fix medusa variable redefinition

crytic · Mar 27, 2024 · a457089 · a457089
1 parent e3d1771
commit a457089
Show file tree

Hide file tree

Showing 6 changed files with 330 additions and 11 deletions.
diff --git a/fuzz_utils/fuzzers/Echidna.py b/fuzz_utils/fuzzers/Echidna.py
@@ -34,7 +34,7 @@ def __init__(
         self.reproducer_dir = f"{corpus_path}/reproducers"
         self.corpus_dirs = [f"{corpus_path}/coverage", self.reproducer_dir]
         self.named_inputs = named_inputs
-        self.declared_variables: set[str] = set()
+        self.declared_variables: set[tuple[str, str]] = set()
 
     def get_target_contract(self) -> Contract:
         """Finds and returns Slither Contract"""
@@ -320,11 +320,11 @@ def _get_memarr(
         name = f"dyn{input_type}Arr_{index}"
 
         # If the variable was already declared, just assign the new value
-        if name in self.declared_variables:
+        if (input_type, name) in self.declared_variables:
             declaration = f"{name} = new {input_type}[]({length});\n"
         else:
             declaration = f"{input_type}[] memory {name} = new {input_type}[]({length});\n"
 
-        self.declared_variables.add(name)
+        self.declared_variables.add((input_type, name))
 
         return name, declaration
diff --git a/fuzz_utils/fuzzers/Medusa.py b/fuzz_utils/fuzzers/Medusa.py
@@ -38,6 +38,7 @@ def __init__(
             self.reproducer_dir,
         ]
         self.named_inputs = named_inputs
+        self.declared_variables: set[tuple[str, str]] = set()
 
     def get_target_contract(self) -> Contract:
         """Finds and returns Slither Contract"""
@@ -58,6 +59,9 @@ def parse_reproducer(self, file_path: str, calls: Any, index: int) -> str:
         function_name = ""
         has_low_level_call: bool = False
 
+        # before each test case, we clear the declared variables, as those are locals
+        self.declared_variables = set()
+
         for idx, call in enumerate(calls):
             call_str, fn_name = self._parse_call_object(call)
             call_list.append(call_str)
@@ -198,16 +202,22 @@ def _match_type(self, parameter: Any, values: Any) -> tuple[str, str, str]:
                     # TODO make it work with multidim dynamic arrays
                     if values:
                         dyn_length = len(values)
-
                         array_type: str = ""
+
                         if isinstance(
                             parameter.type.type,
                             (Structure | StructureContract | Enum | EnumContract),
                         ):
                             array_type = parameter.type.type.name
                         else:
                             array_type = parameter.type.type
-                        var_def += f"{array_type}[] memory {parameter.name} = new {parameter.type.type}[]({dyn_length});\n"
+                        # If dynamic array of the same name and type was already declared, reuse it. Else, declare a new one.
+                        if (array_type, parameter.name) in self.declared_variables:
+                            var_def += f"{parameter.name} = new {array_type}[]({dyn_length});\n"
+                        else:
+                            var_def += f"{array_type}[] memory {parameter.name} = new {array_type}[]({dyn_length});\n"
+
+                        self.declared_variables.add((array_type, parameter.name))
 
                         for idx, value in enumerate(values):
                             _, matched_value, _ = self._match_type(parameter.type, value)

