Without path condition, verification targets created inside ternary
operator ignore the condition of the operator inside the branches.
This led to false positives.
Further updates:
- Function calls should consider the conditions under which they are
called, otherwise the analysis may report false positives.
The fix proposed here is to add the current path condition to the edge
that propagates error from a function call.
- Increment error index after function call
This is necessary for the analysis of the ternary operator to work
correctly. No information should leak from a function call inside a
ternary operator in the first branch to the second branch, including
whether or not an error would have occured in the first branch.
However, for the execution that continues after the function call,
we still need to ensure that under the current path condition
the error has not occurred in that function call.
It would be better to isolate the analysis of the branches to separate
clauses, but I do not see an easy way for that now. In this way, even
though the function call in first branch is included in the clause of
the second branch, no information leaks.
- Additonal test for ternary operator
This tests the behaviour of SMTChecker on ternary operator with function
calls inside both branches. Specifically, it tests that SMTChecker
successfully detects a violation of a verification target in the second
branch when the same target is present also in the first branch, but
there it cannot be triggered because of the operator's condition.
1. `push0_disallowed.yul`: checks if `push0()` is a valid builtin in strict Yul
2. `push0_disallowed.sol`: checks if `push0()` is a valid builtin in inline assembly
3. `push0.sol`: simple semantic test that returns 0
4. `evmone_support.sol`: tests if push0 works properly in evmone
5. Updated some bytecode too large tests to use `shanghai` as version
6. Updated various tests where `push1 0` was hardcoded in different forms / expectations on bytecode
size (`Assembler.cpp`, `GasCosts.cpp`, `SolidityCompiler.cpp`, `SolidityExpressionCompiler.cpp`)
Leo
Martin Blicha
Kamil Śliwak
Daniel
Matheus Aguiar
Nikola Matić
Marko Veniger
Alex Beregszaszi
hrkrshnn
Christian Parpart
Rodrigo Q. SaramagoandDaniel
chriseth
wechman
Pawel Gebal