Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: smt encoding for evm div-by-zero #271

Merged
merged 2 commits into from
Aug 14, 2024

Conversation

daejunpark
Copy link
Collaborator

@daejunpark daejunpark commented Apr 9, 2024

Fix the SMT encoding of division (and modulo) by zero.

In EVM, division (and modulo) by zero is defined to be zero, whereas they are defined differently in SMT-LIB.

Thus, the EVM division (evm_bvudiv_N x y) should be encoded as:

(ite (= y (_ bv0 N)) (_ bv0 N) (bvudiv x y))

where N is the bitsize. The EVM modulo operation should be encoded similarly.

@daejunpark
Copy link
Collaborator Author

Can be merged after #340

@karmacoma-eth
Copy link
Collaborator

it would be nice to have a test that demonstrates the issue that this fixes. What about this?

    function check_Div(uint num, uint256 den) public pure {
        vm.assume(num > den);
        uint256 y;

        assembly {
            y := div(num, den)
        }

        assert(y != 0);
    }

We currently get

# of potential paths involving assertion violations: 1 / 2  (--solver-threads 20)
  Checking again with refinement
  Invalid path; ignored (path id: 1)
[PASS] check_Div(uint256,uint256) (paths: 2, time: 12.51s (paths: 0.03s, models: 12.49s), bounds: [])

but we should get a counterexample with den == 0, right?

@daejunpark
Copy link
Collaborator Author

new tests are added: a5199df

Copy link
Collaborator

@karmacoma-eth karmacoma-eth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

neat, thank you!

@daejunpark daejunpark force-pushed the fix-bv-div-by-zero-smt-encoding branch from a5199df to 6ed495a Compare August 14, 2024 01:37
@daejunpark daejunpark merged commit f5acded into main Aug 14, 2024
33 checks passed
@daejunpark daejunpark deleted the fix-bv-div-by-zero-smt-encoding branch August 14, 2024 01:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants