crytic / medusa

Parallelized, coverage-guided, mutational Solidity smart contract fuzzing, powered by go-ethereum
https://www.trailofbits.com/
GNU Affero General Public License v3.0
288 stars 34 forks source link

tracking: performance optimizations #451

Open 0xalpharush opened 3 weeks ago

0xalpharush commented 3 weeks ago

We don't need a state commitment and it's slow so let's mock it and re-execute transactions as needed (we are already doing this for tracing after the latest go-ethereum upgrade). The only trie that is loaded from the db rn is the genesis and/or post-deployment state AFAIK.

https://github.com/crytic/medusa/blob/b81a9bc7a09baa8f699241fa959e466849b9b453/chain/test_chain.go#L828-L830 https://github.com/crytic/medusa/blob/b81a9bc7a09baa8f699241fa959e466849b9b453/chain/vendored/apply_transaction.go#L64

We should simplify the main fuzz loop to just be changing the block num/timestamp in the block context and not doing all the complex stuff with pending/discarding blocks as if it's a real chain IMO https://github.com/crytic/medusa/blob/b81a9bc7a09baa8f699241fa959e466849b9b453/chain/test_chain.go#L742-L743

bsamuels453 commented 2 weeks ago

consider removing bloom filter calculations (CreateBloom) as well

eats up about 4-5% of the cpu time of EVMApplyTransaction.

if we do this, plan on adding a way to query the list of logs generated by a tx/block since we might still need it for other features

0xalpharush commented 2 weeks ago

Looking at the CPU report of pprof the most notable improvement we can make is probably memoizing this https://github.com/crytic/medusa/blob/3a9b0fae7888b1c1972c1178ca5022ebd51f5414/fuzzing/coverage/coverage_tracer.go#L164-L168

Screenshot 2024-08-29 at 12 36 17 PM

EDIT: This is done https://github.com/crytic/medusa/pull/472