diff --git a/...s/test_data/echidna-corpora/corpus-dyn-arr/reproducers/dyn_array_variable_definition.json b/...s/test_data/echidna-corpora/corpus-dyn-arr/reproducers/dyn_array_variable_definition.json
@@ -0,0 +1,94 @@
+[
+    {
+        "call": {
+            "contents": [
+                "addIntArr",
+                [
+                    {
+                        "contents": [
+                            {
+                                "contents": 256,
+                                "tag": "AbiIntType"
+                            },
+                            [
+                                {
+                                    "contents": [
+                                        256,
+                                        "3"
+                                    ],
+                                    "tag": "AbiInt"
+                                }
+                            ]
+                        ],
+                        "tag": "AbiArrayDynamic"
+                    }
+                ]
+            ],
+            "tag": "SolCall"
+        },
+        "delay": [
+            "0x0000000000000000000000000000000000000000000000000000000000000000",
+            "0x0000000000000000000000000000000000000000000000000000000000000000"
+        ],
+        "dst": "0x00a329c0648769A73afAc7F9381E08FB43dBEA72",
+        "gas": 12500000,
+        "gasprice": "0x0000000000000000000000000000000000000000000000000000000000000000",
+        "src": "0x0000000000000000000000000000000000010000",
+        "value": "0x0000000000000000000000000000000000000000000000000000000000000000"
+    },
+    {
+        "call": {
+            "contents": [
+                "addIntArr",
+                [
+                    {
+                        "contents": [
+                            {
+                                "contents": 256,
+                                "tag": "AbiIntType"
+                            },
+                            [
+                                {
+                                    "contents": [
+                                        256,
+                                        "3"
+                                    ],
+                                    "tag": "AbiInt"
+                                }
+                            ]
+                        ],
+                        "tag": "AbiArrayDynamic"
+                    }
+                ]
+            ],
+            "tag": "SolCall"
+        },
+        "delay": [
+            "0x0000000000000000000000000000000000000000000000000000000000000000",
+            "0x0000000000000000000000000000000000000000000000000000000000000000"
+        ],
+        "dst": "0x00a329c0648769A73afAc7F9381E08FB43dBEA72",
+        "gas": 12500000,
+        "gasprice": "0x0000000000000000000000000000000000000000000000000000000000000000",
+        "src": "0x0000000000000000000000000000000000010000",
+        "value": "0x0000000000000000000000000000000000000000000000000000000000000000"
+    },
+    {
+        "call": {
+            "contents": [
+                "check_intDynArr",
+                []
+            ],
+            "tag": "SolCall"
+        },
+        "delay": [
+            "0x0000000000000000000000000000000000000000000000000000000000000000",
+            "0x0000000000000000000000000000000000000000000000000000000000000000"
+        ],
+        "dst": "0x00a329c0648769A73afAc7F9381E08FB43dBEA72",
+        "gas": 12500000,
+        "gasprice": "0x0000000000000000000000000000000000000000000000000000000000000000",
+        "src": "0x0000000000000000000000000000000000010000",
+        "value": "0x0000000000000000000000000000000000000000000000000000000000000000"
+    }
+]
diff --git a/...s/test_data/medusa-corpora/corpus-dyn-arr/test_results/dyn_array_variable_definition.json b/...s/test_data/medusa-corpora/corpus-dyn-arr/test_results/dyn_array_variable_definition.json
@@ -0,0 +1,99 @@
+[
+    {
+        "call": {
+            "from": "0x0000000000000000000000000000000000010000",
+            "to": "0xa647ff3c36cfab592509e13860ab8c4f28781a66",
+            "nonce": 0,
+            "value": "0x0",
+            "gasLimit": 12500000,
+            "gasPrice": "0x1",
+            "gasFeeCap": "0x0",
+            "gasTipCap": "0x0",
+            "data": "0x9b8da3b70000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+            "dataAbiValues": {
+                "methodName": "addBoolArr",
+                "inputValues": [
+                    [
+                        true,
+                        true,
+                        true,
+                        false,
+                        false,
+                        false,
+                        true,
+                        false,
+                        true,
+                        true,
+                        true,
+                        false,
+                        false,
+                        true
+                    ]
+                ]
+            },
+            "AccessList": null,
+            "SkipAccountChecks": false
+        },
+        "blockNumberDelay": 23884,
+        "blockTimestampDelay": 320182
+    },
+    {
+        "call": {
+            "from": "0x0000000000000000000000000000000000010000",
+            "to": "0xa647ff3c36cfab592509e13860ab8c4f28781a66",
+            "nonce": 1,
+            "value": "0x0",
+            "gasLimit": 12500000,
+            "gasPrice": "0x1",
+            "gasFeeCap": "0x0",
+            "gasTipCap": "0x0",
+            "data": "0x9b8da3b70000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+            "dataAbiValues": {
+                "methodName": "addBoolArr",
+                "inputValues": [
+                    [
+                        true,
+                        true,
+                        true,
+                        false,
+                        false,
+                        false,
+                        true,
+                        false,
+                        true,
+                        true,
+                        true,
+                        false,
+                        false,
+                        true
+                    ]
+                ]
+            },
+            "AccessList": null,
+            "SkipAccountChecks": false
+        },
+        "blockNumberDelay": 23884,
+        "blockTimestampDelay": 320182
+    },
+    {
+        "call": {
+            "from": "0x0000000000000000000000000000000000010000",
+            "to": "0xa647ff3c36cfab592509e13860ab8c4f28781a66",
+            "nonce": 2,
+            "value": "0x0",
+            "gasLimit": 12500000,
+            "gasPrice": "0x1",
+            "gasFeeCap": "0x0",
+            "gasTipCap": "0x0",
+            "data": "0xfe08f9cd",
+            "dataAbiValues": {
+                "methodName": "check_boolArr",
+                "inputValues": []
+            },
+            "AccessList": null,
+            "SkipAccountChecks": false
+        },
+        "blockNumberDelay": 47114,
+        "blockTimestampDelay": 360622
+    }
+]
diff --git a/tests/test_data/test/DynamicArrays_Echidna_Test.t.sol b/tests/test_data/test/DynamicArrays_Echidna_Test.t.sol
@@ -10,6 +10,7 @@ contract DynamicArrays_Echidna_Test is Test {
     function setUp() public {
         target = new DynamicArrays();
     }
+    // Reproduced from: echidna-corpora/corpus-dyn-arr/reproducers/-533708655584678499.json
     function test_auto_check_bytesArr_0() public { 
         bytes[] memory dynbytesArr_0 = new bytes[](4);
 		dynbytesArr_0[0] = bytes(hex"00");
@@ -20,10 +21,13 @@ contract DynamicArrays_Echidna_Test is Test {
         vm.prank(0x0000000000000000000000000000000000010000);
         target.addBytesArr(dynbytesArr_0);
 
