1

I am currently trying to use genetic algorithms to automatically generate test cases that for ethereum smart contracts similar to https://ieeexplore.ieee.org/abstract/document/7840029>this paper. In order to do this, I need to be able to evaluate how close a particular function is to satisfying a branch predicate. Looking at the opcodes can tell me when a branch predicate occurs for example:

...
SLOAD
TIMESTAMP
GT
DUP1
ISZERO
PUSH2 0x10f
JUMPI
#... More opcodes

In the example above, a value is retreived from storage and compared to the block timestamp. If the value is greater than the timestamp, the execution continues with #... More opcodes and otherwise it jumps to 0x10f. I would like to be able to somehow extract the value for SLOAD and TIMESTAMP at the time of execution.

More generally my question is: Is there any way to get the values that are on the stack when the "GT" opcode is executed? Ideally I would like to do this in pyevm, but another way is also fine if you know it.

Improve this question
3
  • It seems tracing an execution is not supported yet, but there's a pull request github.com/ethereum/py-evm/pull/1515. It seems you want to deduce necesary conditions to execute certain paths, I've seen that some tools like Oyente use solvers like z3 to accomplish that task.
    – Ismael ♦
    Commented May 9, 2019 at 16:55
  • Yes, I looked at Oyente as well. Like them I have managed to create a control flow graph and I can also deduce the necessary conditions (like identify the GT in the example above). The challenge for me comes at the point where I have a test case that interacts with the contract. I need to see how close any method call/transaction is to satisfying the branch predicate (so with what values are the predicates called). I don't think Oyente does that yet? Please correct me if I am wrong!
    – Stefan
    Commented May 9, 2019 at 18:08
  • That github-link you shared seems very much like what I want, I am going to try using href=web3js.readthedocs.io/en/1.0/… for now and I will post again if that works.
    – Stefan
    Commented May 9, 2019 at 18:12

2 Answers 2

Reset to default
0

Shouldn't it be possible to inject an opcode before GT to store the values in memory and later read them?

Improve this answer
5
  • You like adding some MSTORE Opcodes? But then how would I later read them?
    – Stefan
    Commented May 9, 2019 at 12:47
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. - From Review
    – Achala Dissanayake
    Commented May 9, 2019 at 14:45
  • Thank you for pointing out the obvious, @AchalaDissanayake. As with many problems of high complexity, a thought-provoking impulse can contribute to sparking an idea that might help finding a solution. Your comment, though, served not even this purpose to the slightest.
    – n1cK
    Commented May 9, 2019 at 16:19
  • @Stefan I am not an expert for handling stack operations in Ethereum unfortunately, my intent was to propose the idea to duplicate the data on the stack for later evaluation. Unfortunately MSTORE won't suit it I see, because according to the yellow paper MSTORE pops off 2 items from the stack.
    – n1cK
    Commented May 9, 2019 at 16:27
  • I appreciate your response Nikita, I could always combine the MSTORE operations with some DUP (duplications), so that the items are not popped from the stack. My problem however would still be that I then need to somehow read it from memory.
    – Stefan
    Commented May 9, 2019 at 18:04
0

When using truffle you can use the debug functionality which can print the stack and opcodes step by step for any given transaction hash. It is probably also possible to access the logs directly rather than have them printed in the terminal.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.