`interpret` could return the pair of program counters and contracts visited
- Dominant language
- Haskell
- Stars
- 358
- Forks
- 79
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 6
Description
The [`interpret`](https://github.com/ethereum/hevm/blob/48ba16f2bf4f19925b64835dba391d1b197f3e3d/src/EVM/SymExec.hs#L309-L411) function is a key part of the symbolic execution since it computes the models for reachable parts of the code, to be solved later. The returned models lack of any detail on the program counters (PC) visited, and therefore, it is very hard to know which ones are more important or more relevant to solve.
If third party applications such as Echidna, wants to integrate the symbolic execution into a fuzzing campaign, it will be really useful to have the list of explored PCs. Tools can filter which models they want to solve, for instance to find inputs that allow deeper code lines, instead of solving path conditions from states already visited.
Contributor guide
No contributing guide indexed for this repository
Research direction
Read src/EVM/SymExec.hs around interpret, lines 309–411, and trace how the symbolic-execution models are assembled and returned. Determine how the visited program counters and contracts should accompany those models for consumers such as Echidna. Done means callers can identify the PCs and contracts explored for each returned model.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100