argotorg / argotorg/hevm

Calls Into Unknown Code (Overapproximated)

Open
#146 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Haskell
Stars
358
Forks
79
Avg merge
1d 1h
Merged PRs (30d)
6

Description

We currently don't handle calls into unknown code. One relatively easy way to deal with this would be to:

1. replace the result of the call with an abstract term (i.e. one of the `*Call` expr terms)
2. after the call, replace the returndata buffer with a fully abstract buf
3. after the call, reset parts of the state that could have been affected (e.g. storage, gas, balances, nonces, ...) to a fully abstract state
4. continue execution

Note that this is an overaproximation, and could produce spurious counterexamples e.g. in the case that some parts of the contract state are protected by a mutex.

A more refined analysis could conditionally reset parts of the state that can be shown to be touched by a reentrant call. An example of such a routine is here: https://github.com/ethereum/act/issues/18

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the call-handling entry point for calls into unknown code and trace how the result, returndata buffer, and execution state are represented. Compare the proposed abstract call result and state reset with the reentrancy routine linked in ethereum/act#18. Done means execution continues with abstracted returndata and affected state, while preserving the documented possibility of spurious counterexamples.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
blockchain, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.