I am currently trying to use genetic algorithms to automatically generate test cases that for ethereum smart contracts similar to https://ieeexplore.ieee.org/abstract/document/7840029>this paper. In order to do this, I need to be able to evaluate how close a particular function is to satisfying a branch predicate. Looking at the opcodes can tell me when a branch predicate occurs for example:

PUSH2 0x10f
#... More opcodes

In the example above, a value is retreived from storage and compared to the block timestamp. If the value is greater than the timestamp, the execution continues with #... More opcodes and otherwise it jumps to 0x10f. I would like to be able to somehow extract the value for SLOAD and TIMESTAMP at the time of execution.

More generally my question is: Is there any way to get the values that are on the stack when the "GT" opcode is executed? Ideally I would like to do this in pyevm, but another way is also fine if you know it.

  • It seems tracing an execution is not supported yet, but there's a pull request github.com/ethereum/py-evm/pull/1515. It seems you want to deduce necesary conditions to execute certain paths, I've seen that some tools like Oyente use solvers like z3 to accomplish that task.
    – Ismael
    May 9 '19 at 16:55
  • Yes, I looked at Oyente as well. Like them I have managed to create a control flow graph and I can also deduce the necessary conditions (like identify the GT in the example above). The challenge for me comes at the point where I have a test case that interacts with the contract. I need to see how close any method call/transaction is to satisfying the branch predicate (so with what values are the predicates called). I don't think Oyente does that yet? Please correct me if I am wrong!
    – Stefan
    May 9 '19 at 18:08
  • That github-link you shared seems very much like what I want, I am going to try using href=web3js.readthedocs.io/en/1.0/… for now and I will post again if that works.
    – Stefan
    May 9 '19 at 18:12

Shouldn't it be possible to inject an opcode before GT to store the values in memory and later read them?

  • You like adding some MSTORE Opcodes? But then how would I later read them?
    – Stefan
    May 9 '19 at 12:47
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review May 9 '19 at 14:45
  • Thank you for pointing out the obvious, @AchalaDissanayake. As with many problems of high complexity, a thought-provoking impulse can contribute to sparking an idea that might help finding a solution. Your comment, though, served not even this purpose to the slightest. May 9 '19 at 16:19
  • @Stefan I am not an expert for handling stack operations in Ethereum unfortunately, my intent was to propose the idea to duplicate the data on the stack for later evaluation. Unfortunately MSTORE won't suit it I see, because according to the yellow paper MSTORE pops off 2 items from the stack. May 9 '19 at 16:27
  • I appreciate your response Nikita, I could always combine the MSTORE operations with some DUP (duplications), so that the items are not popped from the stack. My problem however would still be that I then need to somehow read it from memory.
    – Stefan
    May 9 '19 at 18:04

When using truffle you can use the debug functionality which can print the stack and opcodes step by step for any given transaction hash. It is probably also possible to access the logs directly rather than have them printed in the terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.