# About MetaTrust
## What is MetaTrust?
MetaTrust is dedicated to building a secure infrastructure for WEB 3.0 developers. Our team brings together top security researchers and experienced experts from academia and industry.MetaTrust Solutions
Our tools and solutions cover all attack surface
## **MetaTrust Solutions**
Construct a secure system for the comprehensive life cycle management of Web3.0 projects, featuring four core products: [MPM](/introduction/mpm), [MetaScan](/introduction/metascan), [MetaScout](/introduction/metascout), and [MetaScore](/introduction/metascore).
# MetaScan
Overview of MetaScan
## Introduction
MetaScan adopts a revolutionary approach that puts developers first. It integrates multiple security scanning engines into a single platform with unprecedented speed and accuracy, ensuring the protection of every layer of the application, not just the smart contract layer.MetaScan security platform includes multiple critical engines:
MetaScan security platform includes multiple critical engines:
* [Security Analyzer](/introduction/metascan/security-analyzer): Detect security vulnerabilities in smart contracts.
* [Security Prover](/introduction/metascan/security-prover): Prove free of vulnerability in smart contracts using formal methods.
* [GPTScan](/introduction/metascan/gptscan): Harnessing the Potential of GPT for Accurate Vulnerability Detection.
* [Open Source Analyzer](/introduction/mpm): Supply chain analysis tool which pinpoints vulnerabilities in a developer's open-source dependencies early in the entire software development lifecycle.
* [IP Analyzer:](broken://pages/6qWvGiFdmBVxnCqy6LEB) Detect vulnerabilities in smart contracts caused by code clones.
* [Code Quality](/introduction/metascan/code-quality): Detect contract code quality and code convention compliance.
## Environments
MetaScan provides multiple ways to utilize the product:
### WEB
The MetaScan Web UI at offers a user-friendly, browser-based experience. It incorporates features like organization management, issue filtering, and report generation for resolving identified issues.
### API Integration
Experienced users and partners have the option to leverage MetaScan's APIs to explore its functionalities. The APIs encompass a wide range of common operations that can be performed on the web platform, including project creation, scan execution, and retrieval of scan results.
The API documentation can be accessed at
# Security Analyzer
Introduction to the Security Analyzer scan engine
Security analyzer is an automatic static analysis tool for detecting smart contract vulnerabilities. In this tool, we adopted the context-sensitive, flow-sensitive, money-sensitive technologies to conduct static analysis. First, we collected the almost-known vulnerable smart contracts, and analyzed how these vulnerabilities happened. Then, we designed our threat analysis model to accurately abstract the pattern of these vulnerabilities. Third, we developed more than 100 rules to automatically detect these vulnerabilities. In total, we have developed 12 categories of vulnerabilities as follows:
* Compiler: Vulnerabilities that derive from the solidity compilers, such as the array usage in ABIEncoderV2 in 0.5.9 version.
* Cross-chain: Bugs related with cross-chain bridges, such as the private key leakage.
* Blockchain: Come from the API usage related blockchain, such as block.number, GasLeft, block.difficulty, etc.
* Language: Common vulnerabilities in smart contract languages, such as reentrancy, integer overflow.
* ERC: Happen due to the ERC standards, such as the event missing in some function, the index missing in event emit.
* Cryptography: Related with the cryptography algorithm and usage, such as signature malleability, ecrecover usage.
* Controlled resource: Indicate the vulnerabilities that are related controlled source, such as the access control.
* Protocol: Vulnerabilities in design and implementation of protocol (e.g., DeFi), including the economic model security.
* DeFi liquidity model: Abnormal settlement and reward collection due to the use of easily manipulated price dependencies in economic model.
* DeFi economic model: The dangerous DeFi economic model formed by the combination of complex DeFi behaviors.
* NFT: Additional tokens are minted during NFT minting, causing losses to the project party, such as false deposit.
* DAO: Dangerous DAO voting design, leading to the main permissions being manipulated by attackers, such as flash-loan based DAO voting attacks.
With the release of MetaScan Verison 1.7, we also provide the integration of AI into the Security Analyzer. Leveraging the advanced capabilities of ChatGPT, our AI augmentation provides enhanced vulnerability detection, comprehensive insights, and actionable recommendations to fix identified issues. We encourage you to test drive this new feature and share feedback so we can refine it further. The AI augmentation makes MetaScan more powerful and easy to use for developers.
