crytic / rattle

evm binary static analysis
https://www.trailofbits.com/presentations/rattle/
344 stars 41 forks source link

AttributeError: 'NoneType' object has no attribute 'offset' #17

Closed pgoodman closed 5 years ago

pgoodman commented 6 years ago
sloth:rattle pag$ python3 rattle-cli.py --input map.bin  -O
INVALID JUMPDEST: <SSABasicBlock offset:0x3f num_insns:1 in: [] insns:[
    <0x3f: INVALID()>
] fallthrough:None jumps:None>
INVALID JUMPDEST: <SSABasicBlock offset:0x44 num_insns:1 in: [] insns:[
    <0x44: INVALID()>
] fallthrough:None jumps:None>
INVALID JUMPDEST: <SSABasicBlock offset:0x4f num_insns:1 in: [] insns:[
    <0x4f: INVALID()>
] fallthrough:None jumps:None>
INVALID JUMPDEST: <SSABasicBlock offset:0x8e num_insns:1 in: [] insns:[
    <0x8e: INVALID()>
] fallthrough:None jumps:None>
Traceback (most recent call last):
  File "rattle-cli.py", line 191, in <module>
    main()
  File "rattle-cli.py", line 50, in main
    print(ssa)
  File "/Users/pag/Code/rattle/rattle/recover.py", line 689, in __str__
    rv += str(function) + "\n\n"
  File "/Users/pag/Code/rattle/rattle/ssa.py", line 522, in __repr__
    blocks = '\n'.join([f'{x}' for x in self.blocks])
  File "/Users/pag/Code/rattle/rattle/ssa.py", line 522, in <listcomp>
    blocks = '\n'.join([f'{x}' for x in self.blocks])
  File "/Users/pag/Code/rattle/rattle/ssa.py", line 424, in __repr__
    jump_targets = [f"{x.offset:#x}" for x in self.jump_edges]
  File "/Users/pag/Code/rattle/rattle/ssa.py", line 424, in <listcomp>
    jump_targets = [f"{x.offset:#x}" for x in self.jump_edges]
AttributeError: 'NoneType' object has no attribute 'offset'

From this contract:

pragma solidity ^0.4.0;
contract Foo {

    mapping(address => uint) addr_to_uint;
    uint[] array_of_uints;

    function Set(address from, uint to) public {
        addr_to_uint[from] = to;
    }
}

With bytecode:

{
    "linkReferences": {},
    "object": "608060405234801561001057600080fd5b50610101806100206000396000f300608060405260043610603f576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff168063fd28ec3e146044575b600080fd5b348015604f57600080fd5b50608c600480360381019080803573ffffffffffffffffffffffffffffffffffffffff16906020019092919080359060200190929190505050608e565b005b806000808473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1681526020019081526020016000208190555050505600a165627a7a7230582066505353c876f1bedecc87837015db37436ab0482aa0819d53f28c363da469800029",
    "opcodes": "PUSH1 0x80 PUSH1 0x40 MSTORE CALLVALUE DUP1 ISZERO PUSH2 0x10 JUMPI PUSH1 0x0 DUP1 REVERT JUMPDEST POP PUSH2 0x101 DUP1 PUSH2 0x20 PUSH1 0x0 CODECOPY PUSH1 0x0 RETURN STOP PUSH1 0x80 PUSH1 0x40 MSTORE PUSH1 0x4 CALLDATASIZE LT PUSH1 0x3F JUMPI PUSH1 0x0 CALLDATALOAD PUSH29 0x100000000000000000000000000000000000000000000000000000000 SWAP1 DIV PUSH4 0xFFFFFFFF AND DUP1 PUSH4 0xFD28EC3E EQ PUSH1 0x44 JUMPI JUMPDEST PUSH1 0x0 DUP1 REVERT JUMPDEST CALLVALUE DUP1 ISZERO PUSH1 0x4F JUMPI PUSH1 0x0 DUP1 REVERT JUMPDEST POP PUSH1 0x8C PUSH1 0x4 DUP1 CALLDATASIZE SUB DUP2 ADD SWAP1 DUP1 DUP1 CALLDATALOAD PUSH20 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF AND SWAP1 PUSH1 0x20 ADD SWAP1 SWAP3 SWAP2 SWAP1 DUP1 CALLDATALOAD SWAP1 PUSH1 0x20 ADD SWAP1 SWAP3 SWAP2 SWAP1 POP POP POP PUSH1 0x8E JUMP JUMPDEST STOP JUMPDEST DUP1 PUSH1 0x0 DUP1 DUP5 PUSH20 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF AND PUSH20 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF AND DUP2 MSTORE PUSH1 0x20 ADD SWAP1 DUP2 MSTORE PUSH1 0x20 ADD PUSH1 0x0 KECCAK256 DUP2 SWAP1 SSTORE POP POP POP JUMP STOP LOG1 PUSH6 0x627A7A723058 KECCAK256 PUSH7 0x505353C876F1BE 0xde 0xcc DUP8 DUP4 PUSH17 0x15DB37436AB0482AA0819D53F28C363DA4 PUSH10 0x80002900000000000000 ",
    "sourceMap": "24:176:0:-;;;;8:9:-1;5:2;;;30:1;27;20:12;5:2;24:176:0;;;;;;;"
}
withzombies commented 5 years ago

Fixed in 62198622