def _post_member_access(self, expression): expr = get(expression.expression) # Look for type(X).max / min # Because we looked at the AST structure, we need to look into the nested expression # Hopefully this is always on a direct sub field, and there is no weird construction if isinstance(expression.expression, CallExpression) and expression.member_name in [ "min", "max", ]: if isinstance(expression.expression.called, Identifier): if expression.expression.called.value == SolidityFunction("type()"): assert len(expression.expression.arguments) == 1 val = TemporaryVariable(self._node) type_expression_found = expression.expression.arguments[0] assert isinstance(type_expression_found, ElementaryTypeNameExpression) type_found = type_expression_found.type if expression.member_name == "min:": op = Assignment(val, Constant(str(type_found.min), type_found), type_found,) else: op = Assignment(val, Constant(str(type_found.max), type_found), type_found,) self._result.append(op) set_val(expression, val) return val = ReferenceVariable(self._node) member = Member(expr, Constant(expression.member_name), val) member.set_expression(expression) self._result.append(member) set_val(expression, val)
def _post_member_access(self, expression): expr = get(expression.expression) val = ReferenceVariable(self._node) member = Member(expr, Constant(expression.member_name), val) member.set_expression(expression) self._result.append(member) set_val(expression, val)
def _post_call_expression(self, expression): called = get(expression.called) args = [get(a) for a in expression.arguments if a] for arg in args: arg_ = Argument(arg) arg_.set_expression(expression) self._result.append(arg_) if isinstance(called, Function): # internal call # If tuple if expression.type_call.startswith('tuple(') and expression.type_call != 'tuple()': val = TupleVariable(self._node) else: val = TemporaryVariable(self._node) internal_call = InternalCall(called, len(args), val, expression.type_call) internal_call.set_expression(expression) self._result.append(internal_call) set_val(expression, val) else: # yul things if called.name == 'caller()': val = TemporaryVariable(self._node) var = Assignment(val, SolidityVariableComposed('msg.sender'), 'uint256') self._result.append(var) set_val(expression, val) elif called.name == 'origin()': val = TemporaryVariable(self._node) var = Assignment(val, SolidityVariableComposed('tx.origin'), 'uint256') self._result.append(var) set_val(expression, val) elif called.name == 'extcodesize(uint256)': val = ReferenceVariable(self._node) var = Member(args[0], Constant('codesize'), val) self._result.append(var) set_val(expression, val) elif called.name == 'selfbalance()': val = TemporaryVariable(self._node) var = TypeConversion(val, SolidityVariable('this'), ElementaryType('address')) self._result.append(var) val1 = ReferenceVariable(self._node) var1 = Member(val, Constant('balance'), val1) self._result.append(var1) set_val(expression, val1) elif called.name == 'address()': val = TemporaryVariable(self._node) var = TypeConversion(val, SolidityVariable('this'), ElementaryType('address')) self._result.append(var) set_val(expression, val) elif called.name == 'callvalue()': val = TemporaryVariable(self._node) var = Assignment(val, SolidityVariableComposed('msg.value'), 'uint256') self._result.append(var) set_val(expression, val) else: # If tuple if expression.type_call.startswith('tuple(') and expression.type_call != 'tuple()': val = TupleVariable(self._node) else: val = TemporaryVariable(self._node) message_call = TmpCall(called, len(args), val, expression.type_call) message_call.set_expression(expression) # Gas/value are only accessible here if the syntax {gas: , value: } # Is used over .gas().value() if expression.call_gas: call_gas = get(expression.call_gas) message_call.call_gas = call_gas if expression.call_value: call_value = get(expression.call_value) message_call.call_value = call_value if expression.call_salt: call_salt = get(expression.call_salt) message_call.call_salt = call_salt self._result.append(message_call) set_val(expression, val)