# Security Prover
Introduction to the Security Prover scan engine
Prover is a dynamic scanning engine that runs code and explores the state space of all its execution processes. During exploration, Prover detects vulnerabilities based on execution characteristics such as property changes and execution paths. Meanwhile, Prover can prove the absence of critical vulnerabilities like reentrancy through sufficient constraint conditions. Thus, the Prover engine both detects vulnerabilities and verifies the existence of critical vulnerabilities in the code.
To implement the Prover product, we built a symbolic execution engine based on the semantic layer, supporting automatic generation of code state spaces and allowing users to write Prover scripts in Solidity to mine state spaces.
Prover's vulnerability detection includes: compiling contract files to generate AST trees, dynamically executing statements and recording the process. Finally, it determines whether there are vulnerabilities based on the state space, execution paths, and built-in rules.
Prover's safety proofs define safety proof conditions for each type of vulnerability, such as reentrancy, after obtaining the state space, thereby proving that corresponding vulnerabilities will not occur in the code.
Prover's property proofs use user-defined MAIN functions to verify that contract properties do not violate rules during contract execution.
Compared to static engines, Prover has higher reliability and lower false alarm rates because the code state spaces it analyzes are truly executable.
# GPTScan
Unleash the Power of GPT for Precise Smart Contract Vulnerability Detection
GPTScan is a groundbreaking solution that combines the power of GPT (Generative Pre-trained Transformer) with static analysis to detect logic vulnerabilities in smart contracts. Unlike traditional approaches that solely rely on GPT for vulnerability identification, GPTScan leverages GPT as a versatile code understanding tool. By breaking down each logic vulnerability type into scenarios and properties, GPTScan intelligently matches candidate vulnerabilities with GPT. To ensure precision, GPTScan provides explicit instructions to GPT for recognizing key variables and statements, validating them through static confirmation.
Through extensive evaluation on diverse datasets comprising approximately 400 contract projects and 3,000 Solidity files, GPTScan has demonstrated remarkable performance. It achieves a high precision rate of over 90% for token contracts and an acceptable precision of 57.14% for larger projects such as Web3Bugs. With an impressive recall rate of over 80%, GPTScan effectively detects groundtruth logic vulnerabilities, including 9 new vulnerabilities that went unnoticed by human auditors.
Apart from its accuracy, GPTScan is fast and cost-effective, requiring an average of only 14.39 seconds and 0.01 USD to scan per thousand lines of Solidity code. The integration of static confirmation significantly reduces false positives by two-thirds, enhancing the overall efficiency of vulnerability detection.
GPTScan marks a significant advancement in smart contract security, providing developers and auditors with a comprehensive and reliable tool for identifying logic vulnerabilities. With its unique combination of GPT and static analysis, GPTScan sets a new standard in the field of smart contract security assessment.
Detailed paper about GPTScan:
# Open Source Analyzer
**Open Source Analyzer** (also known as SCA, Software Supply-Chain Analyzer) is a powerful engine designed to identify, monitor, and manage the various components and their dependencies within software. it provides developers and security experts with an in-depth understanding of software composition, enabling them to more effectively control risks and ensure system security.
Key features include:
1. Open-source component identification: SCA can automatically detect open-source components and version information used in software, facilitating tracking and management of open-source dependencies.
2. License compliance: SCA can review software component licenses, ensuring that businesses adhere to relevant regulations and compliance requirements.
3. Security vulnerability detection: SCA can identify known security flaws and risks, assisting developers in promptly patching vulnerabilities and reducing system security risks.
4. Dependency analysis: SCA can analyze the dependency structure between components, helping developers understand component interaction relationships and potential risk points.
# IP Analyzer
Introduction to the IP Analyzer scan engine
The IP Analzyer (Code-Clone) Engine is specifically designed to provide efficient and effective solutions for project IP analysis and smart contract security issue detection.Key features include:
1. Advanced code clone detection: Conducting detailed clone detection at the project, file, function, and line levels to ensure comprehensive coverage. By analyzing patterns of known security issues, it promptly identifies potential vulnerabilities in cloned code, helping users take preventive measures.
