WIP: Experimental valuegeneration techniques

docs/src/static/medusa.json

@@ -7,6 +7,7 @@
     "callSequenceLength": 100,
     "corpusDirectory": "",
     "coverageEnabled": true,
+    "valueGenerationTracingEnabled": true,
     "targetContracts": [],
     "targetContractsBalances": [],
     "constructorArgs": {},

fuzzing/config/config.go

@@ -59,6 +59,8 @@ type FuzzingConfig struct {
 	// CoverageEnabled describes whether to use coverage-guided fuzzing
 	CoverageEnabled bool `json:"coverageEnabled"`
 
+	ValueGenerationTracingEnabled bool `json:"valueGenerationEnabled"`
+
 	// TargetContracts are the target contracts for fuzz testing
 	TargetContracts []string `json:"targetContracts"`
 

fuzzing/config/config_defaults.go

@@ -33,17 +33,18 @@ func GetDefaultProjectConfig(platform string) (*ProjectConfig, error) {
 	// Create a project configuration
 	projectConfig := &ProjectConfig{
 		Fuzzing: FuzzingConfig{
-			Workers:                 10,
-			WorkerResetLimit:        50,
-			Timeout:                 0,
-			TestLimit:               0,
-			ShrinkLimit:             5_000,
-			CallSequenceLength:      100,
-			TargetContracts:         []string{},
-			TargetContractsBalances: []*big.Int{},
-			ConstructorArgs:         map[string]map[string]any{},
-			CorpusDirectory:         "",
-			CoverageEnabled:         true,
+			Workers:                       10,
+			WorkerResetLimit:              50,
+			Timeout:                       0,
+			TestLimit:                     0,
+			ShrinkLimit:                   5_000,
+			CallSequenceLength:            100,
+			TargetContracts:               []string{},
+			TargetContractsBalances:       []*big.Int{},
+			ConstructorArgs:               map[string]map[string]any{},
+			CorpusDirectory:               "",
+			CoverageEnabled:               true,
+			ValueGenerationTracingEnabled: true, // Sanan
 			SenderAddresses: []string{
 				"0x10000",
 				"0x20000",

fuzzing/executiontracer/execution_trace.go

@@ -3,6 +3,7 @@ package executiontracer
 import (
 	"encoding/hex"
 	"fmt"
+	"github.com/crytic/medusa/utils"
 	"regexp"
 	"strings"
 
@@ -22,7 +23,7 @@ import (
 type ExecutionTrace struct {
 	// TopLevelCallFrame refers to the root call frame, the first EVM call scope entered when an externally-owned
 	// address calls upon a contract.
-	TopLevelCallFrame *CallFrame
+	TopLevelCallFrame *utils.CallFrame
 
 	// contractDefinitions represents the known contract definitions at the time of tracing. This is used to help
 	// obtain any additional information regarding execution.
@@ -41,7 +42,7 @@ func newExecutionTrace(contracts contracts.Contracts) *ExecutionTrace {
 // This list of elements will hold information about what kind of call it is, wei sent, what method is called, and more.
 // Additionally, the list may also hold formatting options for console output. This function also returns a non-empty
 // string in case this call frame represents a call to the console.log precompile contract.
-func (t *ExecutionTrace) generateCallFrameEnterElements(callFrame *CallFrame) ([]any, string) {
+func (t *ExecutionTrace) generateCallFrameEnterElements(callFrame *utils.CallFrame) ([]any, string) {
 	// Create list of elements and console log string
 	elements := make([]any, 0)
 	var consoleLogString string
@@ -164,7 +165,7 @@ func (t *ExecutionTrace) generateCallFrameEnterElements(callFrame *CallFrame) ([
 
 // generateCallFrameExitElements generates a list of elements describing the return data of the call frame (e.g.
 // traditional return data, assertion failure, revert data, etc.). Additionally, the list may also hold formatting options for console output.
-func (t *ExecutionTrace) generateCallFrameExitElements(callFrame *CallFrame) []any {
+func (t *ExecutionTrace) generateCallFrameExitElements(callFrame *utils.CallFrame) []any {
 	// Create list of elements
 	elements := make([]any, 0)
 
