search

Consensys / truffle-security

MythX smart contract security verification plugin for Truffle Framework
https://mythx.io
124 stars 28 forks source link

Check that what we send to MythX is the optimal data for best analysis #126

Closed rocky closed 5 years ago

rocky commented 5 years ago

Right now we are only passing one sourceList to MythX even though we are capturing the entire list used in a file and in the right order. (And the AST's refer to this expanded information).

It is possible that right now we don't even need to pass a sourcelist at all and just the AST's will do. Or maybe it is better to pass the full sourcelist since we now should have this logged in the right order as reflected in the srcmap entries.

Investigate.

Warning: be prepared to find bugs in MythX where it is not performing optimally where it should. If that is the case, log bugs in MythX.

daniyarchambylov commented 5 years ago

Right now sourceList is required. It will be unnecessary once Maru will fully support AST, it will generate sourceList by itself. I believe it isn't released yet. We have to wait for new release

rocky commented 5 years ago

Ok. Gerhard however now says legacyAST is no longer needed.

Let's just keep this open until Maru et all gets improved.

daniyarchambylov commented 5 years ago

It is now possible to send request without sourceList, but response is returned with sourceFormat === 'evm-byzantium-bytecode'. We need sourceFormat 'text' for correct behavior

rocky commented 5 years ago

Ok. If we need sourceList to get text back okay. BUT.... we (or the library) should also do somehting reasonalble when bytecode is also returned. In some cases like here where we have sourcemaps and text we should be able to figure out the right source code position. In those cases where we just don't have source code, a disassembly around the context of the offset should be shown, similar to how it is done in markdown reports, but with assymbly instead.

nbanmp commented 5 years ago

Closing as stale; MythXJS will be responsible for sending the optimal data.