2. Open-source component insights: Providing detailed information about imported and cloned code, such as popularity, usage, and maturity, to help developers better understand the use of open-source components in their projects.
# Code Quality
The Code Quality (Lint) engine is a code quality analysis tool that performs static analysis on contract code to identify coding issues, potential errors, and non-compliant code. Its main features include:
* Code style checking: Ensuring that the code follows preset coding standards to improve consistency and readability.
* Potential error detection: Static analysis reveals problems that may cause crashes, reduced performance, or logic errors, and provides repair suggestions.
* Code optimization recommendations: Analyzing performance bottlenecks and unnecessary complexity and providing structural and performance optimization solutions.
* Maintainability analysis: Evaluating code maintainability, identifying parts that need refactoring, and improving maintainability and scalability.
Using the Lint engine helps ensure contract code stability and maintainability, improves project quality and reliability.
# MetaScout
MetaScout is a dynamic, real-time intelligent contract security monitoring platform, mainly including the following monitoring:
* On-chain Monitoring: Transaction analysis for governance attack, market price fluctuation monitoring, social sentiment monitoring, etc.
* Continuous Security Monitoring:By continuously monitoring and assessing the security situation, developers can ensure that their smart contracts maintain optimal security, thereby reducing the risk of attacks and losses.
* Online Abnormal Behavior Monitoring: Analysis of security events based on monitored behavior attacks.
# MetaScore
## Overview
MetaScore is an innovative platform dedicated to providing comprehensive and valuable security insights by deeply analyzing smart contract codes in Web3 projects. As a value-neutral platform, MetaScore automatically identifies project security risks, serving a diverse user base including investors, project owners, developers, and Web3 media. Our services cover various aspects, such as project security rankings, real-time project security risk alerts, Web3 big data trend dashboard, and Web3 project technology trends.
Firstly, to implement project security rankings, we've constructed a multi-dimensional Web3 project security scoring and rating model. By scanning smart contract codes with our proprietary engine, we identify potential risks and generate comprehensive scores. This helps investors to fully assess the security of Web3 projects and make informed decisions. At the same time, project owners can understand their project's security position within the industry and take appropriate measures to enhance security.
Secondly, leveraging MetaScout's round-the-clock multi-chain transaction monitoring and Migration Attack Analyzer's migration attack detection capabilities, MetaScore provides users with real-time risk information for their followed projects. This enables investors and project owners to respond to risks promptly, protecting assets and avoiding financial losses.
Furthermore, we showcase the Web3 big data trend dashboard from multiple perspectives, revealing the overall security risk landscape for various stakeholders while continuously providing news materials for Web3 media.
Lastly, with IP Analyzer's code clone analysis, we offer MetaStack analysis for each Web3 project, displaying the technical frameworks and templates used in the projects. We also present the industry's technology framework evolution from a macro perspective, assisting project builders in tracking advanced security technologies and reducing security risks.
In summary, MetaScore empowers the Web3 community to build and invest in decentralized projects confidently through comprehensive security analysis and risk assessment, driving Web3's progress.
It is worth noting that to prevent security risk information from being maliciously exploited, MetaScore displays differentiated security risk information for different user types. For ordinary investors, we only display risk statistics identified in various dimensions. Upon automatically identifying and manually confirming a severe risk in a project, we promptly notify the project owner and, after verifying their identity, provide the specific risk location. Simultaneously, we offer corresponding repair suggestions, helping project owners resolve issues in a short time.By adopting this approach, MetaScore ensures that security information is not maliciously exploited while providing project owners with timely security risk alerts and solutions to protect the overall security and stability of the Web3 ecosystem.
Through continuous optimization of our services and technology, MetaScore strives to become the most trusted Web3 project security analysis platform in the industry. Our goal is to provide comprehensive security services to a diverse user base, including investors, project owners, developers, and Web3 media, fostering the healthy development of the entire Web3 industry. We believe that through our efforts and expertise, MetaScore will earn the trust and support of a wide range of users, contributing to building a safer Web3 world.
## Contact Us:
Website:
Twitter:
Email:
# Data
As of April 10, 2023, the MetaScore platform has scanned, rated, ranked, and provided risk alerts for important Web3 projects from mainstream platforms such as Web3 websites and exchanges. To determine the list of projects, we followed these steps:
Firstly, we collected unique Web3 projects from Web3 websites and exchange databases. Then, we ranked these projects by calculating the average of their rankings on various platforms.