@@ -250,7 +251,7 @@ func (t *ExecutionTrace) generateCallFrameExitElements(callFrame *CallFrame) []a
 
 // generateEventEmittedElements generates a list of elements used to express an event emission. It contains information about an
 // event log such as the topics and the event data. Additionally, the list may also hold formatting options for console output.
-func (t *ExecutionTrace) generateEventEmittedElements(callFrame *CallFrame, eventLog *coreTypes.Log) []any {
+func (t *ExecutionTrace) generateEventEmittedElements(callFrame *utils.CallFrame, eventLog *coreTypes.Log) []any {
 	// Create list of elements
 	elements := make([]any, 0)
 
@@ -301,7 +302,7 @@ func (t *ExecutionTrace) generateEventEmittedElements(callFrame *CallFrame, even
 // generateElementsAndLogsForCallFrame generates a list of elements and logs for a given call frame and its children.
 // The list of elements may also hold formatting options for console output. The list of logs represent calls to the
 // console.log precompile contract.
-func (t *ExecutionTrace) generateElementsAndLogsForCallFrame(currentDepth int, callFrame *CallFrame) ([]any, []any) {
+func (t *ExecutionTrace) generateElementsAndLogsForCallFrame(currentDepth int, callFrame *utils.CallFrame) ([]any, []any) {
 	// Create list of elements and logs
 	elements := make([]any, 0)
 	consoleLogs := make([]any, 0)
@@ -334,7 +335,7 @@ func (t *ExecutionTrace) generateElementsAndLogsForCallFrame(currentDepth int, c
 		// Loop for each operation performed in the call frame, to provide a chronological history of operations in the
 		// frame.
 		for _, operation := range callFrame.Operations {
-			if childCallFrame, ok := operation.(*CallFrame); ok {
+			if childCallFrame, ok := operation.(*utils.CallFrame); ok {
 				// If this is a call frame being entered, generate information recursively.
 				childOutputLines, childConsoleLogStrings := t.generateElementsAndLogsForCallFrame(currentDepth+1, childCallFrame)
 				elements = append(elements, childOutputLines...)

fuzzing/executiontracer/execution_tracer.go

@@ -1,6 +1,7 @@
 package executiontracer
 
 import (
+	"github.com/crytic/medusa/utils"
 	"math/big"
 
 	"github.com/crytic/medusa/chain"
@@ -45,7 +46,7 @@ type ExecutionTracer struct {
 	trace *ExecutionTrace
 
 	// currentCallFrame references the current call frame being traced.
-	currentCallFrame *CallFrame
+	currentCallFrame *utils.CallFrame
 
 	// contractDefinitions represents the contract definitions to match for execution traces.
 	contractDefinitions contracts.Contracts
@@ -90,7 +91,7 @@ func (t *ExecutionTracer) CaptureTxEnd(restGas uint64) {
 
 // resolveConstructorArgs resolves previously unresolved constructor argument ABI data from the call data, if
 // the call frame provided represents a contract deployment.
-func (t *ExecutionTracer) resolveCallFrameConstructorArgs(callFrame *CallFrame, contract *contracts.Contract) {
+func (t *ExecutionTracer) resolveCallFrameConstructorArgs(callFrame *utils.CallFrame, contract *contracts.Contract) {
 	// If this is a contract creation and the constructor ABI argument data has not yet been resolved, do so now.
 	if callFrame.ConstructorArgsData == nil && callFrame.IsContractCreation() {
 		// We simply slice the compiled bytecode leading the input data off, and we are left with the constructor
@@ -104,7 +105,7 @@ func (t *ExecutionTracer) resolveCallFrameConstructorArgs(callFrame *CallFrame,
 