def copy_ir(ir, local_variables_instances, state_variables_instances, temporary_variables_instances, reference_variables_instances, all_local_variables_instances): ''' Args: ir (Operation) local_variables_instances(dict(str -> LocalVariable)) state_variables_instances(dict(str -> StateVariable)) temporary_variables_instances(dict(int -> Variable)) reference_variables_instances(dict(int -> Variable)) Note: temporary and reference can be indexed by int, as they dont need phi functions ''' def get(variable): if isinstance(variable, LocalVariable): if variable.name in local_variables_instances: return local_variables_instances[variable.name] new_var = LocalIRVariable(variable) local_variables_instances[variable.name] = new_var all_local_variables_instances[variable.name] = new_var return new_var if isinstance( variable, StateVariable ) and variable.canonical_name in state_variables_instances: return state_variables_instances[variable.canonical_name] elif isinstance(variable, ReferenceVariable): if not variable.index in reference_variables_instances: new_variable = ReferenceVariable(variable.node, index=variable.index) if variable.points_to: new_variable.points_to = get(variable.points_to) new_variable.set_type(variable.type) reference_variables_instances[variable.index] = new_variable return reference_variables_instances[variable.index] elif isinstance(variable, TemporaryVariable): if not variable.index in temporary_variables_instances: new_variable = TemporaryVariable(variable.node, index=variable.index) new_variable.set_type(variable.type) temporary_variables_instances[variable.index] = new_variable return temporary_variables_instances[variable.index] return variable def get_variable(ir, f): variable = f(ir) variable = get(variable) return variable def get_arguments(ir): arguments = [] for arg in ir.arguments: arg = get(arg) arguments.append(arg) return arguments def get_rec_values(ir, f): # Use by InitArray and NewArray # Potential recursive array(s) ori_init_values = f(ir) def traversal(values): ret = [] for v in values: if isinstance(v, list): v = traversal(v) else: v = get(v) ret.append(v) return ret return traversal(ori_init_values) if isinstance(ir, Assignment): lvalue = get_variable(ir, lambda x: ir.lvalue) rvalue = get_variable(ir, lambda x: ir.rvalue) variable_return_type = ir.variable_return_type return Assignment(lvalue, rvalue, variable_return_type) elif isinstance(ir, Balance): lvalue = get_variable(ir, lambda x: ir.lvalue) value = get_variable(ir, lambda x: ir.value) return Balance(value, lvalue) elif isinstance(ir, Binary): lvalue = get_variable(ir, lambda x: ir.lvalue) variable_left = get_variable(ir, lambda x: ir.variable_left) variable_right = get_variable(ir, lambda x: ir.variable_right) operation_type = ir.type return Binary(lvalue, variable_left, variable_right, operation_type) elif isinstance(ir, Condition): val = get_variable(ir, lambda x: ir.value) return Condition(val) elif isinstance(ir, Delete): lvalue = get_variable(ir, lambda x: ir.lvalue) variable = get_variable(ir, lambda x: ir.variable) return Delete(lvalue, variable) elif isinstance(ir, EventCall): name = ir.name return EventCall(name) elif isinstance(ir, HighLevelCall): # include LibraryCall destination = get_variable(ir, lambda x: ir.destination) function_name = ir.function_name nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: ir.lvalue) type_call = ir.type_call if isinstance(ir, LibraryCall): new_ir = LibraryCall(destination, function_name, nbr_arguments, lvalue, type_call) else: new_ir = HighLevelCall(destination, function_name, nbr_arguments, lvalue, type_call) new_ir.call_id = ir.call_id new_ir.call_value = get_variable(ir, lambda x: ir.call_value) new_ir.call_gas = get_variable(ir, lambda x: ir.call_gas) new_ir.arguments = get_arguments(ir) new_ir.function = ir.function return new_ir elif isinstance(ir, Index): lvalue = get_variable(ir, lambda x: ir.lvalue) variable_left = get_variable(ir, lambda x: ir.variable_left) variable_right = get_variable(ir, lambda x: ir.variable_right) index_type = ir.index_type return Index(lvalue, variable_left, variable_right, index_type) elif isinstance(ir, InitArray): lvalue = get_variable(ir, lambda x: ir.lvalue) init_values = get_rec_values(ir, lambda x: ir.init_values) return InitArray(init_values, lvalue) elif isinstance(ir, InternalCall): function = ir.function nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: ir.lvalue) type_call = ir.type_call new_ir = InternalCall(function, nbr_arguments, lvalue, type_call) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, InternalDynamicCall): lvalue = get_variable(ir, lambda x: ir.lvalue) function = ir.function function_type = ir.function_type new_ir = InternalDynamicCall(lvalue, function, function_type) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, LowLevelCall): destination = get_variable(ir, lambda x: x.destination) function_name = ir.function_name nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: ir.lvalue) type_call = ir.type_call new_ir = LowLevelCall(destination, function_name, nbr_arguments, lvalue, type_call) new_ir.call_id = ir.call_id new_ir.call_value = get_variable(ir, lambda x: ir.call_value) new_ir.call_gas = get_variable(ir, lambda x: ir.call_gas) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, Member): lvalue = get_variable(ir, lambda x: ir.lvalue) variable_left = get_variable(ir, lambda x: ir.variable_left) variable_right = get_variable(ir, lambda x: ir.variable_right) return Member(variable_left, variable_right, lvalue) elif isinstance(ir, NewArray): depth = ir.depth array_type = ir.array_type lvalue = get_variable(ir, lambda x: ir.lvalue) new_ir = NewArray(depth, array_type, lvalue) new_ir.arguments = get_rec_values(ir, lambda x: ir.arguments) return new_ir elif isinstance(ir, NewElementaryType): new_type = ir.type lvalue = get_variable(ir, lambda x: ir.lvalue) new_ir = NewElementaryType(new_type, lvalue) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, NewContract): contract_name = ir.contract_name lvalue = get_variable(ir, lambda x: ir.lvalue) new_ir = NewContract(contract_name, lvalue) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, NewStructure): structure = ir.structure lvalue = get_variable(ir, lambda x: ir.lvalue) new_ir = NewStructure(structure, lvalue) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, Push): array = get_variable(ir, lambda x: ir.array) lvalue = get_variable(ir, lambda x: ir.lvalue) return Push(array, lvalue) elif isinstance(ir, Return): value = [get_variable(x, lambda y: y) for x in ir.values] return Return(value) elif isinstance(ir, Send): destination = get_variable(ir, lambda x: ir.destination) value = get_variable(ir, lambda x: ir.call_value) lvalue = get_variable(ir, lambda x: ir.lvalue) return Send(destination, value, lvalue) elif isinstance(ir, SolidityCall): function = ir.function nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: ir.lvalue) type_call = ir.type_call new_ir = SolidityCall(function, nbr_arguments, lvalue, type_call) new_ir.arguments = get_arguments(ir) return new_ir elif isinstance(ir, Transfer): destination = get_variable(ir, lambda x: ir.destination) value = get_variable(ir, lambda x: ir.call_value) return Transfer(destination, value) elif isinstance(ir, TypeConversion): lvalue = get_variable(ir, lambda x: ir.lvalue) variable = get_variable(ir, lambda x: ir.variable) variable_type = ir.type return TypeConversion(lvalue, variable, variable_type) elif isinstance(ir, Unary): lvalue = get_variable(ir, lambda x: ir.lvalue) rvalue = get_variable(ir, lambda x: ir.rvalue) operation_type = ir.type return Unary(lvalue, rvalue, operation_type) elif isinstance(ir, Unpack): lvalue = get_variable(ir, lambda x: ir.lvalue) tuple_var = ir.tuple idx = ir.index return Unpack(lvalue, tuple_var, idx) elif isinstance(ir, Length): lvalue = get_variable(ir, lambda x: ir.lvalue) value = get_variable(ir, lambda x: ir.value) return Length(value, lvalue) logger.error('Impossible ir copy on {} ({})'.format(ir, type(ir))) exit(-1)
def copy_ir(ir, *instances): ''' Args: ir (Operation) local_variables_instances(dict(str -> LocalVariable)) state_variables_instances(dict(str -> StateVariable)) temporary_variables_instances(dict(int -> Variable)) reference_variables_instances(dict(int -> Variable)) Note: temporary and reference can be indexed by int, as they dont need phi functions ''' if isinstance(ir, Assignment): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) rvalue = get_variable(ir, lambda x: x.rvalue, *instances) variable_return_type = ir.variable_return_type return Assignment(lvalue, rvalue, variable_return_type) elif isinstance(ir, Balance): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) value = get_variable(ir, lambda x: x.value, *instances) return Balance(value, lvalue) elif isinstance(ir, Binary): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) variable_left = get_variable(ir, lambda x: x.variable_left, *instances) variable_right = get_variable(ir, lambda x: x.variable_right, *instances) operation_type = ir.type return Binary(lvalue, variable_left, variable_right, operation_type) elif isinstance(ir, Condition): val = get_variable(ir, lambda x: x.value, *instances) return Condition(val) elif isinstance(ir, Delete): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) variable = get_variable(ir, lambda x: x.variable, *instances) return Delete(lvalue, variable) elif isinstance(ir, EventCall): name = ir.name return EventCall(name) elif isinstance(ir, HighLevelCall): # include LibraryCall destination = get_variable(ir, lambda x: x.destination, *instances) function_name = ir.function_name nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: x.lvalue, *instances) type_call = ir.type_call if isinstance(ir, LibraryCall): new_ir = LibraryCall(destination, function_name, nbr_arguments, lvalue, type_call) else: new_ir = HighLevelCall(destination, function_name, nbr_arguments, lvalue, type_call) new_ir.call_id = ir.call_id new_ir.call_value = get_variable(ir, lambda x: x.call_value, *instances) new_ir.call_gas = get_variable(ir, lambda x: x.call_gas, *instances) new_ir.arguments = get_arguments(ir, *instances) new_ir.function = ir.function return new_ir elif isinstance(ir, Index): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) variable_left = get_variable(ir, lambda x: x.variable_left, *instances) variable_right = get_variable(ir, lambda x: x.variable_right, *instances) index_type = ir.index_type return Index(lvalue, variable_left, variable_right, index_type) elif isinstance(ir, InitArray): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) init_values = get_rec_values(ir, lambda x: x.init_values, *instances) return InitArray(init_values, lvalue) elif isinstance(ir, InternalCall): function = ir.function nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: x.lvalue, *instances) type_call = ir.type_call new_ir = InternalCall(function, nbr_arguments, lvalue, type_call) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, InternalDynamicCall): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) function = get_variable(ir, lambda x: x.function, *instances) function_type = ir.function_type new_ir = InternalDynamicCall(lvalue, function, function_type) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, LowLevelCall): destination = get_variable(ir, lambda x: x.destination, *instances) function_name = ir.function_name nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: x.lvalue, *instances) type_call = ir.type_call new_ir = LowLevelCall(destination, function_name, nbr_arguments, lvalue, type_call) new_ir.call_id = ir.call_id new_ir.call_value = get_variable(ir, lambda x: x.call_value, *instances) new_ir.call_gas = get_variable(ir, lambda x: x.call_gas, *instances) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, Member): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) variable_left = get_variable(ir, lambda x: x.variable_left, *instances) variable_right = get_variable(ir, lambda x: x.variable_right, *instances) return Member(variable_left, variable_right, lvalue) elif isinstance(ir, NewArray): depth = ir.depth array_type = ir.array_type lvalue = get_variable(ir, lambda x: x.lvalue, *instances) new_ir = NewArray(depth, array_type, lvalue) new_ir.arguments = get_rec_values(ir, lambda x: x.arguments, *instances) return new_ir elif isinstance(ir, NewElementaryType): new_type = ir.type lvalue = get_variable(ir, lambda x: x.lvalue, *instances) new_ir = NewElementaryType(new_type, lvalue) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, NewContract): contract_name = ir.contract_name lvalue = get_variable(ir, lambda x: x.lvalue, *instances) new_ir = NewContract(contract_name, lvalue) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, NewStructure): structure = ir.structure lvalue = get_variable(ir, lambda x: x.lvalue, *instances) new_ir = NewStructure(structure, lvalue) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, Push): array = get_variable(ir, lambda x: x.array, *instances) lvalue = get_variable(ir, lambda x: x.lvalue, *instances) return Push(array, lvalue) elif isinstance(ir, Return): values = get_rec_values(ir, lambda x: x.values, *instances) return Return(values) elif isinstance(ir, Send): destination = get_variable(ir, lambda x: x.destination, *instances) value = get_variable(ir, lambda x: x.call_value, *instances) lvalue = get_variable(ir, lambda x: x.lvalue, *instances) return Send(destination, value, lvalue) elif isinstance(ir, SolidityCall): function = ir.function nbr_arguments = ir.nbr_arguments lvalue = get_variable(ir, lambda x: x.lvalue, *instances) type_call = ir.type_call new_ir = SolidityCall(function, nbr_arguments, lvalue, type_call) new_ir.arguments = get_arguments(ir, *instances) return new_ir elif isinstance(ir, Transfer): destination = get_variable(ir, lambda x: x.destination, *instances) value = get_variable(ir, lambda x: x.call_value, *instances) return Transfer(destination, value) elif isinstance(ir, TypeConversion): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) variable = get_variable(ir, lambda x: x.variable, *instances) variable_type = ir.type return TypeConversion(lvalue, variable, variable_type) elif isinstance(ir, Unary): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) rvalue = get_variable(ir, lambda x: x.rvalue, *instances) operation_type = ir.type return Unary(lvalue, rvalue, operation_type) elif isinstance(ir, Unpack): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) tuple_var = get_variable(ir, lambda x: x.tuple, *instances) idx = ir.index return Unpack(lvalue, tuple_var, idx) elif isinstance(ir, Length): lvalue = get_variable(ir, lambda x: x.lvalue, *instances) value = get_variable(ir, lambda x: x.value, *instances) return Length(value, lvalue) logger.error('Impossible ir copy on {} ({})'.format(ir, type(ir))) exit(-1)
