nevillegrech / gigahorse-toolchain

A binary lifter and analysis framework for Ethereum smart contracts
Other
290 stars 59 forks source link

Introduce `incompleteGlobal` analysis round, other changes #120

Closed sifislag closed 8 months ago

sifislag commented 8 months ago

The main change of this PR is the introduction of an incompleteGlobal analysis round, before the instantiation of the typical main global analysis. This allows us to verify which of the variables that are pushed to the stack and have the values of valid JUMPDESTs are actually used as jump targets, overriding the BlockPushesLabel() facts used by PrivateFunctionCall() which is essential our context sensitivity algorithms. The result of this is a reduction of the number of contexts of our global CFG analysis, lightening the load of the function inference logic as well.

Other changes:

Will run some final benchmarks and post the results before merging.


RESULTS


All runs have a timeout of 200s and are performed using --disable_scalable_fallback

Transactional-Shrinking

viaIR contracts see the biggest benefit with a reduction in timeouts and no increase in execution time. In the other two datasets we notice an increase in the average execution time but no new timeouts.

results over 3k ir contracts (via-ir-dec23):

2866 contracts decompiled/analyzed by dec23-ir-master-200 (0 exclusively)
2880 contracts decompiled/analyzed by dec23-ir-unsound-200 (14 exclusively)

ANALYTIC: decomp_time                       
dec23-ir-master-200 (common): 20948.068742275238 (+0.123%)          
dec23-ir-unsound-200 (common): 20922.326548814774

ANALYTIC: Analytics_JumpToMany            
dec23-ir-master-200 (common): 5425                                  
dec23-ir-unsound-200 (common): 5456 (+0.5714%)

ANALYTIC: Analytics_PublicFunction          
dec23-ir-master-200 (common): 61316                                 
dec23-ir-unsound-200 (common): 61263 (-0.08644%)

ANALYTIC: Analytics_ReachableBlocks               
dec23-ir-master-200 (common): 1265532                               
dec23-ir-unsound-200 (common): 1265532

ANALYTIC: Analytics_UnreachableBlock                
dec23-ir-master-200 (common): 29734                                 
dec23-ir-unsound-200 (common): 29734        

ANALYTIC: Analytics_ReachableBlocksInTAC           
dec23-ir-master-200 (common): 1264073 (-0.005616%)                  
dec23-ir-unsound-200 (common): 1264144

ANALYTIC: Analytics_BlockHasNoTACBlock      
dec23-ir-master-200 (common): 1459 (+5.115%)                        
dec23-ir-unsound-200 (common): 1388   

ANALYTIC: Analytics_DeadBlocks          
dec23-ir-master-200 (common): 12216 (+0.7339%)                      
dec23-ir-unsound-200 (common): 12127              

ANALYTIC: Analytics_PolymorphicTargetSameCtx
dec23-ir-master-200 (common): 761                                   
dec23-ir-unsound-200 (common): 761                             

ANALYTIC: Analytics_LocalBlockEdge              
dec23-ir-master-200 (common): 1796030                               
dec23-ir-unsound-200 (common): 1795110 (-0.05122%)                                                                                       

ANALYTIC: Analytics_StmtMissingOperand        
dec23-ir-master-200 (common): 587 (+0.6861%)                        
dec23-ir-unsound-200 (common): 583

ANALYTIC: Analytics_PrivateFunctionMatchesMetadata
dec23-ir-master-200 (common): 82382 (-0.002428%)                                                                                                                                                                                                                                  
dec23-ir-unsound-200 (common): 82384

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectArgs                                                                          
dec23-ir-master-200 (common): 2203 (+0.04541%)                                                                                           
dec23-ir-unsound-200 (common): 2202                                                                                                                                                                                                                                               

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectReturnArgs
dec23-ir-master-200 (common): 1600 (+0.1879%)
dec23-ir-unsound-200 (common): 1597

ANALYTIC: Analytics_Contexts                                                                                                                                                                                                                                                      
dec23-ir-master-200 (common): 3881200 (+53.9%)                                                                                                                                                                                                                                    
dec23-ir-unsound-200 (common): 2521911

2k solc0.8 contracts over 10kb (solc08-over10k):

1980 contracts decompiled/analyzed by dec23-large-master-200 (0 exclusively)
1981 contracts decompiled/analyzed by dec23-large-unsound-200 (1 exclusively)

ANALYTIC: decomp_time
dec23-large-master-200 (common): 13397.00133228302
dec23-large-unsound-200 (common): 15676.011434793472 (+17.01%)

ANALYTIC: Analytics_JumpToMany
dec23-large-master-200 (common): 436
dec23-large-unsound-200 (common): 436

ANALYTIC: Analytics_PublicFunction
dec23-large-master-200 (common): 80120
dec23-large-unsound-200 (common): 80090 (-0.03744%)

ANALYTIC: Analytics_ReachableBlocks
dec23-large-master-200 (common): 1631364
dec23-large-unsound-200 (common): 1631364

ANALYTIC: Analytics_UnreachableBlock
dec23-large-master-200 (common): 28720
dec23-large-unsound-200 (common): 28720

