base-org / pessimism

Detect real-time threats and events on OP Stack compatible blockchains
https://base-org.github.io/pessimism/
MIT License
1.54k stars 435 forks source link

Feat - Event Ruleset Engine #179

Open epociask opened 1 year ago

epociask commented 1 year ago

To ensure full coverage of Optimism bridge, a heuristic should be able to run invariant analysis on any arbitrary event topics.

For example, for a WithdrawalInitiated event, we'd want to assert when amount != (2^256-1) using the uint256 amount field. Pessimism forces a configuration to provide an event signature for contract_event heuristics:

        "heuristic_params": {
            "address": "0x0000",
            "args": ["WithdrawalInitiated(address,address,address,address,uint256,bytes)"]
        }
    },

This heuristic can be expanded to support a super lightweight propositional language that can be passed into the configuration to construct an enforceable ruleset.

Since the variable type is already declared in the event signature, we can easily cast this to an internal data type for comparison. For example, a Transfer signature would be converted into a topic series [x0,x1,x2]. A user could then provide arbitrary comparisons for this topic series like:

signature Transfer(address from, address to, uint256 value):
    value < (2^256) - 1
    from != 0x0...0

NOTE: Comparisons between topics (a,b) is only feasible if and only if type(a) == type(b)

1. Lexical analysis

A script is initially parsed into a seres of lexical tokens for boolean processing, so the above transfer script would be converted into a words list:

'Transfer', '(', 'address', 'from', 'address', 'to', 'uint256', 'value', ')', ':', '\n',
'value', '<', '(2^256)', '-', '1', '\n', 'from', '!=', '0x0...0'

This word list would then be converted to a token list like so:

(keyword: signature), (identifier: Transfer(address,address,uint256)), (keyword: address), (identifier: from),
(keyword: address), (identifier: to), (keyword: uint256), (identifier: value), (symbol: \n),
(identifier: value), (operator: <), (constant: 2), (operator: ^), (constant: 256), (operator: - ), (constant: 1), (symbol: \n), (identifier: from), (operator: !=), (constant: 0x0...0)
Viktor110 commented 8 months ago

To ensure full coverage of Optimism bridge, a heuristic should be able to run invariant analysis on any arbitrary event topics.

For example, for a WithdrawalInitiated event, we'd want to assert when amount != (2^256-1) using the uint256 amount field. Pessimism forces a configuration to provide an event signature for contract_event heuristics:


        "heuristic_params": {

            "address": "0x0000",

            "args": ["WithdrawalInitiated(address,address,address,address,uint256,bytes)"]

        }

    },

This heuristic can be expanded to support a super lightweight propositional language that can be passed into the configuration to construct an enforceable ruleset.

Since the variable type is already declared in the event signature, we can easily cast this to an internal data type for comparison. For example, a Transfer signature would be converted into a topic series [x0,x1,x2]. A user could then provide arbitrary comparisons for this topic series like:


signature Transfer(address from, address to, uint256 value):

    value < (2^256) - 1

    from != 0x0...0

NOTE: Comparisons between topics (a,b) is only feasible if and only if type(a) == type(b)

1. Lexical analysis

A script is initially parsed into a seres of lexical tokens for boolean processing, so the above transfer script would be converted into a words list:


'Transfer', '(', 'address', 'from', 'address', 'to', 'uint256', 'value', ')', ':', '\n',

'value', '<', '(2^256)', '-', '1', '\n', 'from', '!=', '0x0...0'

This word list would then be converted to a token list like so:


(keyword: signature), (identifier: Transfer(address,address,uint256)), (keyword: address), (identifier: from),

(keyword: address), (identifier: to), (keyword: uint256), (identifier: value), (symbol: \n),

(identifier: value), (operator: <), (constant: 2), (operator: ^), (constant: 256), (operator: - ), (constant: 1), (symbol: \n), (identifier: from), (operator: !=), (constant: 0x0...0)
engr0001 commented 8 months ago

It would be also great if we could alert certain events via Telegram