 // resolveCallFrameContractDefinitions resolves previously unresolved contract definitions for the To and Code addresses
 // used within the provided call frame.
-func (t *ExecutionTracer) resolveCallFrameContractDefinitions(callFrame *CallFrame) {
+func (t *ExecutionTracer) resolveCallFrameContractDefinitions(callFrame *utils.CallFrame) {
 	// Try to resolve contract definitions for "to" address
 	if callFrame.ToContractAbi == nil {
 		// Try to resolve definitions from cheat code contracts
@@ -150,7 +151,7 @@ func (t *ExecutionTracer) resolveCallFrameContractDefinitions(callFrame *CallFra
 // captureEnteredCallFrame is a helper method used when a new call frame is entered to record information about it.
 func (t *ExecutionTracer) captureEnteredCallFrame(fromAddress common.Address, toAddress common.Address, inputData []byte, isContractCreation bool, value *big.Int) {
 	// Create our call frame struct to track data for this call frame we entered.
-	callFrameData := &CallFrame{
+	callFrameData := &utils.CallFrame{
 		SenderAddress:       fromAddress,
 		ToAddress:           toAddress,
 		ToContractName:      "",

fuzzing/fuzzer_test.go

@@ -60,6 +60,42 @@ func TestFuzzerHooks(t *testing.T) {
 	})
 }
 
+func TestGetEmittedEvents_ValueGeneration(t *testing.T) {
+	filePaths := []string{
+		"testdata/contracts/assertions/assert_immediate.sol",
+	}
+
+	for _, filePath := range filePaths {
+		runFuzzerTest(t, &fuzzerSolcFileTest{
+			filePath: filePath,
+			configUpdates: func(config *config.ProjectConfig) {
+				config.Fuzzing.TargetContracts = []string{"TestContract"}
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnAssertion = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnAllocateTooMuchMemory = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnArithmeticUnderflow = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnCallUninitializedVariable = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnEnumTypeConversionOutOfBounds = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnDivideByZero = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnIncorrectStorageAccess = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnOutOfBoundsArrayAccess = true
+				//config.Fuzzing.Testing.AssertionTesting.PanicCodeConfig.FailOnPopEmptyArray = true
+				config.Fuzzing.Testing.AssertionTesting.Enabled = false
+				config.Fuzzing.Testing.PropertyTesting.Enabled = false
+				config.Fuzzing.Testing.OptimizationTesting.Enabled = false
+				config.Fuzzing.Testing.StopOnNoTests = false
+				config.Fuzzing.Workers = 1
+			},
+			method: func(f *fuzzerTestContext) {
+				// Start the fuzzer
+				err := f.fuzzer.Start()
+				assert.NoError(t, err)
+				// Check for failed assertion tests.
+				assertFailedTestsExpected(f, true)
+			},
+		})
+	}
+}
+
 // TestAssertionMode runs tests to ensure that assertion testing behaves as expected.
 func TestAssertionMode(t *testing.T) {
 	filePaths := []string{

fuzzing/fuzzer_worker.go

@@ -2,6 +2,7 @@ package fuzzing
 
 import (
 	"fmt"
+	"github.com/crytic/medusa/fuzzing/valuegenerationtracer"
 	"math/big"
 	"math/rand"
 
@@ -28,6 +29,10 @@ type FuzzerWorker struct {
 	// coverageTracer describes the tracer used to collect coverage maps during fuzzing campaigns.
 	coverageTracer *coverage.CoverageTracer
 
