使用Diffusc对可升级智能合约进行差异模糊测试

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

function _become(SimpleUnitroller unitroller) public {
   require(msg.sender == unitroller.admin(), "only unitroller admin can change brains");
   require(unitroller._acceptImplementation() == 0, "change not authorized");

   // TODO: Remove this post upgrade
   SimpleComptrollerV2(address(unitroller))._upgradeSplitCompRewards();
}

function _upgradeSplitCompRewards() public {
   require(msg.sender == comptrollerImplementation, "only brains can become itself");
   uint32 blockNumber = safe32(getBlockNumber(), "block number exceeds 32 bits");
   for (uint i = 0; i < allMarkets.length; i ++) {
       CompMarketState storage supplyState = compSupplyState[address(allMarkets[i])];
       if (supplyState.index == 0) {
           // Initialize supply state index with default value
           supplyState.index = compInitialIndex;
           supplyState.block = blockNumber;
       }
   }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

Function Comptroller._become(Unitroller) (*)
    Expression: require(bool,string)(msg.sender == unitroller.admin(),only admin can upgrade)
    IRs:
        TMP_50(address) = HIGH_LEVEL_CALL, dest:unitroller(Unitroller), function:admin, args:[]
        TMP_51(bool) = msg.sender == TMP_50
        TMP_52(None) = SOLIDITY_CALL require(bool,string)(TMP_51,only admin can upgrade)
    Expression: require(bool,string)(unitroller._acceptImplementation() == 0,not authorized)
    IRs:
        TMP_53(uint256) = HIGH_LEVEL_CALL, dest:unitroller(Unitroller), function:_acceptImplementation, args:[]
        TMP_54(bool) = TMP_53 == 0
        TMP_55(None) = SOLIDITY_CALL require(bool,string)(TMP_54,change not authorized)
    // New IR from upgrade
    Expression: Comptroller(address(unitroller))._upgradeSplitCompRewards()
    IRs:
        TMP_56 = CONVERT unitroller to address
        TMP_57 = CONVERT TMP_56 to Comptroller
        HIGH_LEVEL_CALL, dest:TMP_57(Comptroller), function:_upgradeSplitCompRewards, args:[]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

function distributeSupplierComp(address cToken, address supplier) internal {
   CompMarketState storage supplyState = compSupplyState[cToken];
   // Double memory supplyIndex = Double({mantissa: supplyState.index});
   uint supplyIndex = supplyState.index;
   // Double memory supplierIndex = Double({mantissa: compSupplierIndex[cToken][supplier]});
   uint supplierIndex = compSupplierIndex[cToken][supplier];

   // Update supplier index to current index since we are distributing accrued COMP
   // compSupplierIndex[cToken][supplier] = supplyIndex.mantissa;
   compSupplierIndex[cToken][supplier] = supplyIndex;

   // if (supplierIndex.mantissa == 0 && supplyIndex.mantissa > 0) {
   if (supplierIndex == 0 && supplyIndex > compInitialIndex) {
       // Covers case where user supplied tokens before market's supply state was set.
       // Rewards the user with COMP accrued from when supplier rewards were first
       // set for the market.
       supplierIndex = compInitialIndex;  // BUG: line not reached due to new initialization
   }

   // Calculate change in the cumulative sum of the COMP per cToken accrued
   Double memory deltaIndex = Double({mantissa: sub_(supplyIndex, supplierIndex)});
   uint supplierTokens = CToken(cToken).balanceOf(supplier);

   // Calculate COMP accrued: cTokenAmount * accruedPerCToken
   uint supplierDelta = mul_(supplierTokens, deltaIndex);
   uint supplierAccrued = add_(compAccrued[supplier], supplierDelta);
   compAccrued[supplier] = supplierAccrued;
}

function claimComp() public {
   for (uint i = 0; i < allMarkets.length; i++) {
       CToken cToken = allMarkets[i];
       require(markets[address(cToken)].isListed, "market must be listed");
       updateCompSupplyIndex(address(cToken));
       distributeSupplierComp(address(cToken), msg.sender);
   }
   compAccrued[msg.sender] = grantCompInternal(msg.sender, compAccrued[msg.sender]);
}

1
2
3
4
5
6
7
8
9

function grantCompInternal(address user, uint amount) internal returns (uint) {
   Comp comp = Comp(getCompAddress());
   uint compRemaining = comp.balanceOf(address(this));
   if (amount > 0 && amount <= compRemaining) {
       comp.transfer(user, amount);
       return 0;
   }
   return amount;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

function TargetContract_balanceOf(address a) public virtual {
   hevm.prank(msg.sender);
   (bool successV1, bytes memory outputV1) = address(proxyV1).call(
       abi.encodeWithSelector(
           targetContractV1.balanceOf.selector, a
       )
   );
   hevm.prank(msg.sender);
   (bool successV2, bytes memory outputV2) = address(proxyV2).call(
       abi.encodeWithSelector(
           targetContractV2.balanceOf.selector, a
       )
   );
   assert(successV1 == successV2);
   assert((!successV1 && !successV2) || keccak256(outputV1) == keccak256(outputV2));
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

constructor() public {
   targetContractV1 = ITargetContractV1(address(new TargetContractV1()));
   targetContractV2 = ITargetContractV2(address(new TargetContractV2()));
   proxyV1 = IProxy(address(new Proxy()));
   proxyV2 = IProxy(address(new Proxy()));
   // Store the implementation addresses in the proxy slot 0.
   hevm.store(
       address(proxyV1),
       bytes32(uint(0)),
       bytes32(uint256(uint160(address(targetContractV1))))
   );
   hevm.store(
       address(proxyV2),
       bytes32(uint(0)),
       bytes32(uint256(uint160(address(targetContractV1))))
   );
}

1
2
3
4
5
6
7

constructor() public {
   hevm.roll(13322796);
   fork1 = hevm.createFork();
   fork2 = hevm.createFork();
   targetContractV1 = ITargetContractV1(0x75442Ac771a7243433e033F3F8EaB2631e22938f);
   targetContractV2 = ITargetContractV2(0x374ABb8cE19A73f2c4EFAd642bda76c797f19233);
   proxy = IProxy(0x3d9819210A31b4961b30EF54bE2aeD79B9c9