OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Developer Tools

Pakala

Pakala is a Python command-line security scanner that symbolically executes a subset of Ethereum Virtual Machine behavior to search smart contracts for exploitable bugs.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Pakala — OpenViST project profile in Developer Tools.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use Pakala as a focused analysis tool when investigating Ethereum contracts for exploitable paths, especially where simple contract logic or transaction sequences are relevant.

Who it is for

  • Ethereum and EVM security researchers examining contract execution paths.
  • Researchers looking for potentially exploitable bugs across smart contracts.

Documented uses

  • Scan a contract for exploitable bugs using symbolic execution.
  • Inspect reported transaction paths, their constraints, and storage reads or writes.
  • Explore multi-transaction behavior and selected storage or hash-related cases.
Before you choose

Requirements & limits

The project documents installation through pip3 and requires Python 3. The repository identifies GPL-3.0 as its license.

  • A finding is reported as a path of transaction states with constraints and storage activity to inspect.
  • A virtual balance can be specified in the documented example to explore a contract with no balance.
  • The tool does not handle gas or precompiles, and general contract-to-contract interactions are unsupported; CALL support is limited to sending ether.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Install Pakala and scan an Ethereum contract

Install Pakala with Python 3, scan the documented example contract with a virtual balance, and inspect the reported execution path.

Before you start

  • Python 3
  • An Ethereum contract address; the documented example is 0xeBE6c7a839A660a0F04BdF6816e2eA182F5d542C

Steps

  1. Install Pakala with the command below.

    Documented command
    pip3 install pakala

  2. Scan the example contract using pakala 0xeBE6c7a839A660a0F04BdF6816e2eA182F5d542C --force-balance="1 ether".

  3. Review the reported bug and dumped states, which describe transactions and their constraints and storage reads or writes.

  4. Inspect calldata[0] in the constraints to identify each transaction's function signature.

Expected outcome

Pakala reports whether it finds a bug and, when one is found, provides a path of states describing the relevant transaction sequence and execution constraints.

Guide limitations

  • Pakala works only with Python 3.
  • It models only a subset of the EVM: it does not handle gas or precompiles, and does not support general contract-to-contract interactions such as DELEGATECALL and STATICCALL. CALL support is limited to sending ether.
  • The forced balance is virtual; it is used in the example because the contract's actual balance is zero.
Documentation 1 ↗Documentation 2 ↗
Evidence and transparency

Sources & review

Official repository ↗Guide documentation ↗
Source record details
Source availability
Active
Sources checked
15 October 2026
Original website title
palkeo/pakala · Official homepage title · retained in its source language
How we review sourcesSuggest a correction