changed sections.

Automated Security Analysis

MythX automated security analysis API provides additional verification layer through multi-engine analysis that scans for common vulnerability patterns, security flaws, and potential attack vectors. Integrates directly into development workflows for continuous security verification.

Pricing and Plans

Diligence Fuzzing available in multiple tiers: Explorer (free, 100 5-minute campaigns), Builder ($250/month, unlimited 1-hour campaigns), Pro Builder ($1,999/month, unlimited hours, 2x performance), and Enterprise (custom pricing, 4x performance, multiple simultaneous campaigns). Scribble is open-source and installed via npm.