Consensys / mythril

Security analysis tool for EVM bytecode. Supports smart contracts built for Ethereum, Hedera, Quorum, Vechain, Rootstock, Tron and other EVM-compatible blockchains.
https://mythx.io/
MIT License
3.87k stars 737 forks source link

Detecting fixed points to reduce execution time #400

Open rocky opened 6 years ago

rocky commented 6 years ago

Description

Investigate whether using the dominators tree in a CFG and detecting a lack of change in a dominator basic block can profitably reduce unneeded searching.

Background

A dominator tree has the property that the basic block acts as a choke point for each of the basic blocks in its decendents. Therefrore if in tracing there is no change in a dominiator, there will be no change in the children and so they don't have to be scanned.

It could be that subsequently there's a change in one of a basic-block's ancestor dominators, and then the basic block would again be re scanned.

rocky commented 6 years ago

@JoranHonig reports that a dominator tree isn't needed, and that change changed detection on basic-block branches can be restricted further by the constraints added by those specific branches.

JoranHonig commented 5 years ago

We're spending a bit of time cleaning up old issues, which is why I was re-reading this issue again.

Not sure what my reasoning was, but I think I was wrong. As I understand it (now) the following example could be optimized using this idea/technique:

function expensiveButUseless() {
    for (uint i=0; i<block.blocknumber % 10; i++) {
    }
}

function doIt() {
   expensiveButUseless()
   expensiveButUseless()
}

would be equivalent (in terms of safety properties) to:

function doIt{
  expensiveButUseless()
}

I'll therefore keep this issue in the backlog