search

muellerberndt / sabre

Security analyzer for Solidity smart contracts. Uses the MythX smart contract security service.
https://mythx.io
MIT License
60 stars 23 forks source link

Sample contract failing to be match for required pattern #17

Closed sjukeshov closed 5 years ago

sjukeshov commented 5 years ago

Standard truffle contracts unboxed with https://truffleframework.com/docs/truffle/getting-started/creating-a-project return error with Sabre:

sabre contracts/MetaCoin.sol 
Bad data in analysis-request JSON:
In contract MetaCoin:
* field "bytecode" with value "608060405234801561001057600080fd5b50326000908152602081905260409020612710905561024b806100346000396000f3fe608060405234801561001057600080fd5b50600436106100415760003560e01c80637bd703e81461004657806390b98a111461007e578063f8b2cb4f146100be575b600080fd5b61006c6004803603602081101561005c57600080fd5b50356001600160a01b03166100e4565b60408051918252519081900360200190f35b6100aa6004803603604081101561009457600080fd5b506001600160a01b038135169060200135610178565b604080519115158252519081900360200190f35b61006c600480360360208110156100d457600080fd5b50356001600160a01b0316610204565b600073__$c1e9661f796f9214b5c8076e394fd5a419$__6396e4ee3d61010984610204565b60026040518363ffffffff1660e01b8152600401808381526020018281526020019250505060206040518083038186803b15801561014657600080fd5b505af415801561015a573d6000803e3d6000fd5b505050506040513d602081101561017057600080fd5b505192915050565b33600090815260208190526040812054821115610197575060006101fe565b33600081815260208181526040808320805487900390556001600160a01b03871680845292819020805487019055805186815290519293927fddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef929181900390910190a35060015b92915050565b6001600160a01b03166000908152602081905260409020549056fea165627a7a723058204870795535bc4f787f5cf8ad43aa2639bfc2dc28f1700ad9c97f8cd5853dd3220029" fails to match the required pattern: /^(0x)?([0-9a-fA-F]{2})+$/
* field "deployedBytecode" with value "608060405234801561001057600080fd5b50600436106100415760003560e01c80637bd703e81461004657806390b98a111461007e578063f8b2cb4f146100be575b600080fd5b61006c6004803603602081101561005c57600080fd5b50356001600160a01b03166100e4565b60408051918252519081900360200190f35b6100aa6004803603604081101561009457600080fd5b506001600160a01b038135169060200135610178565b604080519115158252519081900360200190f35b61006c600480360360208110156100d457600080fd5b50356001600160a01b0316610204565b600073__$c1e9661f796f9214b5c8076e394fd5a419$__6396e4ee3d61010984610204565b60026040518363ffffffff1660e01b8152600401808381526020018281526020019250505060206040518083038186803b15801561014657600080fd5b505af415801561015a573d6000803e3d6000fd5b505050506040513d602081101561017057600080fd5b505192915050565b33600090815260208190526040812054821115610197575060006101fe565b33600081815260208181526040808320805487900390556001600160a01b03871680845292819020805487019055805186815290519293927fddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef929181900390910190a35060015b92915050565b6001600160a01b03166000908152602081905260409020549056fea165627a7a723058204870795535bc4f787f5cf8ad43aa2639bfc2dc28f1700ad9c97f8cd5853dd3220029" fails to match the required pattern: /^(0x)?([0-9a-fA-F]{2})+$/

Please check and fix. I'm getting this in Ubuntu and MacOs environments

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

This issue now has a funding of 0.15 ETH (20.34 USD @ $135.63/ETH) attached to it as part of the MythX fund.

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

Work has been started.

These users each claimed they can complete the work by 12 months from now. Please review their action plans below:

1) skyge has been approved to start work.

I ever saw sabre before, I will try to find out what is wrong, if I have any questions, I will ask at the Discord, if it is.

Learn more on the Gitcoin Issue Details page.

cryptokat commented 5 years ago

I think this is an upstream issue that should be reported to https://github.com/ConsenSys/mythx-developer-support

Skyge commented 5 years ago

The key of the problem must be at opcode PUSH20 0x0 which directs the bytes are 73__$c1e9661f796f9214b5c8076e394fd5a419$__, it should be 730000000000000000000000000000000000000000, so maybe we should make some conversion or something else.

muellerberndt commented 5 years ago

Looks like some kind of placeholder...

Skyge commented 5 years ago

Yeah, it is a placeholder, because we quote a library in this contract MetaCoin.sol, I am looking for more details about it at the official document.

Skyge commented 5 years ago

I do not find a better way to do it now, now my solution is 

const reger=new RegExp("[\__$].*[\$__]","gm");
const fourty_bits = "0000000000000000000000000000000000000000"
data.bytecode = data.bytecode.replace(reger, fourty_bits);
data.deployedBytecode = data.deployedBytecode.replace(reger, fourty_bits);

as you see above, I intend to use regular expression to replace the placeholder, but I do not think it is a good way, if one contract quotes two and more libraries, I am not sure what will happen, so I will test it, and at the same time, I will try to find whether there is a better way to solve it. Maybe I can try to traverse the compiled.contract or something else. BTW, although now you can pass to next step if you update the file as I write above, but then you will encounter anther error: Analysis failed: source list index out of range.

Skyge commented 5 years ago

yeah, I am almost sure that we should solve the quoting library by replacing the placeholder, but I should change my method to be more readable.

muellerberndt commented 5 years ago

Yeah, I did it the same way in Mythril Classic. Does your method deal with multiple library imports?

Skyge commented 5 years ago

@b-mueller I just use the regular expression to modify it, you can look at here, but it still throw out an error Analysis failed: source list index out of range.I am not sure for this.

Skyge commented 5 years ago

Fixed a problem, but introduced another problem. Maybe I did wrong.

muellerberndt commented 5 years ago

Ok, I'll have a look at it tomorrow!

gitcoinbot commented 5 years ago

⚡️ A tip worth 0.15000 ETH (20.41 USD @ $136.08/ETH) has been granted to @skyge for this issue from @b-mueller. ⚡️

Nice work @skyge! To redeem your tip, login to Gitcoin at https://gitcoin.co/explorer and select 'Claim Tip' from dropdown menu in the top right, or check your email for a link to the tip redemption page.

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

This Bounty has been completed.

Additional Tips for this Bounty: