Skip to content

Commit

Permalink
Del unused code [Liquidite] (#258)
Browse files Browse the repository at this point in the history 
* clippy

* del unused code

* Update Cargo.toml
  • Loading branch information
@0xAWM
0xAWM authored Oct 19, 2023
1 parent 51986a5 commit be8cf36
Show file tree
Hide file tree
Showing 6 changed files with 227 additions and 970 deletions.
6 changes: 3 additions & 3 deletions Cargo.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ default = [
"dataflow",
"evm",
"print_txn_corpus",
"full_trace"
"full_trace",
]
evm = []
cmp = []
Expand Down Expand Up @@ -92,9 +92,9 @@ revm-interpreter = { git = "https://github.com/fuzzland/revm", rev = "60d409c17d
"memory_limit",
] }
# external fuzzing-based abi decompiler
heimdall_core = { git = "https://github.com/fuzzland/heimdall-rs.git", package = "heimdall-core"}
heimdall_core = { git = "https://github.com/fuzzland/heimdall-rs.git", package = "heimdall-core" }
# heimdall_core relies on an async runtime
tokio = {version = "1.0", features = ["full"]}
tokio = { version = "1.0", features = ["full"] }


move-binary-format = { git = "https://github.com/fuzzland/ityfuzz-sui-fork.git", package = "move-binary-format", optional = true }
Expand Down
52 changes: 31 additions & 21 deletions src/evm/oracle.rs
View file
Original file line number Diff line number Diff line change
@@ -1,28 +1,28 @@
/// Dummy oracle for testing
use crate::evm::input::{ConciseEVMInput, EVMInput, EVMInputT};
use std::collections::{HashMap, HashSet};

use crate::evm::input::{ConciseEVMInput, EVMInput};
use crate::evm::srcmap::parser::SourceMapLocation;
use crate::evm::types::{EVMAddress, EVMFuzzState, EVMOracleCtx, EVMU256};

use crate::evm::vm::EVMState;

use crate::oracle::{Oracle, OracleCtx};
use crate::state::HasExecutionResult;

use crate::fuzzer::ORACLE_OUTPUT;
use crate::oracle::Oracle;
use bytes::Bytes;
use libafl_bolts::impl_serdeany;

use crate::evm::uniswap::{liquidate_all_token, TokenContext};
use revm_primitives::Bytecode;
use serde::{Deserialize, Serialize};
use crate::evm::middlewares::call_printer::CallPrinterResult;
use crate::evm::srcmap::parser::SourceMapLocation;
use crate::fuzzer::ORACLE_OUTPUT;

pub struct NoOracle {}

impl Oracle<EVMState, EVMAddress, Bytecode, Bytes, EVMAddress, EVMU256, Vec<u8>, EVMInput, EVMFuzzState, ConciseEVMInput>
for NoOracle
impl
Oracle<
EVMState,
EVMAddress,
Bytecode,
Bytes,
EVMAddress,
EVMU256,
Vec<u8>,
EVMInput,
EVMFuzzState,
ConciseEVMInput,
> for NoOracle
{
fn transition(&self, _ctx: &mut EVMOracleCtx<'_>, _stage: u64) -> u64 {
0
Expand All @@ -37,7 +37,6 @@ pub fn dummy_precondition(_ctx: &mut EVMOracleCtx<'_>, _stage: u64) -> u64 {
99
}


pub struct EVMBugResult {
pub bug_type: String,
pub bug_info: String,
Expand All @@ -47,7 +46,6 @@ pub struct EVMBugResult {
pub bug_idx: u64,
}


impl EVMBugResult {
pub fn to_value(&self) -> serde_json::Value {
serde_json::json!({
Expand All @@ -60,7 +58,14 @@ impl EVMBugResult {
})
}

pub fn new(bug_type: String, bug_idx: u64, bug_info: String, input: ConciseEVMInput, sourcemap: Option<SourceMapLocation>, issue_source: Option<String>) -> Self {
pub fn new(
bug_type: String,
bug_idx: u64,
bug_info: String,
input: ConciseEVMInput,
sourcemap: Option<SourceMapLocation>,
issue_source: Option<String>,
) -> Self {
Self {
bug_type,
bug_info,
Expand All @@ -71,7 +76,12 @@ impl EVMBugResult {
}
}

