TIme Dependence Detection Error about oyente HOT 9 CLOSED

Hi @Ishowcode ,

Currently we are only interested in the paths that send out ether/ money. Hence we do not consider the paths that depend on timestamp and do not do anything with the contract balance. That explains why Oyente doesn't raise any flag for theRun.

from oyente.

Hi @loiluu ,
it's still a puzzle for me. i just modified a little about the theRun as following:
contract theRun{ function random() returns(uint result){ uint salt = block.timestamp; if(salt % 5 == 0){ return 100; } } }
it outputed "time_dependency:true", i don't know what's the differ

from oyente.

We find out if a different code path can be executed purely by controlling the block timestamp. To this end, if we find block timestamp as one of the variables used in the path condition, we report the bug.

from oyente.

I ran your contract contract theRun{ function random() returns(uint result){ uint salt = block.timestamp; if(salt % 5 == 0){ return 100; } } } and it outputed "time_dependency: false" instead.

from oyente.

@luongnt95 i am sorry i gived a wrong example. i have read the source code of oyente, @inian is right that timestamp must as one of the varables used in the path condition. but i think besides block.timestamp in path condition, if detect any variable using block.timestamp, it should be considered as time dependence, is my thought reasonable?

from oyente.

@Ishowcode We only care about a timestamp that affects money flows of a contract. There is no meaning to report the bug if the contract transfers nothing but using timestamp

from oyente.

@luongnt95 i perhaps not agree your viewpoint very well, now our team is developing a dapp based on smart contracts, in smart contracts, we using some variables to store some users' information, and through functions to modify these information, if i using block.timestamp as a factor in a path condition, it may affect the modification process, although there are no money flows, but i think this is meaningful

from oyente.

from oyente.

@loiluu Thanks for your approval, i'll do my best for oyente

from oyente.