Consensys / mythx-cli

A command line interface for the MythX smart contract security analysis API
https://mythx-cli.readthedocs.io/
MIT License
83 stars 29 forks source link

Formatter crash on bytecode-only 0xfe #14

Closed dmuhs closed 4 years ago

dmuhs commented 4 years ago

Description

Submit a very simple analysis request (as trial user): mythx analyze 0xfe

What I Did

The following valid response report comes back:

HTTP/1.1 200
Server: nginx/1.15.6
Date: Mon, 30 Sep 2019 10:34:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-DNS-Prefetch-Control: off
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Origin: *
ETag: W/"9a8-mwBtthFl+P8I0MYEUkGJkmhdLwc"
Content-Encoding: gzip

[{"issues":[{"swcID":"SWC-110","swcTitle":"Assert Violation","description":{"head":"A reachable exception has been detected.","tail":"It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking."},"severity":"Low","locations":[{"sourceMap":"0:1:0","sourceType":"raw-bytecode","sourceFormat":"evm-byzantium-bytecode","sourceList":["0xbcc90f2d6dada5b18e155c17a1c0a55920aae94f39857d39d0d8ed07ae8f228b"]}],"extra":{"discoveryTime":79263210,"testCases":[{"initialState":{"accounts":{"0x901d12ebe1b195e5aa8748e62bd7734ae19b51f":{"balance":"0x0","code":"","nonce":0,"storage":{}},"0xaffeaffeaffeaffeaffeaffeaffeaffeaffeaffe":{"balance":"0x1","code":"","nonce":0,"storage":{}},"0xdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef":{"balance":"0x0","code":"","nonce":0,"storage":{}}}},"steps":[{"address":"","blockCoinbase":"0xcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcbcb","blockDifficulty":"0xa7d7343662e26","blockGasLimit":"0x7d0000","blockNumber":"0x66e393","blockTime":"0x5bfa4639","gasLimit":"0x7d000","gasPrice":"0x773594000","input":"0xfe","name":"unknown","origin":"0xaffeaffeaffeaffeaffeaffeaffeaffeaffeaffe","value":"0x0"}]}],"toolName":"mythril"}},{"swcID":"","swcTitle":"","description":{"head":"Upgrade to MythX Pro to unlock the ability to test for even more vulnerabilities, perform deeper security analysis, and more. https://mythx.io/plans","tail":"Warning: Free mode only detects certain types of smart contract vulnerabilities. Your contract may still be unsafe. Upgrade to MythX Pro to unlock the ability to test for even more vulnerabilities, perform deeper security analysis, and more. https://mythx.io/plans"},"severity":"Low","locations":[],"extra":{}},{"swcID":"","swcTitle":"","description":{"head":"MythX API Trial Mode.","tail":"You are currently running MythX in Trial mode, which returns a maximum of three vulnerabilities. Sign up for a free account at https://mythx.io to run a complete report."},"severity":"Low","locations":[],"extra":{}}],"sourceType":"raw-bytecode","sourceFormat":"evm-byzantium-bytecode","sourceList":["0xbcc90f2d6dada5b18e155c17a1c0a55920aae94f39857d39d0d8ed07ae8f228b"],"meta":{"coveredPaths":0,"coveredInstructions":0,"logs":[{"level":"info","msg":"skipped automated fuzz testing due to incompatible bytecode input"}]}}]

With the incomplete input response, the formatter crashes, however:

DEBUG:pythx.api.handler:
HTTP/1.1 200
Server: nginx/1.15.6
Date: Mon, 30 Sep 2019 10:34:45 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 58
Connection: keep-alive
X-DNS-Prefetch-Control: off
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Origin: *
ETag: W/"3a-aZ2zFCmjWQcIC4KaNoH5va+UmwY"

{"sourceList":[],"bytecode":"0xfe","analysisMode":"quick"}

DEBUG:pythx.api.client:Parsing response
DEBUG:pythx.api.handler:Executing response middleware: <pythx.middleware.toolname.ClientToolNameMiddleware object at 0x7f81a00c4110>
DEBUG:ClientToolNameMiddleware:Forwarding the response without any action
DEBUG:pythx.api.handler:Executing response middleware: <pythx.middleware.analysiscache.AnalysisCacheMiddleware object at 0x7f819fd7c7d0>
DEBUG:AnalysisCacheMiddleware:Forwarding the response without any action
Traceback (most recent call last):
  File "/home/spoons/diligence/tools/mythx-cli/venv/bin/mythx", line 11, in <module>
    load_entry_point('mythx-cli', 'console_scripts', 'mythx')()
  File "/home/spoons/diligence/tools/mythx-cli/venv/lib/python3.7/site-packages/click/core.py", line 764, in __call__
    return self.main(*args, **kwargs)
  File "/home/spoons/diligence/tools/mythx-cli/venv/lib/python3.7/site-packages/click/core.py", line 717, in main
    rv = self.invoke(ctx)
  File "/home/spoons/diligence/tools/mythx-cli/venv/lib/python3.7/site-packages/click/core.py", line 1137, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/spoons/diligence/tools/mythx-cli/venv/lib/python3.7/site-packages/click/core.py", line 956, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/spoons/diligence/tools/mythx-cli/venv/lib/python3.7/site-packages/click/core.py", line 555, in invoke
    return callback(*args, **kwargs)
  File "/home/spoons/diligence/tools/mythx-cli/venv/lib/python3.7/site-packages/click/decorators.py", line 27, in new_func
    return f(get_current_context().obj, *args, **kwargs)
  File "/home/spoons/diligence/tools/mythx-cli/mythx_cli/cli.py", line 236, in analyze
    click.echo(FORMAT_RESOLVER[ctx["fmt"]].format_detected_issues(resp, inp))
  File "/home/spoons/diligence/tools/mythx-cli/mythx_cli/formatter/tabular.py", line 59, in format_detected_issues
    inp.sources[filename]["source"], c.offset
TypeError: 'NoneType' object is not subscriptable
dmuhs commented 4 years ago

Affects tabular and simple formatter options, due to missing sources entry on bytecode-only analysis