argotorg / argotorg/hevm

When doing equivalence checking, CALL to unknown code can be approximated in a different way

Open
#669 3 comments 0 reactions 0 assignees View on GitHub
low-priority
Dominant language
Haskell
Stars
358
Forks
79
Avg merge
1d 1h
Merged PRs (30d)
6

Description

As @charles-cooper mentioned on the chat, for equivalence checking -- and only for equivalence checking -- one can do a different kind of overapproximation for call to unknown code via `CALL`. If codeA and codeB both call contract C with the _same prestate and same calldata_ then and only then, the post-state after the call can be assumed to be symbolic, _but_ equivalent. Which obviously does not work for regular symbolic execution, which e.g. the #658 does allow us to perform. However, this kind of `CALL` does not necessitate `--promise-no-reent`, i.e. the system may actually be non-reentrant.

NOTE: It may be important to think though things related to this. When code-A has a function "mess_me_up()" and code-B does not have that function, then even though the two codes have the same prestate and the same calldata, the end state may be different -- in one case, a malicious contract could have called `mess_me_up()`, while in the other, it could not. However, the `mess_me_up()` public will be detected as a difference anyway...

Contributor guide

No contributing guide indexed for this repository

Research direction

Read this proposal alongside issue #658 and trace the existing equivalence-checking treatment of CALL. Clarify the same-prestate and same-calldata rule, the non-reentrancy caveat, and the missing-public-function case; completion should include agreed behavior and tests for these cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.