Medusa is a free, open-source smart contract fuzzer for Solidity developers and security reviewers who want to find broken rules by running their contracts under unexpected inputs before they go live. It is built on go-ethereum, the Go implementation of the Ethereum protocol, and it is inspired by the Echidna fuzzer. Medusa for Windows is available as a ready-made build or installer, and the program also runs on Linux.
Instead of relying only on hand-written test cases, fuzzing generates large numbers of call sequences and checks whether your contract still follows its rules. Medusa runs these campaigns in parallel across multiple workers, and you can drive it from the command line or extend it with a Go API. This page explains what the program does, how to install it from the official source, how to use it, and how it compares with other tools in the same category.
What Is Fuzzing and Why It Matters for Smart Contracts
Fuzzing is a testing technique that feeds a program a large number of generated inputs and watches for failures. In smart contract work, the inputs are sequences of function calls with arguments, sent in an order a human tester might never think to try. A contract can pass every unit test a developer wrote and still fail when someone finds a particular combination of calls, balances and timing.
Smart contracts are hard to patch once deployed, and many of them hold real value. That is why security teams invest in testing before launch. Fuzzing complements manual review and static analysis. Because it runs the code, it can show that a rule is broken with a concrete sequence of calls, rather than only suggesting that a pattern looks risky.
Medusa applies this approach to Solidity contracts that run on the Ethereum Virtual Machine through go-ethereum. Testing happens against a simulated chain, so you can explore many scenarios without spending real assets.
Who Should Use Medusa and When?
Independent auditors use fuzzers to test contracts within a short review window and to produce reproducible evidence of a bug. When a sequence of calls breaks a property, the saved sequence gives the reviewer something concrete to share with the development team.
Protocol developers can run Medusa while they write new features. Adding property tests for each core rule, such as accounting totals staying consistent or permissions holding after an upgrade, turns the fuzzer into a regression check that runs whenever the code changes.
Teams with custom needs can use the Go API. A lending protocol, for example, might define global invariants across several contracts, while a token project might only need per-contract checks. The same workflow scales from a single file to a larger codebase.
Key Concepts: Assertions, Properties, and Coverage
Property tests describe conditions that should hold after any sequence of calls, such as total supply matching the sum of all balances. Assertions are checks placed at a specific point in the code. Both help the fuzzer decide whether a run has failed.
Coverage measures which parts of a contract were executed during testing. Higher coverage means more of the code was exercised, but coverage alone does not prove security. A campaign can reach every branch and still miss a rule that was never written as a property.
The corpus is the stored set of useful call sequences, and reusing it lets testing build on earlier discoveries instead of starting from nothing. Mutation means altering known inputs slightly, such as changing an amount or swapping the order of two calls, to explore neighboring cases.
Key features
Parallel Fuzzing Across Workers
Assertion and Property Tests
Mutational Value Generation
Coverage Collection and the Corpus
Coverage-Guided Fuzzing
Low-Level Testing Hooks
High-Level Go Testing API
Supported coins
The documentation mentions Ethereum (ETH) as the network Medusa targets. Because it is built on go-ethereum, its testing centers on Ethereum-compatible smart contracts written in Solidity.
How to install Medusa on Windows
- 1
Get the Windows build
Open the official GitHub repository at github.com/crytic/medusa and go to the Releases page. Download the Windows build or installer for the latest version, which is v1.5.1 at the time of writing. Download only from the official website or the GitHub Releases page, and avoid files shared through mirrors or forum links.
- 2
Verify the checksum
Compute the SHA-256 hash of the downloaded file in PowerShell with Get-FileHash, then compare the result with the checksum listed on the official release page or in the project documentation. If the hashes do not match, delete the file and download it again from the same source.
- 3
Run the installer or unpack the build
If you received an installer, run it and follow the prompts. If you received a portable build, extract it to a folder you control and add that folder to your PATH so the command is available from any terminal window.
-
Confirm the command runs
Open Command Prompt or PowerShell and run the Medusa command with its help flag. If the help text appears, the command-line tool is ready. You can then point it at a Solidity project and start a first campaign on a small contract.
How to use Medusa
Medusa works best when you treat the first run as a learning exercise on a small contract and then expand. The workflow below follows the typical path from setup to reviewing results.
- Set up a Solidity project that compiles cleanly, because the fuzzer depends on compiled contract information.
- Write or collect a few property tests that describe rules your contract must always follow.
- Add assertion tests at points where a value should never fall outside its expected range.
- Choose the number of workers for your machine. More workers can speed up a campaign but also use more CPU.
- Start the campaign from the command line and let it run for a set period.
- Review failing sequences and the coverage results, then reproduce the bug locally before changing any code.
- Keep the corpus and refine your tests. For custom logic, move to the Go API and add per-contract or global post-call checks.
Pros & cons
- Free and open source, with the source code available on GitHub
- Parallel workers make campaigns faster on multi-core machines
- Built-in assertion and property tests written in Solidity
- Coverage-guided fuzzing with a corpus of useful call sequences
- Go API for custom, project-specific testing methodology
- Available for both Windows and Linux
- Focused on Solidity and Ethereum-style contracts, so it does not cover other languages or ecosystems
- Fuzzing finds only the violations your properties describe and cannot prove a contract is secure
- The Go API requires Go programming knowledge, which creates a learning curve for custom testing
- Setting up a project for testing takes familiarity with Solidity development tooling
Is Medusa safe?
Medusa is a testing tool that runs your own contracts on a local test chain, so it does not ask for a seed phrase or private keys. Still, treat any security tool with care. Download only from the official website or the GitHub Releases page for crytic/medusa, verify the SHA-256 checksum before running the file, and never enter a seed phrase on a third-party website for any reason. The code was updated recently and the project is not marked as deprecated, which is reassuring. Check the latest version on the official website before you install, and keep test runs away from real funds on mainnet.
- Official source only. Download from github.com/crytic/medusa. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Medusa's closest relative is Echidna, another fuzzer for smart contracts, and both aim to uncover broken rules through generated call sequences. Medusa's own traits, such as its go-ethereum foundation and Go API, shape how teams combine it with other tools.
Static analyzers such as Slither and Aderyn work differently. They read the code and flag suspicious patterns without running it, so they are fast and good for early feedback, but they can report false positives. Halmos takes another approach by testing contracts symbolically. Many teams use a static analyzer first, a fuzzer for runtime evidence, and a symbolic tool for deeper checks on critical functions.
Specifications
- Price
- Free
- Type
- Open source
- License
- —
- Latest version
- v1.5.1
- Last update
- 28 Oct 2026
- Windows support
- Yes (Windows build or installer)
- Source code
- github.com/crytic/medusa
Frequently asked questions
Yes. Medusa is free and open source, and its source code is available on GitHub. You can download the Windows build or installer from the official GitHub Releases page, where the latest version is v1.5.1. Because there is no license fee, the only costs are your own development and infrastructure time.
Yes, Medusa supports Windows through a ready-made build or installer, and it also runs on Linux. The Windows option lets you run the command-line tool without building anything yourself. For a smooth first run, verify the file's SHA-256 hash and open a terminal to confirm the command starts before you point it at a project.
Medusa is a testing tool that works on your own contracts and does not need a seed phrase or wallet keys. Safety mainly depends on where you get the file. Use the official GitHub repository, check the checksum, and keep your testing away from real funds. The project is not marked as deprecated, and its code has been updated recently.
Medusa is inspired by Echidna and tackles the same problem of fuzzing Solidity contracts. Its main differences are its go-ethereum foundation, parallel workers spread across threads, and a Go API for building custom testing logic. Developers who already write Echidna properties can usually carry that thinking over when they try Medusa.
The documentation mentions Ethereum (ETH) as the chain Medusa targets. Since it is built on go-ethereum and tests Solidity contracts, it fits projects on Ethereum-compatible networks. If your project targets a different chain or a different language, a tool designed for that ecosystem will be a better match.
No. The command-line interface lets you run campaigns without writing any Go code. You do need to be comfortable with Solidity, because property and assertion tests are written in that language. Go knowledge becomes useful only when you want custom logic through the Go API, such as post-call or event property checks.
As far as its public record shows, Medusa is actively maintained. The latest version is v1.5.1, and the code was updated recently. Check the GitHub Releases page for newer versions before starting a serious project, since security tools change over time and newer releases may include fixes.
Verdict
Medusa is a strong choice for Solidity developers and auditors who want a free, open-source fuzzer with parallel workers, coverage-guided search and a Go API for custom checks. It rewards teams that already write property tests and can read Solidity closely. If you are new to smart contract testing, start with a small contract, learn the property model, and pair Medusa with a static analyzer. Use Slither or Aderyn for a quick code-level scan, then bring Medusa in for runtime evidence.