Currently, we are committed to conducting comprehensive scanning, rating, ranking, and risk alerts for every Web3 project that can be publicly accessed on the Internet. We strive to provide the most comprehensive and accurate security analysis and risk assessment tools to help the Web3 community and investors build and invest in reliable projects in the decentralized network, driving the sustainable development of Web3.
# Dimensions in portrait system
The MetaScore portrait system aims to describe the health status of Web3 projects in the open source ecosystem under a security background. We have created six dimensions to build the Web3 project portrait system: Security Development, Security Investment, Transaction Risk, IP Risk, Code Quality Risk, and Development Process Risk.
**Security Development:** This dimension aims to evaluate the vulnerabilities and malicious code in the project's smart contract code to discover potential exploitable vulnerabilities and prevent investors from falling into trading traps.
**Security Investment:** This dimension aims to evaluate the project's investment in security, including whether there are dedicated security teams or experts involved in project development, as well as whether security audits, bug bounty programs, and insurance are implemented.
**Transaction Risk:** This dimension aims to evaluate the security and reliability of the project's smart contract in transactions, as well as whether the project adopts secure asset management and transaction processes to protect users' assets and privacy.
**IP Risk:** This dimension aims to evaluate the risk brought by code cloning and the legal risks of the project's intellectual property and code copyright, as well as whether the project follows relevant intellectual property laws and regulations to protect the interests of the project team and investors.
**Code Quality Risk:** This dimension aims to evaluate the quality, structure, and maintainability of the project's code to ensure the reliability and scalability of the code.
**Development Process Risk**(Coming soon): This dimension aims to evaluate the security practices, code review, and testing processes of the project's code in the development process, as well as whether the best security practices are adopted to ensure the security and stability of the code.
By evaluating these dimensions, we can comprehensively and deeply understand the security status of Web3 projects and provide more accurate security assessments and risk warnings for project teams and investors. We are committed to providing the most comprehensive and accurate security assessment tools to help the Web3 community and investors build trustworthy projects and promote the sustainable development of Web3.
# Score and Rating
## 1. Score
Our proprietary tool is used to scan the projects to be analyzed. In each rating dimension, the project is ranked based on the tool's scan results and a ranking score is calculated, ranging from 0-100. The ranking scores of several dimensions are weighted to give each project a total score, which serves as the project's final security score. The determination of the weight value of each dimension is based on the APH hierarchical method \[1].
The scoring process involves the following important aspects:
1\). A higher security score for a project indicates that it is more secure and trustworthy.
2\). When calculating the ranking score based on the engine's scan results, a reverse ranking is used. For example, if a project has more vulnerabilities detected by the vulnerability scanning engine, its ranking score will be relatively lower.
## 2. Rating
Here is the score and rating comparison table in descending order:
| Score Range | Rating |
| ----------- | ------ |
| 95-100 | AAA |
| 90-95 | AA |
| 80-90 | A |
| 75-80 | BBB |
| 65-75 | BB |
| 60-65 | B |
| 50-60 | CCC |
| 45-50 | CC |
| 40-45 | C |
| 30-40 | DDD |
| 20-30 | DD |
| <20 | D |
This table is used to assign the corresponding rating to the project based on its final security score. The rating system ranges from AAA (highest) to DDD (lowest).
\[1] AHP,
# MPM
The MPM is the Meta Package Manager that are specifically designed to provide a more secured and light-weighted solution for the publishment, maintenance, distribution, integration, and security of the supply chain of Web3 projects, including not only the Web3 contracts, but also the web2 infrastructures. Based on MPM, we aim to provide a better integrated solution for the community to establish a more secured Web3 ecosystem. MPM consists of 6 main submodules, MPM Registry, MPM Advisory, MPM Client, MPM Backend, MPM Auditing, and MPM Configuration.
* MPM Registry is a private registry to maintain the artifacts and their corresponding metadata that are verified by us, and it also provides the comprehensive security profiles of the commonly used third-party libraries and smart contracts. Based on this, we can make comprehensive decisions on handling and mitigating security threats within users’ projects.
* MPM Advisory is an advisory database to maintain the security related information (i.e., vulnerabilities) for both web2 and web3 components (i.e., third party libraries and smart contracts, etc.), including not only public vulnerabilities, but also vulnerabilities collected by our other powerful scanners. This also play an important role to mitigate security threats within users’ projects.
* MPM Client is the package manager client, with which users can not only easily manage their dependencies (i.e., smart contracts, third-party libraries, etc) in secured ways, but also obtain comprehensive profiles (i.e., from MetaScore) of their own projects before publishment or on-chain, by interacting with our powerful engines (i.e., MPM Auditing and MPM Backend).
* MPM Backend is the backend service that processes requests from MPM Client and make right decisions on remediation strategies by not only taking the potential security risks (i.e., Meta Advisory) into consideration, but also considering the non-functional properties (i.e., the profiles in MPM Registry) so that we can provide the most appropriate and comprehensive strategies on dependency management.
* MPM Auditing is a front end of the engines behind MetaScore, which with, we are able to provide a comprehensive analysis of users’ projects before they are published or on-chain.
* MPM Configuration is a set of new configuration options realized by a new domain specific language for Web3 project configuration management, which not only offers a new and more light-weighted way for users to define their dependencies on external smart contracts, but also provides a flexible and configurable way for users to control the thresholds and priorities when deriving integrated solutions on dependency management.
# Getting Started with MetaScan
Discover the power of MetaScan: Your essential tool for secure smart contract and Web3 project scanning
This document describes the necessary steps you should follow to get started with using MetaScan. These steps cover the entire workflow, from account creation to obain security analysis report.
1. [Sign-up and sign-in](/getting-started/getting-started-with-metascan/sign-up-and-sign-in)
2. [Set up an integration (optional)](/getting-started/getting-started-with-metascan/set-up-an-integration-optional)
3. [Add projects](/getting-started/getting-started-with-metascan/add-projects)
4. [Scan for vulnerabilities](/getting-started/getting-started-with-metascan/scan-for-vulnerabilities)
5. [View scan results](/getting-started/getting-started-with-metascan/scan-for-vulnerabilities)
6. [Generate and download scan reports](/getting-started/getting-started-with-metascan/generate-and-download-scan-reports)
# Sign-Up and Sign-In
MetaScan is available at [https://app.metatrust.io.](https://app.metatrust.io)
You need to setup an account and sign-in with that account to access all the features.
There are 2 ways to sign-in to MetaScan:
* Create an account with your email then sign-in
* Sign in using an existing third-party account via OAuth login
## Create an Account
1. Click the link "Sign up now" on the sign-in page, , which redirects you to the sign-up form.
2. Fill in your email and passwords, accept our terms and privacy policy on the sign-up page, then click the button "Sign Up Now".
3. You will receive an email with a confirmation link in a minute or two. Click the link to confirm your email address. The link will open the MetaScan page and automatically log you into the platform.
## Sign In Using Third-Party Identity (OAuth)
If you'd like to sign in with your identity at a third-party service (like GitHub) without going through the sign-up process, follow these steps:
(We are going to use GitHub as an example here)
1. Click on the **GitHub icon** on the sign-in page.
2. The browse will redirect to GitHub.
3. If this is your first time using this sign-in method, you need to confirm to let MetaScan use your GitHub identity. Read the information on the GitHub page and click "**Authorize MetaTrustLabs**".
4. Your browser will redirect back to MetaScan and you will automatically sign-in.
{% hint style="info" %}
We are working hard to add support for other popular 3rd-party services, and you will be able to sign in with your Google or Twitter account soon.
{% endhint %}
# Set Up an Integration (Optional)
If you plan to scan your GitHub repositories for vulnerability, you need to setup an integration and grant access of your repositories to MetaScan.
{% hint style="info" %}
This step can be skipped if you plan to scan code in a public repository or in an uploaded zip-file.
{% endhint %}
## Integration Types
Users can set the appropriate source code platform where the projects to be scanned are located.
## Example: Setting up source code management integration
If you want to scan projects in Git's source code platform, you will need to use Git Repository Integration to connect. MetaScan has pre-built integrations for GitHub, with subsequent extensions for other repositories GitLab, Bitbucket, etc.
