Echidna vs Medusa vs Foundry: Which Fuzzer Should You Use?

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. There is no single winner: use Foundry if your tests live in Forge, then run Echidna or Medusa on the same properties as a second engine. Public benchmarks are small and dated, so treat rankings as hints.

Watch: Echidna vs Medusa vs Foundry: Which Fuzzer Should You Use? 1:48

Video transcript

There is no single best Solidity fuzzer. The strongest setup often runs two of them.

If your tests live in Forge, start with Foundry, then add Echidna or Medusa on the same properties. Guardian has published no benchmark, so this draws on the tools' docs.

Foundry shares a toolchain with your unit tests. Echidna offers seven test modes. Medusa runs ten parallel workers by default. Foundry's coverage guidance stays off until you set a corpus directory.

Trail of Bits said in 2025 its focus was shifting to Medusa, yet Medusa's own FAQ still calls Echidna its robust, well tested fuzzer.

In the Olympia benchmark from 2024, across 200 generated mazes, ItyFuzz solved 147, Echidna 83, Medusa 58 and Foundry 31.

But the paper lists no tool versions, and Foundry has since added coverage-guided fuzzing. In Dacian's comparison, the winner changed from challenge to challenge.

Recon's Chimera targets all three, Echidna's foundry mode runs Forge invariants, and Medusa reads Echidna properties with one config change. Avoid Foundry-only cheatcodes.

A workable split: Forge invariants on every pull request, then a longer Echidna or Medusa campaign each night with a saved corpus.

For Synthetix's BFP Market, Guardian's tailored Echidna suite ran over 140 million fuzzing runs against 22 core invariants.

Read the full comparison, or talk to Guardian about putting a fuzzing team on your protocol.

Foundry, Echidna and Medusa all run stateful invariant campaigns against Solidity contracts. They differ in how you write tests, how they search and what ships with them.

Two of them come from Trail of Bits. In February 2025, it said Echidna would get minor fixes while its "primary focus now shifts to Medusa's evolution."

Echidna has since shipped two feature releases.

Disclosure: Guardian uses fuzzers in its audits and has published no benchmark of these tools. We compared them from their own docs, READMEs and release notes as of November 6, 2026, plus two public benchmarks.

The Comparison Table

Defaults come from each tool's configuration docs.

	Foundry	Echidna	Medusa
Maintainer	foundry-rs	Trail of Bits (crytic)	Trail of Bits (crytic)
Latest release	v1.9.0, Nov 2, 2026	2.4.0, Nov 4, 2026	v1.5.1, Mar 11, 2026
Built on	Rust	Haskell, hevm	Go, go-ethereum
License	MIT or Apache-2.0	AGPL-3.0	AGPL-3.0
Tests written as	`invariant_` functions with assertions	`echidna_` properties, assertions or Foundry tests	`property_` functions or assertions
Default campaign	256 runs of 500 calls	50,000 calls, 100 per sequence	No call limit, 100 per sequence
Coverage guidance	When `corpus_dir` is set	On by default	On by default
Parallel workers	Campaign sharding since v1.8.0	1 to 4, by core count	10 by default
Symbolic execution	Opt-in preview	Symbolic worker and verification mode	Not in its docs
Cheatcodes	Full Foundry set	hevm's set	A subset of Foundry's

All three can fork live chain state into a campaign.

Foundry

Forge's invariant runner lives in the same toolchain as your unit tests. Handlers are Solidity, assertions come from forge-std, and every Foundry cheatcode works.

Recent releases added a lot.

v1.3.0 (July 2025): coverage-guided invariant fuzzing.
v1.7.0 (April 2026): optimization mode, check_interval, and random time and block delays.
v1.8.0 (August 2026): campaign sharding, forge fuzz replay commands and a symbolic testing preview.
v1.9.0 (November 2026): a faster shrinker for failing call sequences.

Coverage guidance stays off until you set corpus_dir, so set it for long campaigns.

Our Foundry invariant testing guide shows how to write the suite: handlers, ghost variables and actors.

Echidna

Echidna is Trail of Bits' Haskell fuzzer. Its README says it uses "grammar-based fuzzing campaigns based on a contract ABI" to falsify your properties.

It has seven test modes: property, assertion, foundry, optimization, overflow, exploration and verification.

2.3.0 (December 2025): symbolic execution modes, and generated Foundry tests that reproduce failures.
2.4.0 (November 2026): an experimental MCP server, so AI assistants can inspect and steer a live campaign.

The foundry mode runs Forge-style invariant_ functions, and 2.4.0 improved that compatibility.