def _post_call_expression(self, expression): # pylint: disable=too-many-branches,too-many-statements called = get(expression.called) args = [get(a) for a in expression.arguments if a] for arg in args: arg_ = Argument(arg) arg_.set_expression(expression) self._result.append(arg_) if isinstance(called, Function): # internal call # If tuple if expression.type_call.startswith( "tuple(") and expression.type_call != "tuple()": val = TupleVariable(self._node) else: val = TemporaryVariable(self._node) internal_call = InternalCall(called, len(args), val, expression.type_call) internal_call.set_expression(expression) self._result.append(internal_call) set_val(expression, val) else: # yul things if called.name == "caller()": val = TemporaryVariable(self._node) var = Assignment(val, SolidityVariableComposed("msg.sender"), "uint256") self._result.append(var) set_val(expression, val) elif called.name == "origin()": val = TemporaryVariable(self._node) var = Assignment(val, SolidityVariableComposed("tx.origin"), "uint256") self._result.append(var) set_val(expression, val) elif called.name == "extcodesize(uint256)": val = ReferenceVariable(self._node) var = Member(args[0], Constant("codesize"), val) self._result.append(var) set_val(expression, val) elif called.name == "selfbalance()": val = TemporaryVariable(self._node) var = TypeConversion(val, SolidityVariable("this"), ElementaryType("address")) self._result.append(var) val1 = ReferenceVariable(self._node) var1 = Member(val, Constant("balance"), val1) self._result.append(var1) set_val(expression, val1) elif called.name == "address()": val = TemporaryVariable(self._node) var = TypeConversion(val, SolidityVariable("this"), ElementaryType("address")) self._result.append(var) set_val(expression, val) elif called.name == "callvalue()": val = TemporaryVariable(self._node) var = Assignment(val, SolidityVariableComposed("msg.value"), "uint256") self._result.append(var) set_val(expression, val) else: # If tuple if expression.type_call.startswith( "tuple(") and expression.type_call != "tuple()": val = TupleVariable(self._node) else: val = TemporaryVariable(self._node) message_call = TmpCall(called, len(args), val, expression.type_call) message_call.set_expression(expression) # Gas/value are only accessible here if the syntax {gas: , value: } # Is used over .gas().value() if expression.call_gas: call_gas = get(expression.call_gas) message_call.call_gas = call_gas if expression.call_value: call_value = get(expression.call_value) message_call.call_value = call_value if expression.call_salt: call_salt = get(expression.call_salt) message_call.call_salt = call_salt self._result.append(message_call) set_val(expression, val)
def _post_member_access(self, expression): expr = get(expression.expression) # Look for type(X).max / min # Because we looked at the AST structure, we need to look into the nested expression # Hopefully this is always on a direct sub field, and there is no weird construction if isinstance(expression.expression, CallExpression) and expression.member_name in [ "min", "max", ]: if isinstance(expression.expression.called, Identifier): if expression.expression.called.value == SolidityFunction( "type()"): assert len(expression.expression.arguments) == 1 val = TemporaryVariable(self._node) type_expression_found = expression.expression.arguments[0] assert isinstance(type_expression_found, ElementaryTypeNameExpression) type_found = type_expression_found.type if expression.member_name == "min:": op = Assignment( val, Constant(str(type_found.min), type_found), type_found, ) else: op = Assignment( val, Constant(str(type_found.max), type_found), type_found, ) self._result.append(op) set_val(expression, val) return # This does not support solidity 0.4 contract_name.balance if (isinstance(expr, Variable) and expr.type == ElementaryType("address") and expression.member_name in ["balance", "code", "codehash"]): val = TemporaryVariable(self._node) name = expression.member_name + "(address)" sol_func = SolidityFunction(name) s = SolidityCall( sol_func, 1, val, sol_func.return_type, ) s.set_expression(expression) s.arguments.append(expr) self._result.append(s) set_val(expression, val) return if isinstance(expr, TypeAlias) and expression.member_name in [ "wrap", "unwrap" ]: # The logic is be handled by _post_call_expression set_val(expression, expr) return # Early lookup to detect user defined types from other contracts definitions # contract A { type MyInt is int} # contract B { function f() public{ A.MyInt test = A.MyInt.wrap(1);}} # The logic is handled by _post_call_expression if isinstance(expr, Contract): if expression.member_name in expr.file_scope.user_defined_types: set_val( expression, expr.file_scope.user_defined_types[expression.member_name]) return val = ReferenceVariable(self._node) member = Member(expr, Constant(expression.member_name), val) member.set_expression(expression) self._result.append(member) set_val(expression, val)