Calls Into Unknown Code (Overapproximated)
- Dominant language
- Haskell
- Stars
- 358
- Forks
- 79
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 6
Description
We currently don't handle calls into unknown code. One relatively easy way to deal with this would be to:
1. replace the result of the call with an abstract term (i.e. one of the `*Call` expr terms)
2. after the call, replace the returndata buffer with a fully abstract buf
3. after the call, reset parts of the state that could have been affected (e.g. storage, gas, balances, nonces, ...) to a fully abstract state
4. continue execution
Note that this is an overaproximation, and could produce spurious counterexamples e.g. in the case that some parts of the contract state are protected by a mutex.
A more refined analysis could conditionally reset parts of the state that can be shown to be touched by a reentrant call. An example of such a routine is here: https://github.com/ethereum/act/issues/18
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the call-handling entry point for calls into unknown code and trace how the result, returndata buffer, and execution state are represented. Compare the proposed abstract call result and state reset with the reentrancy routine linked in ethereum/act#18. Done means execution continues with abstracted returndata and affected state, while preserving the documented possibility of spurious counterexamples.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100