Solidity Debugging and Testing: Setting Up Foundry, Hardhat, Anvil

We design and develop full-cycle blockchain solutions: from smart contract architecture to launching DeFi protocols, NFT marketplaces and crypto exchanges. Security audits, tokenomics, integration with existing infrastructure.
Showing 1 of 1All 1305 services
Solidity Debugging and Testing: Setting Up Foundry, Hardhat, Anvil
Medium
~1 day
Frequently Asked Questions

Blockchain Development Services

Blockchain Development Stages

Latest works

  • image_website-b2b-advance_0.webp
    B2B ADVANCE company website development
    1358
  • image_web-applications_feedme_466_0.webp
    Development of a web application for FEEDME
    1251
  • image_websites_belfingroup_462_0.webp
    Website development for BELFINGROUP
    957
  • image_ecommerce_furnoro_435_0.webp
    Development of an online store for the company FURNORO
    1188
  • image_logo-advance_0.webp
    B2B Advance company logo design
    646
  • image_crm_enviok_479_0.webp
    Development of a web application for Enviok
    929

Problem: Tests Fail, No Confidence

Imagine: you deploy a contract to mainnet, but an hour later discover a reentrancy vulnerability. Users lost funds — reputation damaged, audit didn't help. Every hour of downtime costs $5,000, and damages from reentrancy attacks exceed $100M. Or a typical situation: a new developer spends half a day installing dependencies and running the first test. The CI pipeline failed, but no one knows why — logs are empty.

Our team with 5 years of blockchain development experience has set up such environments for 50+ projects, including protocols with total TVL > $1B. As a result, deployment time decreased by 40%, and the number of bugs in production — by 70%. This is not just a toolchain — it's a guarantee of stability and reproducibility.

Which Framework to Choose for the Task?

For Solidity projects, there are currently two real options: Foundry and Hardhat. They solve different tasks and are often used together. The choice depends on what you are testing: contract logic or frontend integration.

Parameter Foundry Hardhat
Test language Solidity TypeScript/JavaScript
Execution speed Very fast (revm on Rust) Slower (up to 5x)
Fuzz testing Built-in (differential, invariant) Only via plugins
Mainnet fork vm.createFork() --fork-url
Frontend integration Harder Easier (ethers.js, Wagmi)
Deployment scripts Solidity scripts TypeScript + ethers.js
Transaction debugging forge debug console.log() in contract

Our standard: Foundry for unit and fuzz tests, Hardhat for deployment scripts and frontend integration. Both configs coexist in one repository — this allows writing tests in Solidity and deploying via TypeScript.

How Is the Project Structure Organized?

We use a module-based separation: contracts/core, contracts/interfaces, test/unit, test/integration, test/invariant, script (Foundry), deploy (Hardhat) and fixtures. This organization allows separating unit tests (without RPC) from integration tests (with fork). Unit tests should run in seconds, integration only on merge to main.

Setting Up Local Network, Mocks, and Fixtures

Local Network: Anvil Instead of Ganache

Anvil (included in Foundry) is a local EVM node on Rust. 10x faster than Ganache, actively maintained. For development, we run it in fork mode from mainnet or testnet:

# Fork Ethereum mainnet at a specific block (reproducibility)
anvil --fork-url $MAINNET_RPC --fork-block-number 19500000

# Fork with predefined accounts and balances
anvil --fork-url $MAINNET_RPC --accounts 10 --balance 10000

Fork testing is the only way to check integration with Uniswap, Aave, Chainlink without deploying to testnet. Transaction in a local fork is instant. On Sepolia — 12-15 seconds. Time savings per iteration: from 15 seconds to 0.1 seconds. Use Ethereum testnets to get familiar with networks.

Mocks and Fixtures: Isolation Without Fragility

For test isolation we use fixture inheritance:

// BaseFixture.sol — common dependencies
abstract contract BaseFixture is Test {
    MockERC20 token;
    MockChainlinkOracle oracle;

    function setUp() public virtual {
        token = new MockERC20("Test", "TST", 18);
        oracle = new MockChainlinkOracle(2000e8); // $2000 price
    }
}

// ProtocolFixture.sol — deploy the protocol under test
contract ProtocolFixture is BaseFixture {
    Protocol protocol;

    function setUp() public override {
        super.setUp();
        protocol = new Protocol(address(token), address(oracle));
    }
}

We do not use vm.mockCall for core dependencies — it's fragile and doesn't check interfaces. We create full mock contracts with minimal implementation. This approach reduces false positives by 30%.

