CVE-comparison

Comparison of EVMPatch and SafeMath on 5 well-known CVEs

We use these 5 contracts for a comparison of EVMPatch bytecode-rewriter patching vs. manual source-code patching with the SafeMath library.

• ./*/*.sol is the original source code as obtained from etherscan
• ./_safemath_manual contains the source-level patches
• ./osiris.sh is the script we used to run osiris on the contracts.

For the Contracts we always have three versions of the runtime bytecode (without constructor code):

• ./*/*.bin is the compiled original EVM bytecode
• ./*/*.evmpatched.bin is the original EVM bytecode patched with EVMPatch
• ./*/*.safemath.bin is the modified source code compiled with the same compiler