**First**, after the user logs in successfully, click \[Integrations] to enter its main interface.
**Next**, click on the source code platform (e.g., GitHub) to integrate with MetaScan.
**Finally**, to grant MetaScan access to the source code platform, enter your account credentials and save your information when prompted.
# Add Projects
MetaScan assists users in scanning problematic projects to identify vulnerabilities in them. You first need to add a project.
You can add projects in two easy steps:
**Step 01:** Click \[Projects] -> \[Add Project], you can choose \[GitHub] or \[Upload] to get the projects you want to scan.
**Step 02:** For GitHub selection as example 1, you can select the repositories stored in it. For Upload selection as example 2, you can upload the local projects.
**Example 1**: After selecting GitHub, you can select the project \[v3-core], and finally click the \[confirm] button to import this project.
After importing the project \[v3-core] successfully, you will see the following screenshot:
**Example 2**: You can also import projects by uploading local files following the guide.
# Scan for Vulnerabilities
We support flexible configuration of scanning parameters, mainly engine configuration and standardized configuration, before the project starts to be scanned.
## Flexible configuration
### **Engine configuration：**
After the user clicks the \[Start Scan] button located on the right side of the imported project, MetaScan will confirm the engine configuration with the user.
### Standardized configuration：
Moreover, users can also click "Advanced Scan Settings" to set personalized parameter configuration.
## Start scanning
After the project scanning parameters are configured, users can click the \[Start Scan] button to start scanning the project automatically. The project will be in scanning status.
# View Scan Results
After completing the scan, users can view the details of the scan results.
**Step 01**: Once the project scan is complete, users can directly view the scan results.
**Step 02:** For scanned projects, users can click on the name of any engine on the left to navigate to the specific details page to check the detail.
# Generate and Download Scan Reports
After the project is scanned, the system will automatically generate a security report for the project, and users can download the report on demand to view the details.
In the upper right corner of the project's detail page, click on the \[Reports] drop-down menu and users can select the scanned engine to download the report in .PDF format.
# How to use Security Prover
A step-by-step guide for using the scanning engine Security Prover on MetaScan
Here is a step-by-step guide for using the scanning engine Security Prover on MetaScan based on the demo contract code. You can also watch the [video instructions](https://youtu.be/CatvrkcJTNk). (Video Link: )
1. Upload the smart contract to MetaScan.\
Click "Add Projects" and select "Upload Files" to add the project that needs scanning.
2. Select the appropriate project type based on the situation. Here we select "Framework-less Solidity Files" and click "Continue".
3. Upload a zip file of the project and click "Continue".
4. Input a project name and click "Upload" to upload the project.
5. Configure contract analysis settings and scan. Click "Start Scan" to prepare for scanning.
6. Select "Security Prover" and fill in the name of the contract to verify in "Entry Contract", here we fill in "Token". Then click "Start Scan" to start security scanning.
7. Review key metrics and information from the report.
8. Click on "EquailzationOfTransferBalances" under "Rules" and check the "Call Trace" information based on violation.\
From the information, we know the violated condition is `assert(balanceBefore == balanceAfter);`\
From the "Rule Call Resolutions" on the right, we know that when msg.sender is the same as $to, it will violate the check condition
9. Click on the "transfer" in the "Call Trace" to check deeper call stack information.\
In `uint256 senderAmount = _balances[sender];` senderAmount is 20000\
In `uint256 recipientAmount = _balances[recipient];` recipientAmount is 20000
10. After calling `_balances[sender] = senderAmount.sub(amount);`, `_balances[sender]` becomes 19900
11. After calling `_balances[recipient] = recipientAmount.add(amount);`, `_balances[recipient]` becomes 20100
**Thus the assertion `assert(balanceBefore == balanceAfter);` is finally violated.**
# MetaScan
## Overview
By incorporating four major security engines, MetaScan can continuously analyze and review the quality of smart contract project source code, and can quickly detect security vulnerabilities, duplicate code and other issues in the project.
MetaScan can greatly improve the efficiency of detecting vulnerabilities in smart contracts and effectively reduce the risk of missing security risks.
# Projects
#### **Step01: Import a Project**
Click \[Projects] -> \[Add Project], Users can choose the following two methods to add projects to be scanned, as shown in the following figures.