Step-by-Step Setup and CI/CD

Detailed instructions
  1. Install Foundry: curl -L https://foundry.paradigm.xyz | bash.
  2. Create config: forge init and configure foundry.toml for your project.
  3. Add Hardhat: npm install --save-dev hardhat and generate hardhat.config.ts.
  4. Start local node: anvil in a separate terminal.
  5. Write your first test: use the fixture template above.
  6. Set up CI: add GitHub Actions workflow (see below).

CI/CD: Automation Without Surprises

GitHub Actions configuration for Foundry:

name: Tests
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install Foundry
        uses: foundry-rs/foundry-toolchain@v1
      - name: Run unit tests
        run: forge test --match-path "test/unit/*" -vvv
      - name: Run integration tests
        run: forge test --match-path "test/integration/*" --fork-url ${{ secrets.MAINNET_RPC }}
      - name: Coverage check
        run: forge coverage --min-line-coverage 80

Separate unit and integration tests — unit tests must work without RPC keys. Integration tests only on PR to main. This reduces feedback time to 2 minutes.

Testnets and Scope of Work

Multi-Network Support

We set up a multi-network config in Hardhat:

networks: {
  sepolia: {
    url: process.env.SEPOLIA_RPC,
    accounts: [process.env.DEPLOYER_KEY],
    chainId: 11155111,
  },
  polygon_amoy: {
    url: process.env.AMOY_RPC,
    accounts: [process.env.DEPLOYER_KEY],
    chainId: 80002,
  },
}
Testnet Chain ID Faucet Block Time
Sepolia 11155111 Alchemy / Chainlink 12 sec
Polygon Amoy 80002 Official Polygon 2 sec
BNB Testnet 97 Binance Faucet 3 sec

Scope and Timelines

What is included in the setup:

  • Configuration of Foundry and Hardhat (foundry.toml, hardhat.config.ts)
  • Set of mock contracts (ERC-20, Chainlink Oracle)
  • Fixture hierarchy for your protocol
  • Local EVM node (Anvil) with fork mode
  • CI pipeline (GitHub Actions) with separation of unit/integration tests
  • Testnet setup (Sepolia, Polygon Amoy, BNB Chain testnet)
  • Documentation on running and extending
  • Team training (1-2 hours)

Timelines: basic setup — 1 business day. With custom mocks and fixtures — 1-2 days. For projects with multiple chains (EVM + Solana) — 2-3 days. Result: reduction in testing time up to 60%, early vulnerability detection, stable CI. Monthly savings from this approach can reach $10,000.

Order Test Environment Setup

Contact us — we'll conduct a free audit of your current process and propose a configuration for your protocol. Get a consultation on optimizing your test environment. We guarantee: after setup, every commit will pass checks without surprises. Order setup today — start testing with confidence.

Smart Contract Development

We faced a situation: a contract was deployed, two weeks later a message arrives—the pool drained for $800k. Looked at the transaction in Tenderly: attacker called deposit(), inside an ERC-777 callback re-called withdraw()—balance only updated after the second exit. Classic reentrancy, but not via ETH transfer—through an ERC-777 hook. ReentrancyGuard was only on withdraw().

Such cases are not rare. A smart contract is financial logic with no possibility to patch it overnight. Our team develops turnkey contracts, embedding protection against reentrancy, MEV, and gas attacks from the early stages.

How We Develop Smart Contracts Turnkey

We start with business logic audit and stack selection. Solidity 0.8.x is the standard for EVM-compatible chains: Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche C-Chain. For Solana, we use Rust and Anchor: the account and program model requires explicit declaration of all resources. For projects requiring formal verification, Move (Aptos, Sui) fits—linear types eliminate resource copying at the compiler level. Vyper is chosen for contracts where audit simplicity is critical (Curve Finance).

Language Execution Model Typical Domain Risks
Solidity 0.8.x EVM, sequential DeFi, NFT, tokens Reentrancy, overflow (unchecked)
Rust (Anchor) Solana, parallel High-throughput DEX, games Incorrect account declaration
Move Aptos/Sui, resource Large protocols Ecosystem complexity
Vyper EVM, limited syntax Critical contracts (Curve) Compiler stability dependency

Gas optimization is not premature optimization—it is an architectural decision. On Ethereum mainnet, deploying a poorly designed contract can cost a significant amount of ETH due to suboptimal storage layout. Repacking a Proposal structure from 7 slots to 4 saved thousands of gas per vote—substantial savings when scaled across thousands of votes per day.

