97 |
100 | -
13 | *
- Type 14 | *
- Name 15 | *
- Inputs 16 | *
- Outputs 17 | *
-
12 | *
- Name 13 | *
- Type 14 | *
- Components (currently ignored) 15 | *
-
13 | *
- Hash 14 | *
- Type 15 | *
- Inputs 16 | *
-
9 | *
- index 10 | *
- type 11 | *
2 | # EtherSolve 3 | 4 | EtherSolve is a tool for *Control Flow Graph (CFG)* reconstruction and *static analysis* of Solidity smart-contracts from Ethereum bytecode. 5 | 6 | The tool is based on the peer-reviewed pubblication 7 | > Michele Pasqua, Andrea Benini, Filippo Contro, Marco Crosara, Mila Dalla Preda, and Mariano Ceccato. "Enhancing Ethereum smart-contracts static analysis by computing a precise Control-Flow Graph of Ethereum bytecode". In: *Journal of Systems and Software* (pp. 1-18), Elsevier, 2023. DOI: [10.1016/j.jss.2023.111653](https://doi.org/10.1016/j.jss.2023.111653) 8 | 9 | That is a revised and extended version of the peer-reviewed publication 10 | > Filippo Contro, Marco Crosara, Mariano Ceccato, and Mila Dalla Preda. "EtherSolve: Computing an Accurate Control-Flow Graph from Ethereum Bytecode". In: *Proceedings of the 29th IEEE/ACM International Conference on Program Comprehension* (pp. 127-137), IEEE, 2021. DOI: [10.1109/ICPC52881.2021.00021](https://doi.org/10.1109/ICPC52881.2021.00021) 11 | 12 | ### Vulnerability Detection 13 | The tool also provides modules for the detection of Ethereum vulnerabilities. It currently supports *Re-entrancy* and *Tx.origin* vulnerabilities. 14 | 15 | ## Usage 16 | 17 | ### JAR 18 | 19 | The simplest way to try EtherSolve is through the provided `EtherSolve.jar` ([link](artifact/EtherSolve.jar)). 20 | 21 | ```bash 22 | Usage: ethersolve [-hV] [--re-entrancy] [--tx-origin] [-o=
39 | The tool has been tested on Linux x64 with Java 11.0.8. To produce a graphical output (HTML or SVG) [Graphviz](https://graphviz.org/) is required. 40 | 41 | To run the Re-entrancy and the Tx.origin validators add the `--re-entrancy` and the `--tx-origin` options, respectively. The tool will create a CSV file containing the detected vulnerabilities and their location in the code. 42 | 43 | #### Examples 44 | 45 | To analize the bytecode of a smart-contract contained in a given file, you can run following: 46 | 47 | ```bash 48 | # Generate HTML report for creation-code source file 49 | java -jar EtherSolve.jar -c -H path/to/bytecode/file.evm 50 | ``` 51 | 52 | ```bash 53 | # Generate JSON report in 'report.json' for creation-code source file 54 | java -jar EtherSolve.jar -c -j -o report.json path/to/bytecode/file.evm 55 | ``` 56 | 57 | ```bash 58 | # Generate HTML report in 'index.html' for runtime-code source file 59 | java -jar EtherSolve.jar -r -H -o index.html path/to/bytecode/file.evm 60 | ``` 61 | 62 | ```bash 63 | # Generate HTML report in 'index.html' for creation-code source file with Re-entrancy detection analysis 64 | java -jar EtherSolve.jar -c -H -o index.html --re-entrancy path/to/bytecode/file.evm 65 | ``` 66 | 67 | ### Gradle 68 | 69 | To build from source and run the project you should use gradle (minimum Gradle supported version: *5.2.1*). To build from source **Java 8** is required. 70 | 71 | EtherSolve is composed of five modules. 72 | - **Core**: it contains the main procedures to parse the bytecode and build the CFG. 73 | - **Abi**: it contains the validation methods (see the paper) and a prototype for an Abi extraction. 74 | - **UI**: it contains the procedures to graphically represent the CFG using Graphviz and to produce the HTML report. It also contains the command line interface and the main class of the tool. 75 | - **SecurityAnalysis**: it contains the security analyser and the dataset tester used for the comparison with the [SolidiFI](https://arxiv.org/pdf/2005.11613.pdf) survey. 76 | - **WebApp**: it contains a simple SpringBoot server to provide analysis via APIs (unmantained). 77 | 78 | The following Gradle tasks are available. 79 | - `bootRun`: run the project as a Spring Boot application. 80 | - `runCoreMain`: run the main class of the Core module, that analyses a sample bytecode written in the `Main` class, producing a JSON output. 81 | - `runIRExtractor`: run the extractor to get the intermediate representation used for the analysis. 