**Method 1: By GitHub**
After selecting GitHub, you can select the project \[v3-core], and finally click the \[confirm] button to import this project.
**Method 2: Upload**
You can also import projects by uploading local files following the guide.
The main screen for selecting the file to upload will then pop up. The user can click on the \[upload] icon in the middle to upload the document, or drag document to that area to complete the operation of uploading files. For our example here, we uploaded the local file: v3-core-main.zip
Finally, after uploading the file successfully, click the \[Upload] button to complete the local upload.
After successfully uploading local files, the main screen displays the currently uploaded projects.
#### **Step02:** Setting the scan configuration
#### **Engine configuration：**
After the user clicks the \[Start Scan] button located on the right side of the imported project, MetaScan will confirm the engine configuration with the user.
#### Standard configuration
Moreover, users can also click "Advanced Scan Settings" to set personalized parameter configuration.
#### **Step03: Start Scanning**
After the project scanning parameters are configured, users can click the \[Start Scan] button to start scanning the project automatically. The project will be in scanning status.
# Reports
Once the project scan is complete, users can directly view the scan results.
**Step01:** Users can click on the name of any engine on the left to navigate to the specific details page to check the detail.
**Step02:** The information in the details page can be exported as a report. The user needs to first click on the \[report] button, and then in the drop-down menu, select the desired engine scan report. The system will automatically generate and download the report.
After the download is successful, you can view the report immediately according to the prompt.
# Users and Organizations
Each account can create different organizations, add different members under the organization, and share projects within the members.
## Create Organization
**Step01:** Click \[Personal], a dialog box will pop up.
**Step02:** Click the \[+] button to bring up a dialog box to create an organization.
**Step03:** Fill in the Organization name and click \[Submit] to store it.
**Step04:** Finally, in order to view the organization just created, users can click on the Personal Center in the upper right corner of the page to view and edit organization information.
## Add organization members
For adding organization members, users should first select organization.
Click \[Organization] in the Personal Center to enter the main interface of Organization. Users can click on the currently displayed organization, or switch between different organizations. In our example, aptos is selected.
**Step01:** Click the \[Invite a member] button.
**Step02:** In the member invitation dialog box, you need to fill in the email and select role of the member to be invited. Then click \[Submit] to save.
**Step03:** After adding members successfully, the current list of members and their status will be displayed in the member list.
**Step04:** After the invited user receives the email, he/she needs to click the invitation link in the email to enter the MetaTrust website, and then click the \[Join] button. After the system gives the message "Save successfully", the user can become a member of the organization.
**Step05:** Finally, Refresh the main screen of the organization and you can see that the status of the invited user has changed to joined.
# FAQs
Frequently Asked Questions
## How to ensure accurate and valid scan results?
In order for our scan engines to produce accurate and valid scan results, the projects imported should fulfill the following prerequisites:
* Projects should contain smart contracts written in Solidity language (.sol files)
* Projects should be able to compile successfully
* For mono-repos – repositories that contain multiple projects, it is necessary to specify the sub-directory of a specific project you want to scan for issues. This is configurable in the "***Advanced Settings***" section in the *Start Scan* dialog.\
\
For example: the repository in the following screenshot contains 3 sub-projects and each of them is a standalone, hardhat-based web3-project. It is then necessary to make sure the sub-path setting is set to a specific sub-project directory when the scan is started.
## What to do if the security scan fails?
There could be various reasons that prohibit the scan engines to delivery the final scan results. The most common problems are:
1. Invalid project
2. Missing project dependencies
3. Unsuccessful compilation of the project
## What smart contract / web3 frameworks are currently supported?
## What smart contract formats / languages are currently supported?
# Glossary
To make the user documentation easier to use, we have developed specialized terminology, as described below:
* **B**
* **Broker**
A system that takes the source code and builds the deployable application (such as a Security Analyzer).
* **D**
* **Dependency**
When your application uses another package, this other package becomes dependent on your software.
(1)A direct dependency is a package you include in your project.
(2)An indirect dependency (also known as a deep, chained, or transitive dependency) is a package used by one of your direct dependencies.
* **Dependency tree**
(Also known as Dependency path) A hierarchical graph shows the dependencies of a software application. It includes direct and indirect dependencies, and levels may be deep.
