Symbolic Execution

A program analysis technique that explores execution paths using symbolic variables instead of concrete inputs, building mathematical constraints for each branch to identify inputs that trigger specific behaviors. More systematic than fuzzing but computationally expensive due to path explosion. Tools like Halmos, Manticore, and Mythril apply symbolic execution to EVM bytecode.