Conversation
5b104f4 to
cb523e4
Compare
1ad0b38 to
5472d0b
Compare
|
getting annoying, mysterious errors in the communication with the solver and sbv |
| -- testCase "calldata beyond length must be 0" $ runSMTWith z3 | ||
| -- $ query $ do calldatalist <- freshVar_ | ||
| -- -- works with length .< 10, but not 100... | ||
| -- constrain $ SL.length calldatalist .< 10 | ||
| -- let cd = DynamicSymBuffer calldatalist | ||
| -- constrain $ 0 ./= readSWord (sw256 $ sFromIntegral $ len cd) cd | ||
| -- checkSat >>= \case | ||
| -- Sat -> error "should be false" | ||
| -- Unsat -> return () | ||
| -- Unk -> error "timed out!" |
There was a problem hiding this comment.
Did you mean to leave this commented?
There was a problem hiding this comment.
I think I will remove this
| Unk -> error "timed out!" | ||
|
|
||
| , | ||
| testCase "comparing function selector" $ runSMTWith z3{transcript=Just "sameno.smt2"} $ do |
There was a problem hiding this comment.
did you mean to leave the transcript here?
| constrain $ SL.length calldatalist .< 100 | ||
| constrain $ sw256 (sFromIntegral $ SL.length calldatalist) .< sw256 100 |
There was a problem hiding this comment.
Why do we need both of these contraints?
There was a problem hiding this comment.
it turned out to yield better performance in practice
| # # OpCalldatacopy | ||
| # "loops/for_loop_array_assignment_memory_memory.sol" | ||
| # "loops/for_loop_array_assignment_memory_storage.sol" | ||
| # "loops/while_loop_array_assignment_memory_memory.sol" | ||
| # "loops/while_loop_array_assignment_memory_storage.sol" | ||
| # "types/address_call.sol" | ||
| # "types/address_delegatecall.sol" | ||
| # "types/address_staticcall.sol" | ||
| # "types/array_aliasing_storage_2.sol" | ||
| # "types/array_aliasing_storage_3.sol" | ||
| # "types/array_aliasing_storage_5.sol" | ||
| # "types/array_branch_1d.sol" | ||
| # "types/array_branches_1d.sol" | ||
| # "types/array_dynamic_parameter_1.sol" | ||
| # "types/array_dynamic_parameter_1_fail.sol" | ||
| # "types/bytes_1.sol" | ||
| # "types/bytes_2.sol" | ||
| # "types/bytes_2_fail.sol" | ||
| # "types/mapping_unsupported_key_type_1.sol" | ||
| # "types/function_type_array_as_reference_type.sol" |
There was a problem hiding this comment.
Did you mean to leave these commented?
|
|
||
| burnSym :: SymWord -> EVM () -> EVM () | ||
| burnSym n continue = case maybeLitWord n of | ||
| Nothing -> continue -- smt query (TODO: no gas mode) |
There was a problem hiding this comment.
Does this mean no gas is deduced when dealing with symbolic values?
There was a problem hiding this comment.
currently yes. But there should really be a query made here unless run in --no-gas mode.
Replaces #491