ANALYTIC: Analytics_ReachableBlocksInTAC
dec23-large-master-200 (common): 1631182
dec23-large-unsound-200 (common): 1631182

ANALYTIC: Analytics_BlockHasNoTACBlock
dec23-large-master-200 (common): 182
dec23-large-unsound-200 (common): 182

ANALYTIC: Analytics_DeadBlocks
dec23-large-master-200 (common): 2267
dec23-large-unsound-200 (common): 2267

ANALYTIC: Analytics_PolymorphicTargetSameCtx
dec23-large-master-200 (common): 1262 (+0.1587%)
dec23-large-unsound-200 (common): 1260

ANALYTIC: Analytics_LocalBlockEdge
dec23-large-master-200 (common): 1776089 (-0.001126%)
dec23-large-unsound-200 (common): 1776109

ANALYTIC: Analytics_StmtMissingOperand
dec23-large-master-200 (common): 83
dec23-large-unsound-200 (common): 83

ANALYTIC: Analytics_Contexts
dec23-large-master-200 (common): 2538793 (+17.44%)
dec23-large-unsound-200 (common): 2161745

2k contracts with metadata (metadata-dataset1):

1990 contracts decompiled/analyzed by some config
1990 contracts decompiled/analyzed by all configs (common)

ANALYTIC: decomp_time
dec23-metadata-master-200 (common): 11313.415241718292
dec23-metadata-unsound-200 (common): 12820.136463880539 (+13.32%)

ANALYTIC: Analytics_JumpToMany
dec23-metadata-master-200 (common): 358
dec23-metadata-unsound-200 (common): 358

ANALYTIC: Analytics_PublicFunction
dec23-metadata-master-200 (common): 77907
dec23-metadata-unsound-200 (common): 77901 (-0.007701%)

ANALYTIC: Analytics_ReachableBlocks
dec23-metadata-master-200 (common): 1229995
dec23-metadata-unsound-200 (common): 1229995

ANALYTIC: Analytics_UnreachableBlock
dec23-metadata-master-200 (common): 11664
dec23-metadata-unsound-200 (common): 11664

ANALYTIC: Analytics_ReachableBlocksInTAC
dec23-metadata-master-200 (common): 1229901
dec23-metadata-unsound-200 (common): 1229901

ANALYTIC: Analytics_BlockHasNoTACBlock
dec23-metadata-master-200 (common): 94
dec23-metadata-unsound-200 (common): 94

ANALYTIC: Analytics_DeadBlocks
dec23-metadata-master-200 (common): 1272
dec23-metadata-unsound-200 (common): 1272

ANALYTIC: Analytics_PolymorphicTargetSameCtx
dec23-metadata-master-200 (common): 736 (+0.2725%)
dec23-metadata-unsound-200 (common): 734

ANALYTIC: Analytics_LocalBlockEdge
dec23-metadata-master-200 (common): 1427369
dec23-metadata-unsound-200 (common): 1427310 (-0.004133%)

ANALYTIC: Analytics_StmtMissingOperand
dec23-metadata-master-200 (common): 86
dec23-metadata-unsound-200 (common): 86

ANALYTIC: Analytics_PrivateFunctionMatchesMetadata
dec23-metadata-master-200 (common): 104265
dec23-metadata-unsound-200 (common): 104265

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectArgs
dec23-metadata-master-200 (common): 505
dec23-metadata-unsound-200 (common): 505

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectReturnArgs
dec23-metadata-master-200 (common): 730
dec23-metadata-unsound-200 (common): 730

ANALYTIC: Analytics_Contexts
dec23-metadata-master-200 (common): 1826948 (+21.72%)
dec23-metadata-unsound-200 (common): 1500998

Plain Transactional

Again, a minor reduction in the number of contexts and increase in the average execution time. Doesn't really give great benefit anywhere.

via-ir-dec23:

2602 contracts decompiled/analyzed by dec23-ir-master-trans-200 (0 exclusively)
2602 contracts decompiled/analyzed by dec23-ir-unsound-trans-200 (0 exclusively)

ANALYTIC: decomp_time
dec23-ir-master-trans-200 (common): 16918.658376932144
dec23-ir-unsound-trans-200 (common): 18542.089124679565 (+9.596%)

ANALYTIC: Analytics_JumpToMany
dec23-ir-master-trans-200 (common): 7553
dec23-ir-unsound-trans-200 (common): 7553

ANALYTIC: Analytics_PublicFunction
dec23-ir-master-trans-200 (common): 52208
dec23-ir-unsound-trans-200 (common): 52194 (-0.02682%)

ANALYTIC: Analytics_ReachableBlocks
dec23-ir-master-trans-200 (common): 1022113
dec23-ir-unsound-trans-200 (common): 1022113

ANALYTIC: Analytics_UnreachableBlock
dec23-ir-master-trans-200 (common): 25090
dec23-ir-unsound-trans-200 (common): 25090

ANALYTIC: Analytics_ReachableBlocksInTAC
dec23-ir-master-trans-200 (common): 1019992
dec23-ir-unsound-trans-200 (common): 1019992