+	// valueGenerationTracer represents the structure that is used for collecting emitted event values and return
+	// values of executed functions in one sequence.
+	valueGenerationTracer *valuegenerationtracer.ValueGenerationTracer
+
 	// testingBaseBlockNumber refers to the block number at which all contracts for testing have been deployed, prior
 	// to any fuzzing activity. This block number is reverted to after testing each call sequence to reset state.
 	testingBaseBlockNumber uint64
@@ -244,6 +249,9 @@ func (fw *FuzzerWorker) updateStateChangingMethods() {
 // deployed in the Chain.
 // Returns the length of the call sequence tested, any requests for call sequence shrinking, or an error if one occurs.
 func (fw *FuzzerWorker) testNextCallSequence() (calls.CallSequence, []ShrinkCallSequenceRequest, error) {
+	// Copy the existing ValueSet
+	copyValueSet := fw.ValueSet().Clone()
+
 	// After testing the sequence, we'll want to rollback changes to reset our testing state.
 	var err error
 	defer func() {
@@ -278,6 +286,14 @@ func (fw *FuzzerWorker) testNextCallSequence() (calls.CallSequence, []ShrinkCall
 			return true, err
 		}
 
+		// Add event values to copied ValueSet
+		lastExecutedSequenceElement := currentlyExecutedSequence[len(currentlyExecutedSequence)-1]
+		messageResults := lastExecutedSequenceElement.ChainReference.MessageResults()
+		valuegenerationtracer.AddTransactionOutputValuesToValueSet(messageResults, copyValueSet)
+
+		// Set valueSet to copied valueSet
+		fw.valueSet = copyValueSet
+
 		// Loop through each test function, signal our worker tested a call, and collect any requests to shrink
 		// this call sequence.
 		for _, callSequenceTestFunc := range fw.fuzzer.Hooks.CallSequenceTestFuncs {
@@ -546,6 +562,12 @@ func (fw *FuzzerWorker) run(baseTestChain *chain.TestChain) (bool, error) {
 			fw.coverageTracer = coverage.NewCoverageTracer()
 			initializedChain.AddTracer(fw.coverageTracer, true, false)
 		}
+
+		if fw.fuzzer.config.Fuzzing.ValueGenerationTracingEnabled {
+			// TODO: Sanan
+			fw.valueGenerationTracer = valuegenerationtracer.NewValueGenerationTracer(fw.fuzzer.contractDefinitions)
+			initializedChain.AddTracer(fw.valueGenerationTracer, true, false)
+		}
 		return nil
 	})
 
@@ -597,6 +619,9 @@ func (fw *FuzzerWorker) run(baseTestChain *chain.TestChain) (bool, error) {
 			return false, err
 		}
 
+		// Set valueSet to the one that includes event values
+		//fw.SetValueSet(copyValueSet)
+
 		// If we have any requests to shrink call sequences, do so now.
 		for _, shrinkVerifier := range shrinkVerifiers {
 			_, err = fw.shrinkCallSequence(callSequence, shrinkVerifier)

fuzzing/testdata/contracts/assertions/assert_immediate.sol

@@ -1,7 +1,45 @@
+pragma solidity ^0.8.0;
+
+// This contract includes a function that we will call from TestContract.
+contract AnotherContract {
+    // This function doesn't need to do anything specific for this example.
+    function externalFunction() public pure returns (string memory) {
+        return "External function called";
+    }
+}
+
 // This contract ensures the fuzzer can encounter an immediate assertion failure.
 contract TestContract {
+    AnotherContract public anotherContract;
+
+    event ValueReceived(uint indexed value, uint second_val);
+    event ValueNonIndexedReceived(uint firstval, uint secondval);
+
+    function internalFunction() public returns (string memory) {
+        anotherContract.externalFunction();
+        return "Internal function called";
+    }
+
+    // Deploy AnotherContract within the TestContract
+    constructor() {
+//        internalFunction();
+        anotherContract = new AnotherContract();
+    }
+
+
     function callingMeFails(uint value) public {
+        // Call internalFunction()
+        internalFunction();
+        // Call the external function in AnotherContract.
+        anotherContract.externalFunction();
+
+        uint second_val = 2+12;
+
+        emit ValueReceived(value, second_val);
+        emit ValueNonIndexedReceived(111+111, 444+444);
+
         // ASSERTION: We always fail when you call this function.
         assert(false);
+
     }
 }