Typical gas mistakes: passing arrays via memory instead of calldata in external functions (2–3x more expensive); using require with long strings instead of custom errors like error InsufficientBalance(...). Custom errors are cheaper on revert and pass structured data to the frontend.

Why Smart Contract Audit Is Critical for Security

Audit is not a one-time check—it is a built-in development stage. We use three levels:

  1. Static analysisSlither (30 seconds in CI) detects reentrancy, uninitialized variables, dangerous delegatecall.
  2. Fuzzing and invariant testsFoundry with --fuzz-runs 50000 finds edge cases missed by hundreds of unit tests. Real case: an AMM contract with custom math passed 150 Hardhat tests; Foundry found an integer division truncation that allowed a dust attack to accumulate dust on the contract. Echidna checks invariants ("sum of all balances ≤ totalSupply").
  3. Manual code review—our engineers with 10+ years in blockchain identify logic errors that tools miss. For protocols with TVL > $1M, external audit from Trail of Bits, Consensys Diligence, or OpenZeppelin is mandatory. Timeline: 2–4 weeks.

Any upgradeable protocol must have a timelock. TimelockController from OpenZeppelin: operation proposed → wait minimum delay (48–72 hours) → executed. Without timelock, one compromised deployer wallet means losing the entire pool.

What Upgrade Patterns Do We Choose?

Pattern Mechanism Risk When to Use Our Experience
Transparent Proxy (OZ) admin vs user separation Storage collision, centralization Standard projects 15+ implementations
UUPS Upgrade logic in implementation Forget _authorizeUpgrade → contract permanently broken Gas-optimized projects 7 projects
Diamond (EIP-2535) Multiple facets Audit complexity Large protocols with 10+ contracts 3 deployments
Beacon Proxy One beacon for multiple proxies Beacon = single point of failure Factories of identical contracts 5 factories

Storage collision is the main danger of proxies. Implementation v2 must not add variables before existing ones. OpenZeppelin Upgrades plugin for Hardhat and Foundry checks this automatically, but only when using its API.

How to Protect a Contract from MEV and Front-Running

On Ethereum mainnet, transactions in the mempool are visible to all. MEV bots execute sandwich attacks on DEX, front-run mints and governance. Solution: commit-reveal scheme for auctions, private submission via Flashbots PROTECT RPC. EIP-7702 and PBS (proposer-builder separation) are changing the landscape but not yet widespread.

What Is the Development Process?

  1. Analysis—functional specification, call diagram, edge case analysis. Without this, coding starts in vain.
  2. Development—Solidity/Rust with tests in parallel. Test → code → refactoring. Use Foundry for fuzz and invariant tests.
  3. Internal audit—Slither + Echidna + manual code review. Foundry invariant tests for protocol invariants.
  4. External audit—for projects with real money. Timeline: 2–4 weeks.
  5. Deployment—Foundry scripts or Hardhat Ignition with verification on Etherscan. Gnosis Safe for ownership transfer immediately after deployment.
  6. Monitoring—Tenderly alerts, OpenZeppelin Defender, Forta Network.

What Is Included

  • Architecture documentation and contract specification (NatSpec).
  • Source code with repository and CI (Slither, Foundry, coverage).
  • Deployed contract with verification on blockchain explorer.
  • Audit results (internal and external upon request).
  • Access to monitoring and management (Gnosis Safe).
  • Code warranty: critical bug fixes within one month after deployment.
  • Consultation on web integration (wagmi, RainbowKit).

Estimated Timelines

  • ERC-20 token with basic functions: 1–2 weeks
  • Vesting contract with cliff/linear schedule: 2–3 weeks
  • NFT ERC-721/1155 with marketplace: 4–6 weeks
  • AMM or lending protocol: 2–4 months
  • Multichain protocol with bridge: 4–7 months

Audit adds 3–6 weeks and runs in parallel with final testing where possible. Cost is calculated individually—contact us for a free project evaluation.

Order smart contract development—get consultation on architecture and protection against reentrancy, MEV, and gas attacks. Want to discuss details? Write to us—we will select the optimal stack for your task.