Install Slither first. Echidna's README lists it as a prerequisite and uses it to extract information before each campaign.

For a step-by-step Echidna setup, see Guardian's Echidna invariant testing walkthrough.

Medusa

Medusa is Trail of Bits' Go fuzzer, built on go-ethereum and "inspired by Echidna." Its README lists parallel fuzzing across worker threads first.

Call sequences that raise coverage go into a corpus, which Medusa mutates to dig deeper. To port Echidna tests, add echidna_ to its property test prefixes.

Medusa reached v1 in February 2025. Its latest release, v1.5.1 in March 2026, fixed three memory leaks and added assert* cheatcodes such as assertEq.

Its FAQ is more cautious. It does not recommend switching until Medusa is extensively tested, and calls Echidna "our robust and well tested fuzzer" and Medusa "our new exploratory fuzzer."

Its Go testing API is "still under development" and may change between versions.

Benchmarks and Caveats

We found two public comparisons worth reading. Neither settles the question.

Benchmark	Setup	Result
Olympia (ASE 2024)	200 generated maze contracts, 60 minutes each	ItyFuzz 147, Echidna 83, Medusa 58, Foundry 31
Dacian's fuzzing comparison	Challenges, many simplified from audit findings	Of eight scored: five ties, two Medusa wins

Olympia generates contracts in which finding the bug means finding a maze's exit. ItyFuzz, a fourth fuzzer, solved every maze the others solved.

The paper does not list tool versions. Foundry added coverage-guided invariant fuzzing the following July, so its 31 reflects an older tool.

Dacian's repository says it is "not intended to be an academically rigorous benchmark." It was last updated in February 2025.

In it, Medusa broke invariants the other fuzzers missed, and one challenge fell only to the formal tools Halmos and Certora.

Neither result crowns one tool. In Dacian's set, the winner changed from challenge to challenge, which argues for running two engines on the same properties.

Running More Than One

You do not have to pick one. There are three ways to share a suite.

Chimera: Recon's framework aims to "write once, run everywhere" across Foundry, Echidna, Medusa, Halmos and Kontrol.
Echidna's foundry mode: runs Forge-style invariant_ tests directly.
Shared prefixes: Medusa accepts Echidna's echidna_ properties with one config change.

Mind the cheatcodes. Chimera's README warns that Foundry-only cheatcodes cause issues when running Echidna and Medusa.

A workable split: Forge invariants on every pull request, then a longer Echidna or Medusa campaign each night with a saved corpus. Our CI/CD pipeline guide covers the jobs.

Fuzzing checks only the properties you write.

For where it fits beside audits and proofs, see formal verification vs fuzzing vs audit. For the cheap pattern checks to run first, see our Slither tutorial.

How Guardian Fuzzes

Guardian's published case studies name Echidna. On Synthetix's BFP Market, "a tailored Echidna fuzzing suite" ran "over 140 million fuzzing runs" against 22 core invariants.

For Poolshark, Guardian delivered "a fully functioning Echidna fuzzing harness" that the team kept using after the engagement.

Invariant fuzzing is part of every Vanguard audit, next to two independent review teams and Helix, Guardian's AI auditor.

Frequently Asked Questions

Is Echidna better than Foundry for fuzzing?

Not by default. Echidna solved more mazes in the 2024 Olympia benchmark, but Foundry has since added coverage-guided invariant fuzzing and a faster shrinker. Foundry is simpler if your tests live in Forge; Echidna offers more test modes.

Is Medusa replacing Echidna?

Trail of Bits said in February 2025 that its focus was shifting to Medusa. Echidna has since shipped feature releases in December 2025 and November 2026, and Medusa's FAQ still calls Echidna the robust, well-tested option.

Can I run the same invariants in Foundry, Echidna and Medusa?

Yes, with care. Recon's Chimera framework targets all three, Echidna's foundry mode runs invariant_ tests, and Medusa can read echidna_ properties. Avoid Foundry-only cheatcodes, which cause issues under Echidna and Medusa.

Which Solidity fuzzer found the most bugs in benchmarks?

In the Olympia benchmark (ASE 2024), ItyFuzz solved 147 of 200 generated mazes, Echidna 83, Medusa 58 and Foundry 31. The mazes are synthetic and all the tools have changed since, so treat the ranking as dated.

Sources

Put a fuzzing team on your protocol

Vanguard pairs expert manual review with an invariant suite written for your protocol, which keeps testing every change you ship.

Talk to Guardian Explore Vanguard