pub fn new_simple(bug_type: String, bug_idx: u64, bug_info: String, input: ConciseEVMInput) -> Self {
pub fn new_simple(
bug_type: String,
bug_idx: u64,
bug_info: String,
input: ConciseEVMInput,
) -> Self {
Self {
bug_type,
bug_info,
Expand Down
143 changes: 83 additions & 60 deletions src/evm/oracles/erc20.rs
View file
Original file line number Diff line number Diff line change
@@ -1,22 +1,29 @@
use crate::evm::input::{ConciseEVMInput, EVMInput, EVMInputT};
use crate::evm::input::{ConciseEVMInput, EVMInput};
use crate::evm::oracle::EVMBugResult;
use crate::evm::oracles::ERC20_BUG_IDX;
use crate::evm::producers::erc20::ERC20Producer;
use crate::evm::producers::pair::PairProducer;
use crate::evm::types::{EVMAddress, EVMFuzzState, EVMOracleCtx, EVMU256, EVMU512};
use crate::evm::uniswap::{liquidate_all_token, TokenContext};
#[cfg(feature = "flashloan_v2")]
use crate::evm::uniswap::TokenContext;
use crate::evm::vm::EVMState;
use crate::oracle::Oracle;
use crate::state::HasExecutionResult;
use bytes::Bytes;
use revm_primitives::Bytecode;
use std::borrow::Borrow;
use std::cell::RefCell;
#[cfg(feature = "flashloan_v2")]
use std::collections::HashMap;
#[cfg(feature = "flashloan_v2")]
use std::ops::Deref;
use std::rc::Rc;
use crate::evm::oracle::EVMBugResult;
use crate::evm::oracles::ERC20_BUG_IDX;
use crate::evm::producers::erc20::ERC20Producer;
use crate::fuzzer::ORACLE_OUTPUT;

#[cfg(not(feature = "flashloan_v2"))]
pub struct IERC20OracleFlashloan {
pub balance_of: Vec<u8>,
}

#[cfg(feature = "flashloan_v2")]
pub struct IERC20OracleFlashloan {
pub balance_of: Vec<u8>,
#[cfg(feature = "flashloan_v2")]
Expand All @@ -38,13 +45,16 @@ impl IERC20OracleFlashloan {
}

#[cfg(feature = "flashloan_v2")]
pub fn new(pair_producer: Rc<RefCell<PairProducer>>, erc20_producer: Rc<RefCell<ERC20Producer>>) -> Self {
pub fn new(
pair_producer: Rc<RefCell<PairProducer>>,
erc20_producer: Rc<RefCell<ERC20Producer>>,
) -> Self {
Self {
balance_of: hex::decode("70a08231").unwrap(),
known_tokens: HashMap::new(),
known_pair_reserve_slot: HashMap::new(),
pair_producer,
erc20_producer
erc20_producer,
}
}

Expand All @@ -59,8 +69,19 @@ impl IERC20OracleFlashloan {
}
}

impl Oracle<EVMState, EVMAddress, Bytecode, Bytes, EVMAddress, EVMU256, Vec<u8>, EVMInput, EVMFuzzState, ConciseEVMInput>
for IERC20OracleFlashloan
impl
Oracle<
EVMState,
EVMAddress,
Bytecode,
Bytes,
EVMAddress,
EVMU256,
Vec<u8>,
EVMInput,
EVMFuzzState,
ConciseEVMInput,
> for IERC20OracleFlashloan
{
fn transition(&self, _ctx: &mut EVMOracleCtx<'_>, _stage: u64) -> u64 {
0
Expand All @@ -71,20 +92,16 @@ impl Oracle<EVMState, EVMAddress, Bytecode, Bytes, EVMAddress, EVMU256, Vec<u8>,
// has balance increased?
let exec_res = &ctx.fuzz_state.get_execution_result().new_state.state;
if exec_res.flashloan_data.earned > exec_res.flashloan_data.owed {
unsafe {
EVMBugResult::new_simple(
"erc20".to_string(),
ERC20_BUG_IDX,
format!(
"Earned {}wei more than owed {}wei",
exec_res.flashloan_data.earned, exec_res.flashloan_data.owed
),
ConciseEVMInput::from_input(
ctx.input,
ctx.fuzz_state.get_execution_result(),
)
).push_to_output();
}
EVMBugResult::new_simple(
"erc20".to_string(),
ERC20_BUG_IDX,
format!(
"Earned {}wei more than owed {}wei",
exec_res.flashloan_data.earned, exec_res.flashloan_data.owed
),
ConciseEVMInput::from_input(ctx.input, ctx.fuzz_state.get_execution_result()),
)
.push_to_output();
vec![ERC20_BUG_IDX]
} else {
vec![]
Expand All @@ -93,19 +110,23 @@ impl Oracle<EVMState, EVMAddress, Bytecode, Bytes, EVMAddress, EVMU256, Vec<u8>,

