crytic / tealer

Static Analyzer for Teal
GNU Affero General Public License v3.0
61 stars 14 forks source link

Add Subroutine class and helpers to generate shortened CFG for subroutines. #149

Closed S3v3ru5 closed 1 year ago

S3v3ru5 commented 1 year ago

First commit adds the Subroutine class which is used to represent subroutines in the contract. Second commit adds support to generate shortened CFG for subroutines.

In full CFG, subgraph containing the subroutine is added after each callsub instruction. This makes it hard to follow through the CFG for large contracts. In the shortened version of CFG, Instead of the entire subroutine's subgraph, a small box containing Subroutine {name} is added after the callsub instruction.

Users can generate shortened CFG's using subroutine-cfg. This printer creates a dot file for the main contract and for each one of the subroutines defined in the contract. TBD: Shortened CFG's are not generated by default (when --print-cfg option is used). A help message is displayed instead of that. Have to determine if we want to generate them by default or not.

tealer test.teal --print-cfg
Analyzing test.teal

CFG exported to file: test_full_cfg.dot

Note: Use `subroutine-cfg` printer to generate CFG of subroutines and shortened version of contract CFG

Example

Full CFG

test_full_cfg dot

Shortened CFG

test_contract_shortened_cfg dot

Subroutine CFG (recursive)

test_subroutine_factorial_2_cfg dot