ANALYTIC: Analytics_BlockHasNoTACBlock
dec23-ir-master-trans-200 (common): 2121
dec23-ir-unsound-trans-200 (common): 2121

ANALYTIC: Analytics_DeadBlocks
dec23-ir-master-trans-200 (common): 15010
dec23-ir-unsound-trans-200 (common): 15280 (+1.799%)

ANALYTIC: Analytics_PolymorphicTargetSameCtx
dec23-ir-master-trans-200 (common): 1967
dec23-ir-unsound-trans-200 (common): 1973 (+0.305%)

ANALYTIC: Analytics_LocalBlockEdge
dec23-ir-master-trans-200 (common): 1426408 (-0.06348%)
dec23-ir-unsound-trans-200 (common): 1427314

ANALYTIC: Analytics_StmtMissingOperand
dec23-ir-master-trans-200 (common): 699
dec23-ir-unsound-trans-200 (common): 699

ANALYTIC: Analytics_PrivateFunctionMatchesMetadata
dec23-ir-master-trans-200 (common): 61974
dec23-ir-unsound-trans-200 (common): 61974

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectArgs
dec23-ir-master-trans-200 (common): 1550
dec23-ir-unsound-trans-200 (common): 1550

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectReturnArgs
dec23-ir-master-trans-200 (common): 951
dec23-ir-unsound-trans-200 (common): 951

ANALYTIC: Analytics_Contexts
dec23-ir-master-trans-200 (common): 5820182 (+7.586%)
dec23-ir-unsound-trans-200 (common): 5409804

metadata-dataset1:

1842 contracts decompiled/analyzed by dec23-metadata-master-trans-200 (0 exclusively)
1842 contracts decompiled/analyzed by dec23-metadata-unsound-trans-200 (0 exclusively)

ANALYTIC: decomp_time
dec23-metadata-master-trans-200 (common): 10633.035330295563
dec23-metadata-unsound-trans-200 (common): 12469.912697076797 (+17.28%)

ANALYTIC: Analytics_JumpToMany
dec23-metadata-master-trans-200 (common): 187
dec23-metadata-unsound-trans-200 (common): 187

ANALYTIC: Analytics_PublicFunction
dec23-metadata-master-trans-200 (common): 71587
dec23-metadata-unsound-trans-200 (common): 71582 (-0.006985%)

ANALYTIC: Analytics_ReachableBlocks
dec23-metadata-master-trans-200 (common): 1119714
dec23-metadata-unsound-trans-200 (common): 1119714

ANALYTIC: Analytics_UnreachableBlock
dec23-metadata-master-trans-200 (common): 10962
dec23-metadata-unsound-trans-200 (common): 10962

ANALYTIC: Analytics_ReachableBlocksInTAC
dec23-metadata-master-trans-200 (common): 1119591
dec23-metadata-unsound-trans-200 (common): 1119591

ANALYTIC: Analytics_BlockHasNoTACBlock
dec23-metadata-master-trans-200 (common): 123
dec23-metadata-unsound-trans-200 (common): 123

ANALYTIC: Analytics_DeadBlocks
dec23-metadata-master-trans-200 (common): 3805
dec23-metadata-unsound-trans-200 (common): 3805

ANALYTIC: Analytics_PolymorphicTargetSameCtx
dec23-metadata-master-trans-200 (common): 2678 (+0.1496%)
dec23-metadata-unsound-trans-200 (common): 2674

ANALYTIC: Analytics_LocalBlockEdge
dec23-metadata-master-trans-200 (common): 1291262
dec23-metadata-unsound-trans-200 (common): 1291224 (-0.002943%)

ANALYTIC: Analytics_StmtMissingOperand
dec23-metadata-master-trans-200 (common): 76
dec23-metadata-unsound-trans-200 (common): 76

ANALYTIC: Analytics_PrivateFunctionMatchesMetadata
dec23-metadata-master-trans-200 (common): 95228
dec23-metadata-unsound-trans-200 (common): 95228

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectArgs
dec23-metadata-master-trans-200 (common): 232
dec23-metadata-unsound-trans-200 (common): 232

ANALYTIC: Analytics_PrivateFunctionMatchesMetadataIncorrectReturnArgs
dec23-metadata-master-trans-200 (common): 547
dec23-metadata-unsound-trans-200 (common): 547

ANALYTIC: Analytics_Contexts
dec23-metadata-master-trans-200 (common): 4668384 (+11.65%)
dec23-metadata-unsound-trans-200 (common): 4181344
github-actions[bot] commented 8 months ago

Test Results (Souffle 2.3)

46 tests  ±0   46 :heavy_check_mark: ±0   23m 31s :stopwatch: + 5m 32s   1 suites ±0     0 :zzz: ±0    1 files   ±0     0 :x: ±0 

Results for commit fd452498. ± Comparison against base commit 02c8f5b6.

github-actions[bot] commented 8 months ago

Test Results (Souffle 2.4)

46 tests  ±0   46 :heavy_check_mark: ±0   24m 7s :stopwatch: + 6m 7s   1 suites ±0     0 :zzz: ±0    1 files   ±0     0 :x: ±0 

Results for commit fd452498. ± Comparison against base commit 02c8f5b6.