argotorg / argotorg/hevm

`interpret` could return the pair of program counters and contracts visited

Open
#710 6 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Haskell
Stars
358
Forks
79
Avg merge
1d 1h
Merged PRs (30d)
6

Description

The [`interpret`](https://github.com/ethereum/hevm/blob/48ba16f2bf4f19925b64835dba391d1b197f3e3d/src/EVM/SymExec.hs#L309-L411) function is a key part of the symbolic execution since it computes the models for reachable parts of the code, to be solved later. The returned models lack of any detail on the program counters (PC) visited, and therefore, it is very hard to know which ones are more important or more relevant to solve.

If third party applications such as Echidna, wants to integrate the symbolic execution into a fuzzing campaign, it will be really useful to have the list of explored PCs. Tools can filter which models they want to solve, for instance to find inputs that allow deeper code lines, instead of solving path conditions from states already visited.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read src/EVM/SymExec.hs around interpret, lines 309–411, and trace how the symbolic-execution models are assembled and returned. Determine how the visited program counters and contracts should accompany those models for consumers such as Echidna. Done means callers can identify the PCs and contracts explored for each returned model.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
blockchain, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.