+
         vm.prank(0x0000000000000000000000000000000000010000);
         target.check_bytesArr();
+
     }
 
+    // Reproduced from: echidna-corpora/corpus-dyn-arr/reproducers/-7647997810271354783.json
     function test_auto_check_addressDynArr_1() public { 
         address[] memory dynaddressArr_0 = new address[](8);
 		dynaddressArr_0[0] = 0x00000000000000000000000000000000DeaDBeef;
@@ -38,10 +42,13 @@ contract DynamicArrays_Echidna_Test is Test {
         vm.prank(0x0000000000000000000000000000000000010000);
         target.addAddressArr(dynaddressArr_0);
 
+
         vm.prank(0x0000000000000000000000000000000000010000);
         target.check_addressDynArr();
+
     }
 
+    // Reproduced from: echidna-corpora/corpus-dyn-arr/reproducers/959716005390025023.json
     function test_auto_check_boolArr_2() public { 
         bool[] memory dynboolArr_0 = new bool[](6);
 		dynboolArr_0[0] = true;
@@ -54,21 +61,27 @@ contract DynamicArrays_Echidna_Test is Test {
         vm.prank(0x0000000000000000000000000000000000010000);
         target.addBoolArr(dynboolArr_0);
 
+
         vm.prank(0x0000000000000000000000000000000000010000);
         target.check_boolArr();
+
     }
 
+    // Reproduced from: echidna-corpora/corpus-dyn-arr/reproducers/5551649382488529349.json
     function test_auto_check_intDynArr_3() public { 
         int256[] memory dynint256Arr_0 = new int256[](1);
 		dynint256Arr_0[0] = int256(3);
 
         vm.prank(0x0000000000000000000000000000000000010000);
         target.addIntArr(dynint256Arr_0);
 
+
         vm.prank(0x0000000000000000000000000000000000010000);
         target.check_intDynArr();
+
     }
 
+    // Reproduced from: echidna-corpora/corpus-dyn-arr/reproducers/1997449955301376751.json
     function test_auto_check_strDynArr_4() public { 
         string[] memory dynstringArr_0 = new string[](4);
 		dynstringArr_0[0] = string(hex"00");
@@ -79,8 +92,30 @@ contract DynamicArrays_Echidna_Test is Test {
         vm.prank(0x0000000000000000000000000000000000010000);
         target.addStrArr(dynstringArr_0);
 
+
         vm.prank(0x0000000000000000000000000000000000010000);
         target.check_strDynArr();
+
+    }
+
+    // Reproduced from: echidna-corpora/corpus-dyn-arr/reproducers/dyn_array_variable_definition.json
+    function test_auto_check_intDynArr_5() public { 
+        int256[] memory dynint256Arr_0 = new int256[](1);
+		dynint256Arr_0[0] = int256(3);
+
+        vm.prank(0x0000000000000000000000000000000000010000);
+        target.addIntArr(dynint256Arr_0);
+
+        dynint256Arr_0 = new int256[](1);
+		dynint256Arr_0[0] = int256(3);
+
+        vm.prank(0x0000000000000000000000000000000000010000);
+        target.addIntArr(dynint256Arr_0);
+
+
+        vm.prank(0x0000000000000000000000000000000000010000);
+        target.check_intDynArr();
+
     }
 
 }