Skip to content

Commit

Permalink
Refactoring reentrancy checker
Browse files Browse the repository at this point in the history
  • Loading branch information
VincenzoArceri committed Nov 5, 2024
1 parent 91cbba8 commit 5aaac5e
Show file tree
Hide file tree
Showing 2 changed files with 25 additions and 63 deletions.
2 changes: 1 addition & 1 deletion src/main/java/it/unipr/cfg/EVMCFG.java
Original file line number Diff line number Diff line change
Expand Up @@ -289,7 +289,7 @@ private boolean dfsSequential(Statement start, Statement target, Set<Statement>
Collection<Edge> outgoingEdges = list.getOutgoingEdges(current);

for (Edge edge : outgoingEdges) {
if (edge.getSource() instanceof Jump || edge.getSource() instanceof Jumpi)
if (edge.getSource() instanceof Jumpi || edge.getSource() instanceof Jump)
continue;
Statement next = edge.getDestination();
if (!visited.contains(next))
Expand Down
86 changes: 24 additions & 62 deletions src/main/java/it/unipr/checker/ReentrancyChecker.java
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
package it.unipr.checker;

import java.util.Set;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

import it.unipr.analysis.AbstractStack;
import it.unipr.analysis.EVMAbstractState;
import it.unipr.analysis.MyCache;
import it.unipr.analysis.StackElement;
import it.unipr.analysis.UniqueItemCollector;
import it.unipr.cfg.Call;
import it.unipr.cfg.EVMCFG;
import it.unipr.cfg.ProgramCounterLocation;
Expand All @@ -19,21 +22,16 @@
import it.unive.lisa.checks.semantic.SemanticCheck;
import it.unive.lisa.program.cfg.CFG;
import it.unive.lisa.program.cfg.statement.Statement;
import java.util.Set;
import org.apache.commons.lang3.tuple.ImmutablePair;
import org.apache.commons.lang3.tuple.Pair;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class ReentrancyChecker implements
SemanticCheck<SimpleAbstractState<MonolithicHeap, EVMAbstractState, TypeEnvironment<InferredTypes>>> {
SemanticCheck<SimpleAbstractState<MonolithicHeap, EVMAbstractState, TypeEnvironment<InferredTypes>>> {

private static final Logger log = LogManager.getLogger(ReentrancyChecker.class);

@Override
public boolean visit(
CheckToolWithAnalysisResults<
SimpleAbstractState<MonolithicHeap, EVMAbstractState, TypeEnvironment<InferredTypes>>> tool,
SimpleAbstractState<MonolithicHeap, EVMAbstractState, TypeEnvironment<InferredTypes>>> tool,
CFG graph, Statement node) {

if (node instanceof Call) {
Expand All @@ -44,7 +42,7 @@ public boolean visit(
for (AnalyzedCFG<SimpleAbstractState<MonolithicHeap, EVMAbstractState,
TypeEnvironment<InferredTypes>>> result : tool.getResultOf(cfg)) {
AnalysisState<SimpleAbstractState<MonolithicHeap, EVMAbstractState,
TypeEnvironment<InferredTypes>>> analysisResult = null;
TypeEnvironment<InferredTypes>>> analysisResult = null;

try {
analysisResult = result.getAnalysisStateBefore(call);
Expand Down Expand Up @@ -84,59 +82,23 @@ private void checkForReentrancy(Call call, Statement sstore, CheckToolWithAnalys
SimpleAbstractState<MonolithicHeap, EVMAbstractState, TypeEnvironment<InferredTypes>>> tool,
Set<Statement> ns, EVMCFG cfg) {

Pair<Object, Object> myPair = new ImmutablePair<>(call, sstore);

ProgramCounterLocation sstoreLoc = (ProgramCounterLocation) sstore.getLocation();
if (MyCache.getInstance().existsStmtReachableFrom(myPair)) {
if (MyCache.getInstance().isStmtReachableFrom(myPair)) {

for (Statement otherSstore : ns)
if (!otherSstore.equals(sstore))
if (otherSstore.getLocation().compareTo(sstoreLoc) > 0
&& cfg.reachableFromSequentially(sstore, otherSstore))
sstoreLoc = (ProgramCounterLocation) otherSstore.getLocation();

log.debug("Reentrancy attack at "
+ sstoreLoc.getPc() + "at line no. "
+ sstoreLoc.getSourceCodeLine()
+ "coming from line "
+ ((ProgramCounterLocation) call.getLocation()).getSourceCodeLine());
String warn = "Reentrancy attack at "
+ sstoreLoc.getPc();
tool.warn(warn);
UniqueItemCollector.getInstance().add(warn); // TODO
// to
// optimize,
// temp
// solution
}
} else {
if (cfg.reachableFrom(call, sstore)) {

for (Statement otherSstore : ns)
if (!otherSstore.equals(sstore))
if (otherSstore.compareTo(sstore) > 0 && cfg.reachableFromSequentially(sstore, otherSstore))
sstoreLoc = (ProgramCounterLocation) otherSstore.getLocation();

MyCache.getInstance().setStmtReachableFrom(myPair, true);
log.debug("Reentrancy attack at "
+ sstoreLoc.getPc() + "at line no. "
+ sstoreLoc.getSourceCodeLine()
+ "coming from line "
+ ((ProgramCounterLocation) call.getLocation()).getSourceCodeLine());
String warn = "Reentrancy attack at "
+ sstoreLoc.getPc();
tool.warn(warn);
UniqueItemCollector.getInstance().add(warn); // TODO
// to
// optimize,
// temp
// solution

} else {
MyCache.getInstance().setStmtReachableFrom(myPair, false);
}

if (cfg.reachableFrom(call, sstore)) {
for (Statement otherSstore : ns)
if (!otherSstore.equals(sstore))
if (cfg.reachableFromSequentially(sstore, otherSstore))
sstoreLoc = (ProgramCounterLocation) otherSstore.getLocation();

log.debug("Reentrancy attack at "
+ sstoreLoc.getPc() + "at line no. "
+ sstoreLoc.getSourceCodeLine()
+ "coming from line "
+ ((ProgramCounterLocation) call.getLocation()).getSourceCodeLine());
String warn = "Reentrancy attack at "
+ sstoreLoc.getPc();
tool.warn(warn);

}
}

}

0 comments on commit 5aaac5e

Please sign in to comment.