使用Diffusc进行可升级智能合约的差异模糊测试

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

function _become(SimpleUnitroller unitroller) public {
    require(msg.sender == unitroller.admin(), "only unitroller admin can change brains");
    require(unitroller._acceptImplementation() == 0, "change not authorized");

    // TODO: Remove this post upgrade
    SimpleComptrollerV2(address(unitroller))._upgradeSplitCompRewards();
}

function _upgradeSplitCompRewards() public {
    require(msg.sender == comptrollerImplementation, "only brains can become itself");
    uint32 blockNumber = safe32(getBlockNumber(), "block number exceeds 32 bits");
    for (uint i = 0; i < allMarkets.length; i ++) {
        CompMarketState storage supplyState = compSupplyState[address(allMarkets[i])];
        if (supplyState.index == 0) {
            // Initialize supply state index with default value
            supplyState.index = compInitialIndex;
            supplyState.block = blockNumber;
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

Function Comptroller._become(Unitroller) (*)
    Expression: require(bool,string)(msg.sender == unitroller.admin(),only admin can upgrade)
    IRs:
        TMP_50(address) = HIGH_LEVEL_CALL, dest:unitroller(Unitroller), function:admin, args:[]
        TMP_51(bool) = msg.sender == TMP_50
        TMP_52(None) = SOLIDITY_CALL require(bool,string)(TMP_51,only admin can upgrade)
    Expression: require(bool,string)(unitroller._acceptImplementation() == 0,not authorized)
    IRs:
        TMP_53(uint256) = HIGH_LEVEL_CALL, dest:unitroller(Unitroller), function:_acceptImplementation, args:[]
        TMP_54(bool) = TMP_53 == 0
        TMP_55(None) = SOLIDITY_CALL require(bool,string)(TMP_54,change not authorized)
    // New IR from upgrade
    Expression: Comptroller(address(unitroller))._upgradeSplitCompRewards()
    IRs:
        TMP_56 = CONVERT unitroller to address
        TMP_57 = CONVERT TMP_56 to Comptroller
        HIGH_LEVEL_CALL, dest:TMP_57(Comptroller), function:_upgradeSplitCompRewards, args:[]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

function distributeSupplierComp(address cToken, address supplier) internal {
    CompMarketState storage supplyState = compSupplyState[cToken];
    // Double memory supplyIndex = Double({mantissa: supplyState.index});
    uint supplyIndex = supplyState.index;
    // Double memory supplierIndex = Double({mantissa: compSupplierIndex[cToken][supplier]});
    uint supplierIndex = compSupplierIndex[cToken][supplier];

    // Update supplier index to current index since we are distributing accrued COMP
    // compSupplierIndex[cToken][supplier] = supplyIndex.mantissa;
    compSupplierIndex[cToken][supplier] = supplyIndex;

    // if (supplierIndex.mantissa == 0 && supplyIndex.mantissa > 0) {
    if (supplierIndex == 0 && supplyIndex > compInitialIndex) {
        // Covers case where user supplied tokens before market's supply state was set.
        // Rewards the user with COMP accrued from when supplier rewards were first
        // set for the market.
        supplierIndex = compInitialIndex;  // BUG: line not reached due to new initialization
    }

    // Calculate change in the cumulative sum of the COMP per cToken accrued
    Double memory deltaIndex = Double({mantissa: sub_(supplyIndex, supplierIndex)});
    uint supplierTokens = CToken(cToken).balanceOf(supplier);

    // Calculate COMP accrued: cTokenAmount * accruedPerCToken
    uint supplierDelta = mul_(supplierTokens, deltaIndex);
    uint supplierAccrued = add_(compAccrued[supplier], supplierDelta);
    compAccrued[supplier] = supplierAccrued;
}

function claimComp() public {
    for (uint i = 0; i < allMarkets.length; i++) {
        CToken cToken = allMarkets[i];
        require(markets[address(cToken)].isListed, "market must be listed");
        updateCompSupplyIndex(address(cToken));
        distributeSupplierComp(address(cToken), msg.sender);
    }
    compAccrued[msg.sender] = grantCompInternal(msg.sender, compAccrued[msg.sender]);
}

1
2
3
4
5
6
7
8
9

function grantCompInternal(address user, uint amount) internal returns (uint) {
    Comp comp = Comp(getCompAddress());
    uint compRemaining = comp.balanceOf(address(this));
    if (amount > 0 && amount <= compRemaining) {
        comp.transfer(user, amount);
        return 0;
    }
    return amount;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

function TargetContract_balanceOf(address a) public virtual {
    hevm.prank(msg.sender);
    (bool successV1, bytes memory outputV1) = address(proxyV1).call(
        abi.encodeWithSelector(
            targetContractV1.balanceOf.selector, a
        )
    );
    hevm.prank(msg.sender);
    (bool successV2, bytes memory outputV2) = address(proxyV2).call(
        abi.encodeWithSelector(
            targetContractV2.balanceOf.selector, a
        )
    );
    assert(successV1 == successV2);
    assert((!successV1 && !successV2) || keccak256(outputV1) == keccak256(outputV2));
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

constructor() public {
    targetContractV1 = ITargetContractV1(address(new TargetContractV1()));
    targetContractV2 = ITargetContractV2(address(new TargetContractV2()));
    proxyV1 = IProxy(address(new Proxy()));
    proxyV2 = IProxy(address(new Proxy()));
    // Store the implementation addresses in the proxy slot 0.
    hevm.store(
        address(proxyV1),
        bytes32(uint(0)),
        bytes32(uint256(uint160(address(targetContractV1))))
    );
    hevm.store(
        address(proxyV2),
        bytes32(uint(0)),
        bytes32(uint256(uint160(address(targetContractV1))))
    );
}

1
2
3
4
5
6
7

constructor() public {
    hevm.roll(13322796);
    fork1 = hevm.createFork();
    fork2 = hevm.createFork();
    targetContractV1 = ITargetContractV1(0x75442Ac771a7243433e033F3F8EaB2631e22938f);
    targetContractV2 = ITargetContractV2(0x374ABb8cE19A73f2c4EFAd642bda76c797f19233);
    proxy = IProxy(0x3d9819210A31b4961b30EF54bE2aeD79B9c