Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

reentrancy analyzer test #1189

Merged
merged 9 commits into from
Oct 8, 2024
Merged

reentrancy analyzer test #1189

merged 9 commits into from
Oct 8, 2024

Conversation

Hecate2
Copy link
Contributor

@Hecate2 Hecate2 commented Oct 2, 2024

No description provided.

Copy link
Member

@shargon shargon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't check if the method has the attribute

@Hecate2
Copy link
Contributor Author

Hecate2 commented Oct 2, 2024

It doesn't check if the method has the attribute

The analyzer intakes .nef file instead of source code, and is unable to be aware of the [NoReentrant] attribute for now.

@Jim8y
Copy link
Contributor

Jim8y commented Oct 3, 2024

is that possible that we add attribute to the debuginfo?@shargon

@Hecate2
Copy link
Contributor Author

Hecate2 commented Oct 3, 2024

is that possible that we add attribute to the debuginfo?@shargon

I think this may not be the best methodology. Verifying the codes is better than trusting the manifest. And it may be not easy for other languages to have the same attributes

@Jim8y
Copy link
Contributor

Jim8y commented Oct 3, 2024

is that possible that we add attribute to the debuginfo?@shargon

I think this may not be the best methodology. Verifying the codes is better than trusting the manifest. And it may be not easy for other languages to have the same attributes

here we dont consider other languages.

@roman-khimov
Copy link

NEP-25 and NEP-19 are shared by all of the ecosystem, so any changes there should be discussed separately.

@shargon
Copy link
Member

shargon commented Oct 4, 2024

How it works this reentrancy analyzer? how it check that it has a protection?

@Jim8y
Copy link
Contributor

Jim8y commented Oct 4, 2024

NEP-25 and NEP-19 are shared by all of the ecosystem, so any changes there should be discussed separately.

@roman-khimov This is C# compiler, nothing to do with NEP25 or NEP19 standards. And core team is not maintaining any languagues other than C#, we are not responsible for other languages.

@Hecate2
Copy link
Contributor Author

Hecate2 commented Oct 4, 2024

I think the best way is to symbolically execute the assembly of a method, and infer that the method cannot be re-entered.

@roman-khimov
Copy link

This is C# compiler

I know, but

is that possible that we add attribute to the debuginfo?

Looks like NEP-19 to me. While in fact what you want with attribute and what is suggested by @Hecate2 by

trusting the manifest

is even closer to NEP-25. And this rings the bell for me.

@Jim8y
Copy link
Contributor

Jim8y commented Oct 4, 2024

NEP-19

Problem all mine, i did not know debuginfo is also an NEP~~~

@Jim8y Jim8y requested a review from shargon October 8, 2024 01:39
public void Test_HasReentrancy()
{
ReEntrancyAnalyzer.ReEntrancyVulnerabilityPair v =
ReEntrancyAnalyzer.AnalyzeSingleContractReEntrancy(NefFile, Manifest);
Copy link
Member

@shargon shargon Oct 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AnalyzeSingleContractReEntrancy checks that the storage key is the same?

Copy link
Contributor Author

@Hecate2 Hecate2 Oct 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AnalyzeSingleContractReEntrancy checks that the storage key is the same?

No. This is a test for the reentrancy analyzer, instead of the [NoReentrant] attribute.
I am writing a symbolic VM that should be able to infer the storage key from .nef

@Jim8y Jim8y merged commit 71695e2 into neo-project:master Oct 8, 2024
4 checks passed
@Jim8y Jim8y deleted the test-reentrancy branch October 8, 2024 10:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants