// PRODUCTS · HASHEYE FORGE

Break your tests before attackers break your contracts.

Forge packages Gambit-style Solidity mutation testing for audit readiness: generate mutants, run tests or specs, score what gets killed, and turn survivors into concrete proof gaps.

// forge mutation diff

MUTANT_014

contract Vault {
  function mul(uint256 a, uint256 b) public pure returns (uint256 c) {
-   c = a * b;
+   c = a + b;
  }
}

$ gambit mutate --filename contracts/Vault.sol --solc solc8.20

$ gambit summary --mids 14

survived // no test failed after injected arithmetic fault

// WHAT FORGE PROVES

Coverage is not enough. Forge asks whether tests catch meaningful faults.

Line coverage can say code was executed. Mutation testing asks the sharper question: if important logic changes, does anything fail? Survivors become a prioritized hardening list.

// FORGE PIPELINE

Mutate, run, report.

01

MUTATE

Traverse Solidity ASTs and inject controlled changes into operators, constants, conditions, and call structure.

02

RUN

Run generated mutants through Foundry, Hardhat, or formal specs with the matching solc compiler.

03

REPORT

Summarize killed mutants, survivors, output paths, and the score that tells you how much behavior is proven.

// GAMBIT TOOLING

Full mutation workflow, available from the site.

Forge exposes the underlying Gambit workflow instead of hiding it. Teams can run the source locally, pin solc, generate mutants, inspect summaries, and wire the mutant directories into CI.

// RUN LOCALLY

curl -L https://hasheye.io/tools/gambit-master.zip -o gambit-master.zip
unzip gambit-master.zip
cd gambit-master
cargo install --path .

gambit mutate --json gambit_conf.json
gambit summary

for mutant in gambit_out/mutants/*; do
  cp -R "$mutant"/* .
  forge test
done

// FORGE FAQ

How is Forge different from line coverage?

Line coverage shows code executed. Mutation testing shows whether tests fail when meaningful contract behavior changes.

// TEST STACKS

What test frameworks does Forge support?

Forge is designed for Solidity projects using Foundry, Hardhat, and optional formal specs.

// FEATURES

Mutation testing built for Solidity teams.

Forge keeps the useful Gambit surface area visible: developers can see how mutants are produced, tune where they are produced, and measure what their current test suite misses.

> open_source

Fast, inspectable Solidity mutation generation with the source archive hosted by HashEye.

> easy_integration

Works with test suites and formal-spec workflows; Forge wraps the run and survivor triage.

> adaptive_mutations

Finds valid mutation points by traversing the Solidity abstract syntax tree.

> scored_results

Killed versus surviving mutants becomes a score for test/spec strength.

> high_variability

Generates diverse mutants so teams spend less time on redundant equivalent cases.

> targeted_mutations

Use declarative JSON config to focus mutations on specific contracts, functions, and operator classes.

// OUTCOMES

Proof gaps become engineering work.

The report separates strong evidence from weak evidence. Killed mutants show tests and specs caught injected faults. Survivors show behavior changes your suite allowed.

killed_mutants

caught

Tests or specs failed after the injected fault. This is evidence your checks detect that class of behavior change.

surviving_mutants

gap

Tests still passed after the injected fault. This is the proof gap to close before audit, launch, or upgrade.

// INTEGRATIONS

Fits the stack you already test.

> Solidity contracts and libraries

> Foundry test suites

> Hardhat test suites

> Optional formal specs when available

Forge is a HashEye workflow for Solidity mutation testing. Gambit is MIT-licensed software originally published by Certora; HashEye hosts the source archive, runbook, and config template so teams can run it locally or in CI.

// DETAILS WE TRACK

No black box. Every mutant is traceable.

These are the specific run details HashEye asks for when we turn a mutation run into an audit-readiness report.

operators

binary ops, constants, conditions, argument swaps, statement-level edits

inputs

--filename for one Solidity file or --json for project-level configuration

compiler

uses solc; pin --solc to the compiler version your project expects

paths

--sourceroot controls how original and mutated source paths are reported

outputs

gambit_results.json, mutants.log, input_json, mutants/<id>/...

inspection

gambit summary prints mutant diffs; --mids filters to selected mutant ids

// READY CHECK

Run Forge before the audit report becomes expensive feedback.

Send the repo, test command, target contracts, and any specs. HashEye returns a survivor list your team can fix before external review.

> request_forge_run