#[cfg(feature = "flashloan_v2")]
fn oracle(&self, ctx: &mut EVMOracleCtx<'_>, _stage: u64) -> Vec<u64> {
use crate::evm::{uniswap::generate_uniswap_router_sell, types::EVMFuzzExecutor};
use crate::evm::{input::EVMInputT, uniswap::generate_uniswap_router_sell};

let liquidation_percent = ctx.input.get_liquidation_percent();
if liquidation_percent > 0 {
let liquidation_percent = EVMU256::from(liquidation_percent);
let mut liquidations_earned = Vec::new();

for ((caller, token), (prev_balance, new_balance)) in self.erc20_producer.deref().borrow().balances.iter() {
for ((caller, token), (_prev_balance, new_balance)) in
self.erc20_producer.deref().borrow().balances.iter()
{
let token_info = self.known_tokens.get(token).expect("Token not found");

#[cfg(feature = "flashloan_debug")]
println!("Balance: {} -> {} for {:?} @ {:?}", prev_balance, new_balance, caller, token);

println!(
"Balance: {} -> {} for {:?} @ {:?}",
prev_balance, new_balance, caller, token
);

if *new_balance > EVMU256::ZERO {
let liq_amount = *new_balance * liquidation_percent / EVMU256::from(10);
Expand All @@ -116,29 +137,32 @@ impl Oracle<EVMState, EVMAddress, Bytecode, Bytes, EVMAddress, EVMU256, Vec<u8>,
let path_idx = ctx.input.get_randomness()[0] as usize;

let mut liquidation_txs = vec![];

// println!("Liquidations earned: {:?}", liquidations_earned);
for (caller, token_info, amount) in liquidations_earned {
let txs = generate_uniswap_router_sell(
&token_info, path_idx, amount, ctx.fuzz_state.callers_pool[0]);
token_info,
path_idx,
amount,
ctx.fuzz_state.callers_pool[0],
);
if txs.is_none() {
continue;
}
liquidation_txs.extend(txs.unwrap().iter().map(
|(abi, _, addr)| {
(caller, *addr, Bytes::from(abi.get_bytes()))
}
));

liquidation_txs.extend(
txs.unwrap()
.iter()
.map(|(abi, _, addr)| (caller, *addr, Bytes::from(abi.get_bytes()))),
);
}
// println!(
// "Liquidation txs: {:?}",
// liquidation_txs
// );



// println!("Earned before liquidation: {:?}", ctx.fuzz_state.get_execution_result().new_state.state.flashloan_data.earned);
let (out, state) = ctx.call_post_batch_dyn(&liquidation_txs);
let (_out, state) = ctx.call_post_batch_dyn(&liquidation_txs);
// println!("results: {:?}", out);
// println!("result state: {:?}", state.flashloan_data);
ctx.fuzz_state.get_execution_result_mut().new_state.state = state;
Expand All @@ -160,29 +184,28 @@ impl Oracle<EVMState, EVMAddress, Bytecode, Bytes, EVMAddress, EVMU256, Vec<u8>,

if exec_res.new_state.state.flashloan_data.earned
> exec_res.new_state.state.flashloan_data.owed
&& exec_res.new_state.state.flashloan_data.earned - exec_res.new_state.state.flashloan_data.owed > EVMU512::from(10_000_000_000_000_000_000_000_0u128) // > 0.1ETH
&& exec_res.new_state.state.flashloan_data.earned
- exec_res.new_state.state.flashloan_data.owed
> EVMU512::from(100_000_000_000_000_000_000_000_u128)
// > 0.1ETH
{
let net = exec_res.new_state.state.flashloan_data.earned
- exec_res.new_state.state.flashloan_data.owed;
// we scaled by 1e24, so divide by 1e24 to get ETH
let net_eth = net / EVMU512::from(10_000_000_000_000_000_000_000_00u128);
unsafe {
EVMBugResult::new_simple(
"erc20".to_string(),
ERC20_BUG_IDX,
format!(
"Earned {} more than owed {}, net earned = {}wei ({}ETH)\n",
exec_res.new_state.state.flashloan_data.earned,
exec_res.new_state.state.flashloan_data.owed,
net,
net_eth,
),
ConciseEVMInput::from_input(
ctx.input,
ctx.fuzz_state.get_execution_result(),
)
).push_to_output();
}
let net_eth = net / EVMU512::from(1_000_000_000_000_000_000_000_000_u128);
EVMBugResult::new_simple(
"erc20".to_string(),
ERC20_BUG_IDX,
format!(
"Earned {} more than owed {}, net earned = {}wei ({}ETH)\n",
exec_res.new_state.state.flashloan_data.earned,
exec_res.new_state.state.flashloan_data.owed,
net,
net_eth,
),
ConciseEVMInput::from_input(ctx.input, ctx.fuzz_state.get_execution_result()),
)
.push_to_output();
vec![ERC20_BUG_IDX]
} else {
vec![]
Expand Down
Loading

0 comments on commit be8cf36

Please sign in to comment.