muellerberndt / laser-ethereum

Symbolic virtual machine for Ethereum
MIT License
68 stars 20 forks source link

fix op implemention about contract function call #23

Closed p0n1 closed 6 years ago

p0n1 commented 6 years ago

See contract comments.

pragma solidity ^0.4.18;

contract A {
    uint x;
    function a(uint input) public returns(uint) {
        require(input > 10);
        x = input;
        return x;
    }
}

contract B {
    uint x;
    address delegateAddress;
    function b(uint input) public {
        require(input > 10);
        x = input;
    }

    function b_call_a(uint input) public {
        A delegate = A(delegateAddress);
        var ret = delegate.a(input);
        // laser could not simulate these two branches
        // after library function call due to chaotic stack and memory
        if (ret > 20) {
            x = ret + 9;
        } else {
            x = ret + 10;
        }
    }
}

Two graph generated for comparison.

This commit do as follows:

TODOs:

muellerberndt commented 6 years ago

could forget to store retval to memory in several places.

Return values are not handled well currently because of the way calls are implemented. If there's multiple returns from the callee contract, only one return value (the last return simulated) will be used in the analysis.

This would have to be fixed buy moving call_stack into the global state and returning on exception/stop, however this would create a much larger state space.