* **E**
* **Environment**
It can refer to a MetaTrust Environment, a project attribute, or an interface for working with MetaTrust, such as the MetaTrust CLI, Web UI, or an IDE.
* **Exploit**
Demonstration of how to exploit the vulnerability. When an exploit is widely published, it is commonly referred to as an exploit in the wild.
* **Exploit Maturity**
A measure of the usefulness of an exploit, based on whether the exploit is in the wild, and how "helpful" the exploit is to an attacker. See Evaluating and prioritizing vulnerabilities.
* **F**
* **Fixable / Partially fixable**
A measure whether a vulnerability can be fixed by MetaTrust, by applying a patch, upgrade, or pin. See Fixed in version vs. fixable attributes in vulnerabilities.
* **Fix PR**
A pull request with an automatic fix for vulnerabilities that MetaTrust can offer the user.
* **G**
* **Git**
A distributed version-control system for tracking changes in source code during software development.
* **I**
* **IDE**
Integrated Development Environment. An application gives facilities for software development, typically with a source code editor, build automation tools, and a debugger.
* **Integrations**
Third-party products, applications, and platforms that MetaTrust works with, for example, SCM systems such as GitHub.
* **Issue**
License issues, vulnerabilities, or misconfigurations identified and listed by MetaTrust.
* **L**
* **Library**
* A specific type of package.
* **M**
* **Manifest**
A file that contains metadata about other files in the package.
* **Monitor**
A run of the MetaTrust **monitor** command that tests the project and uploads results to MetaTrust.
* **O**
* **Organization**
* An organization in MetaTrust is a way to collect and organize your projects. Members of organizations can then access these projects.
* **P**
* **Package**
A group of files and additional metadata about those files, used by package managers.
* **Package manager**
A set of tools that automates and manages packages of bundled files, and are usually specific to a language. For example, npm.
* **Package registry**
A software package hosting service that allows customers to host packages and code in one place.
* **Pinnable**
A fix type: define and "pin" a specific version of an indirect dependency to avoid a direct dependency pulling in a vulnerable version.
* **Project**
An external item that Metascan, with configuration to define how to run that scan. Projects appear on the Projects menu on the MetaTrust dashboard. See Introduction to projects.
* **R**
* **Repository**
A storage area that contains all elements necessary for the distribution of an application.
* **Resource**
A cloud infrastructure entity such as an AWS S3 bucket, Identity & Access Management (IAM) role, or Virtual Private Cloud (VPC) flows log.
* **Rule**
A security policy that checks cloud infrastructure and infrastructure as code (IaC) for misconfigurations that can lead to security problems.
* **S**
* **SAST**
Static Application Security Testing. A method of securing software by examining the source code of proprietary software and identifying the source of vulnerabilities. See also DAST.
* **SCA**
Software Composition Analysis. This technique is used to identify open-source and third-party components of an application, including their known security vulnerabilities and the usual adversarial licensing restrictions.
* **SCM**
Source Code Management. Also known as a code repo / repository / version control system. The method used by developers to store their source code and track changes to code. SCM helps resolve conflicts when merging updates from multiple contributors. GitHub is an example of a common SCM system.
* **SDLC**
Software Development Life Cycle. A process followed by a development team describing how to develop and maintain software.
* **Security policy**
A set of criteria for evaluating open-source vulnerabilities. Security policies enable you to set custom rules to prioritize or de-prioritize specific vulnerabilities automatically. The MetaTrust Default Security Policy is enabled by default, or you can create your security policy. See Security policies.
* **Severity**
A severity level is applied to a vulnerability or a license issue, to indicate the risk for that item in an application. See Severity levels.
* **V**
* **Vulnerability**
A security vulnerability identified by MetaScan. See Fixing vulnerabilities.
# MetaTrust 产品
## 关于 MetaTrust
MetaTrust专注于为WEB 3.0开发者提供安全可靠的基础设施，我们的团队由学术界和行业顶尖的安全专家组成，致力于创新和完善解决方案，保障用户数据和资产安全。
## MetaTrust 解决方案
构建web3.0项目全生命周期的安全管理平台，包含四款核心产品MPM、MetaScan、MetaScout、MetaScore。
