argotorg / argotorg/hevm

High-performance Concrete Fuzzing Taking Advantage of Expr

Open
#383 10 comments 0 reactions 0 assignees View on GitHub
enhancement in progress
Dominant language
Haskell
Stars
358
Forks
79
Avg merge
1d 1h
Merged PRs (30d)
6

Description

# Original Idea (already implemented)

There are some hard cases where running concrete execution for a little bit will get us a win. For example:
```
function prove_distributivity(uint120 x, uint120 y, uint120 z) public pure {
assert(x + (y * z) == (x + y) * (x + z));
}
```
In the benchmark suite https://github.com/eth-sc-comp/benchmarks/ will take forever for an SMT solver to deal with, but a fuzzer should find a counterexample in <1s.

This sounds like a hack, and in some sense it is, but I can very easily see this being helpful to the users. The perceived utility of HEVM would be higher, and that's all that matters.

We could even run a thread that just does fuzzing, while the other threads do the symbolic interpretation, etc.

# Follow-ups

The original idea as per above has been implemented already, see `Fuzz.hs`. However, as detailed below by d-xo, there are a number of significant improvements that can be done that could improve the performance in very significant ways.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading Fuzz.hs and the follow-up discussion, then use the benchmark suite linked in the issue to measure the current implementation. The original idea is already implemented; the remaining work is to identify and validate significant fuzzing performance improvements, with benchmark results defining done.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
blockchain, performance, testing-qa
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.