Why using assert, since it would consume all gas

Question

Since assert would consume all gas and require would return all gas, is there any reason to use assert not require? Using require to refund gas seems always a better choice than consuming them?

I saw some explanation in Difference between require and assert and the difference between revert and throw but I still don't get it: what is the benefit of choosing a command that consumes all gas?

Answer 1

You can use assert (over require) to indicate your intention to source code analyzers such as oyente. While require is good to validate input, it can sometimes be false because the user did something innappropriate. assert, on the other hand, is meant to indicate something that should never be false under any circumstances. Knowing this, a source code analyzer can possibly detect a logical error in the system by discovering any situation in which the assert might not be true.

Hope it helps.

Answer 2

If you want to punish the naughty users who supply bad arguments to your functions, you should use up all their gas :-)

Answer 3

Here's a good article: https://codeforgeek.com/assert-vs-require-in-solidity/

Philosophically, they are intended to mean two very different things. require is "user should have done this before calling the function", whereas assert means "something fundamentally is wrong".

Pragmatically, it depends on what your intention is. If the goal is to ensure the least impact on the user, then require is preferred only because it returns the gas. However, if your intention is security/auditability/maintainability/clarity of intention, then there are situations where you'd prefer one over the other.

Answer 4

You should use assert to help you find invariants which have been violated.

You use assert to help you catch when the impossible happens.

Solidity also has an SMTChecker which can prove that your invariants are true:

Solidity implements a formal verification approach based on SMT (Satisfiability Modulo Theories) and Horn solving. The SMTChecker module automatically tries to prove that the code satisfies the specification given by require and assert statements. That is, it considers require statements as assumptions and tries to prove that the conditions inside assert statements are always true. If an assertion failure is found, a counterexample may be given to the user showing how the assertion can be violated. If no warning is given by the SMTChecker for a property, it means that the property is safe.

The SMTChecker Tutorial provides a good example of assert that is too lengthy to include here: highly recommend to read it.

Since assert should never be false, you do not have to worry about consuming all the user's gas.

If the SMTChecker gets you excited to start using assert, that's a very good thing. But remember they are for invariants, as the Solidity docs mention:

Assert should only be used to test for internal errors, and to check invariants. Properly functioning code should never create a Panic, not even on invalid external input. If this happens, then there is a bug in your contract which you should fix. Language analysis tools can evaluate your contract to identify the conditions and function calls which will cause a Panic.