Comments (9)
Hi @Ishowcode ,
Currently we are only interested in the paths that send out ether/ money. Hence we do not consider the paths that depend on timestamp and do not do anything with the contract balance. That explains why Oyente doesn't raise any flag for theRun.
from oyente.
Hi @loiluu ,
it's still a puzzle for me. i just modified a little about the theRun as following:
contract theRun{ function random() returns(uint result){ uint salt = block.timestamp; if(salt % 5 == 0){ return 100; } } }
it outputed "time_dependency:true", i don't know what's the differ
from oyente.
We find out if a different code path can be executed purely by controlling the block timestamp. To this end, if we find block timestamp as one of the variables used in the path condition, we report the bug.
from oyente.
I ran your contract contract theRun{ function random() returns(uint result){ uint salt = block.timestamp; if(salt % 5 == 0){ return 100; } } }
and it outputed "time_dependency: false" instead.
from oyente.
@luongnt95 i am sorry i gived a wrong example. i have read the source code of oyente, @inian is right that timestamp must as one of the varables used in the path condition. but i think besides block.timestamp in path condition, if detect any variable using block.timestamp, it should be considered as time dependence, is my thought reasonable?
from oyente.
@Ishowcode We only care about a timestamp that affects money flows of a contract. There is no meaning to report the bug if the contract transfers nothing but using timestamp
from oyente.
@luongnt95 i perhaps not agree your viewpoint very well, now our team is developing a dapp based on smart contracts, in smart contracts, we using some variables to store some users' information, and through functions to modify these information, if i using block.timestamp as a factor in a path condition, it may affect the modification process, although there are no money flows, but i think this is meaningful
from oyente.
from oyente.
@loiluu Thanks for your approval, i'll do my best for oyente
from oyente.
Related Issues (20)
- Solidity 0.6.x
- Option -r has issues
- Having trouble with newest verions solc:0.8.0 as `solc` is now `solcjs`
- Reentrancy detection machanism
- Upcoming changes in CryticCompile
- Nurses
- How to use the oyente to batch test smart contracts? HOT 2
- docker
- First or second argument must be a Z3 bit-vector expression HOT 1
- ModuleNotFoundError: No module named 'crytic_compile' HOT 2
- Any plan to support solc 0.8.x HOT 1
- Bugs HOT 3
- Bad return value HOT 2
- Error: Expected identifier, got 'LParen' HOT 1
- Exception on binary contract
- UNKNOWN INSTRUCTION: SHL HOT 2
- Why does Oyente report different results on virtually identical contracts?
- docker not run HOT 1
- Installation Error
- python3 error in docker
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oyente.