82 | - `runSecurityAnalyser`: run the main class of the Core module, that analyses a sample bytecode. 83 | - `jar`: build a JAR for each module. The only JAR having an entry point is the one of the UI module. The artifact output can be found in the `UI/build/libs` folder. 84 | 85 | For the full list run `gradle tasks`. 86 | 87 | ## Replication Package 88 | 89 | The material to replicate the results presented in the JSS 2023 publication can be found in the [JSS Replication Package](https://zenodo.org/record/7545056). 90 | -------------------------------------------------------------------------------- /SecurityAnalysis/build.gradle: -------------------------------------------------------------------------------- 1 | plugins { 2 | id 'java' 3 | } 4 | 5 | group 'org.example' 6 | version '1.0-SNAPSHOT' 7 | 8 | repositories { 9 | mavenCentral() 10 | } 11 | 12 | dependencies { 13 | compile project(':Core') 14 | testCompile group: 'junit', name: 'junit', version: '4.12' 15 | } 16 | 17 | task runSecurityAnalyser(type: JavaExec) { 18 | group = "Execution" 19 | description = "Run the main class of Core module, which analyses a sample bytecode" 20 | classpath = sourceSets.main.runtimeClasspath 21 | main = "main.SecurityAnalyser" 22 | } -------------------------------------------------------------------------------- /SecurityAnalysis/src/main/java/analysers/StoreAccessAfterUnsafeCall.java: -------------------------------------------------------------------------------- 1 | package analysers; 2 | 3 | import main.SecurityAnalysisReport; 4 | import main.SecurityDetection; 5 | import main.SecurityVulnerability; 6 | import opcodes.Opcode; 7 | import opcodes.stackOpcodes.SLoadOpcode; 8 | import opcodes.stackOpcodes.SStoreOpcode; 9 | import opcodes.systemOpcodes.CallOpcode; 10 | import parseTree.Contract; 11 | import parseTree.SymbolicExecution.StackExceededException; 12 | import parseTree.SymbolicExecution.SymbolicExecutionStack; 13 | import parseTree.SymbolicExecution.UnknownStackElementException; 14 | import parseTree.cfg.BasicBlock; 15 | import parseTree.cfg.BasicBlockType; 16 | import parseTree.cfg.Cfg; 17 | 18 | import java.util.HashSet; 19 | import java.util.Stack; 20 | 21 | public class StoreAccessAfterUnsafeCall { 22 | private static final String SLOAD_MESSAGE = "Store access in read mode after an unsafe call"; 23 | private static final String SSTORE_MESSAGE = "Store access in write mode after an unsafe call; this could bring to a re-entrancy vulnerability"; 24 | 25 | 26 | public static void analyse(Contract contract, SecurityAnalysisReport report) { 27 | // Get the CFG 28 | Cfg runtimeCfg = contract.getRuntimeCfg(); 29 | // Gather the blocks containing the CALL opcode 30 | for (BasicBlock bb : runtimeCfg){ 31 | if (bb.checkPattern(new CallOpcode(0)) && bb.getType() == BasicBlockType.COMMON){ 32 | // Check if it is an unsafe call 33 | if (isUnsafeCall(bb)){ 34 | // Check if it can reach an SSTORE or an SLOAD opcode through DFS 35 | BasicBlock currentBlock; 36 | Stack
API
Address: " + address + "Name: " + name; 29 | }*/ 30 | 31 | @GetMapping 32 | public String getRequest(@RequestParam String address, @RequestParam(required = false) String name){ 33 | Response response; 34 | if (name == null) 35 | name = "Contract" + CONTACT_COUNTER.getAndIncrement(); 36 | response = AddressProcessor.process(name, address); 37 | return gson.toJson(response); 38 | } 39 | 40 | @PostMapping(consumes = "application/json", produces = "application/json") 41 | public String postRequest(@RequestBody String requestBody){ 42 | PostRequestBody parsedRequestBody; 43 | parsedRequestBody = gson.fromJson(requestBody, PostRequestBody.class); 44 | // System.out.println(String.format("address:%s\nbytecode:%s\nisOnlyRuntime%s\n", parsedRequestBody.getAddress(), parsedRequestBody.getBytecode(), parsedRequestBody.isOnlyRuntime())); 45 | Response response; 46 | 47 | String name; 48 | if (parsedRequestBody.getName() == null) 49 | name = "Contract" + CONTACT_COUNTER.getAndIncrement(); 50 | else 51 | name = parsedRequestBody.getName(); 52 | 53 | if (parsedRequestBody.getAddress() != null) 54 | response = AddressProcessor.process(name, parsedRequestBody.getAddress()); 55 | else if (parsedRequestBody.getBytecode() != null) 56 | response = BytecodeProcessor.process(name, parsedRequestBody.getBytecode(), parsedRequestBody.isOnlyRuntime()); 57 | else 58 | response = MISSING_INVALID_PARAMS_ERROR; 59 | return gson.toJson(response); 60 | } 61 | 62 | @ExceptionHandler({MissingServletRequestParameterException.class, IllegalStateException.class}) 63 | public String requestFormatError() { 64 | return gson.toJson(MISSING_INVALID_PARAMS_ERROR); 65 | } 66 | } 67 | 68 | -------------------------------------------------------------------------------- /WebApp/src/main/java/server/App.java: -------------------------------------------------------------------------------- 1 | package server; 2 | 3 | import org.springframework.boot.SpringApplication; 4 | import org.springframework.boot.autoconfigure.SpringBootApplication; 5 | 6 | @SpringBootApplication 7 | public class App { 8 | 9 | public static void main(String[] args) { 10 | SpringApplication.run(App.class, args); 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /WebApp/src/main/java/server/GuiController.java: -------------------------------------------------------------------------------- 1 | package server; 2 | 3 | import org.springframework.web.bind.annotation.GetMapping; 4 | import org.springframework.web.bind.annotation.RestController; 5 | 6 | @RestController("/") 7 | public class GuiController { 8 | 9 | @GetMapping 10 | public String getRequest(){ 11 | return "GUI"; 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /WebApp/src/main/java/server/RenderController.java: -------------------------------------------------------------------------------- 1 | package server; 2 | 3 | import com.google.gson.Gson; 4 | import json_utils.RenderRequestBody; 5 | import json_utils.Response; 6 | import org.springframework.web.bind.annotation.PostMapping; 7 | import org.springframework.web.bind.annotation.RequestBody; 8 | import org.springframework.web.bind.annotation.RequestMapping; 9 | import org.springframework.web.bind.annotation.RestController; 10 | import processing.GraphvizException; 11 | import processing.GraphvizProcessor; 12 | 13 | @RestController 14 | @RequestMapping("/render") 15 | public class RenderController { 16 | private final static Response GRAPHVIZ_ERROR = new Response("0", 17 | "A critical error occurred during graphviz render", 18 | null); 19 | private static final Gson gson = new Gson(); 20 | 21 | @PostMapping(consumes = "application/json", produces = "application/json") 22 | public String postRequest(@RequestBody String requestBody){ 23 | RenderRequestBody parsedRequestBody; 24 | parsedRequestBody = gson.fromJson(requestBody, RenderRequestBody.class); 25 | 26 | String dotNotation = parsedRequestBody.getDot(); 27 | Response response; 28 | try { 29 | String svg = GraphvizProcessor.process(dotNotation); 30 | response = new Response("1", "Graphviz render completed", svg); 31 | } catch (GraphvizException e) { 32 | response = GRAPHVIZ_ERROR; 33 | } 34 | 35 | return gson.toJson(response); 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /WebApp/src/main/resources/application.yml: -------------------------------------------------------------------------------- 1 | server: 2 | port: 8081 -------------------------------------------------------------------------------- /artifact/EtherSolve.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SeUniVr/EtherSolve/59fe4412f7230d9ee1047b25fbcf30b63cb89488/artifact/EtherSolve.jar -------------------------------------------------------------------------------- /build.gradle: -------------------------------------------------------------------------------- 1 | plugins { 2 | id 'java' 3 | } 4 | 5 | group 'org.example' 6 | version '1.0-SNAPSHOT' 7 | 8 | sourceCompatibility = 1.8 9 | 10 | repositories { 11 | mavenCentral() 12 | } 13 | 14 | dependencies { 15 | testCompile group: 'junit', name: 'junit', version: '4.12' 16 | } -------------------------------------------------------------------------------- /doc/deprecated-list.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 |
104 |
105 |
114 |
115 | Class Hierarchy
106 |-
107 |
- java.lang.Object
108 |
-
109 |
- etherscan.EtherScanDownloader 110 |
112 |
104 |
105 |
114 |
115 | Class Hierarchy
106 |-
107 |
- java.lang.Object
108 |
-
109 |
- gson.GsonAbi 110 |
112 |