Analyzing Smart Contracts: From EVM to a sound Control-Flow Graph

Figure 4 shows the semantics of some instructions involved in the computation of the values stored in the stack for handling jumps. The state of the program $S$ is a tuple $\langle pc,\langle n,\sigma\rangle\rangle$ where $pc$ is the value of the program counter with the index of the next instruction to be executed, and $\langle n,\sigma\rangle$ is a stack state as defined in Section 2 ($n$ is the number of elements in the stack, and $\sigma$ is a partial mapping that relates some stack positions with a set of jump destinations). Interesting rules are the ones that deal with jump destination addresses on the stack: Rule (4) adds a new address on the stack, and Rules (6) and (8-10) copy or exchange existing addresses on top of the stack, respectively. Rules (1) to (3) perform a jump in the program and therefore consume the address placed on top of the stack, plus an additional word in the case of JUMPI. If the instructions considered in this simplified semantics do not handle jump addresses, the corresponding rules just remove some values from the stack in the program state $S$ (Rules (5), (7) and (11)). The remaining EVM instructions not explicitely considered in this simplified semantics are generically represented by Rule (12) with $b_{pc}^{\delta,\alpha}$, where $\delta$ is the number of items removed from stack when $b_{pc}$ is executed, and $\alpha$ is the number of additional items placed on the stack. Complete executions are traces of the form $S_{0}\Rightarrow S_{1}\Rightarrow\dots\Rightarrow S_{n}$ where $S_{0}\equiv\langle 0,\langle 0,\sigma_{\emptyset}\rangle\rangle$ is the initial state, $\sigma_{\emptyset}$ is the empty mapping, and $S_{n}$ corresponds to the last state. There are no infinite traces, as any transaction that executes EVM code has a finite gas limit and every instruction executed consumes some amount of gas. When the gas limit is exceeded, an out-of-gas exception occurs and the program halts immediately.

The next step consists in defining, by means of the transfer and the updating functions, a constraint equation system to represent all possible jumping addresses that could be valid for executing a jump instruction in the program.

Observe that the addresses equation system will have equations for all program points of the program. Concretely, variables of the form ${\mathcal{X}}_{pc}$ store the jumping addresses saved in the stack after executing $b_{pc}$ for all possible entry stacks. This information will be used for computing all possible jump destinations when executing JUMP or JUMPI instructions. For computing the system, most instructions, cases (4) and (5), just apply the transfer function $\tau$ to compute the possible stack states of the subsequent instruction. Note that the expression $pc+size(b_{pc})$ at (3) just computes the position of the next instruction in the EVM program. Jumping instructions, points (1) and (2), compute the initial state of the invoked blocks, thus they produce a map with all possible input stack states that can reach one block. JUMP and JUMPI instructions produce, for each stack state, one equation by taking the element from the previous stack state ${\mathcal{X}}_{\sigma(s_{n-1})}$. JUMPI, point (2), produces an extra equation ${\mathcal{X}}_{pc+1}$ to capture the possibility of continuing to the next instruction instead of jumping to the destination address. Additionally, those instructions before JUMPDEST, point (3), produce initial states for the block that starts in the JUMPDEST. When the constraint equation system is solved, constraint variables over-approximate the jumping information for the program.

Solving the addresses equation system of a program $P$ can be done iteratively. A naïve algorithm consists in first creating one constraint variable ${\mathcal{X}}_{0}\sqsupseteq\pi_{\emptyset}[\langle 0,\sigma_{\emptyset}\rangle\mapsto\left\{{\langle 0,\sigma_{\emptyset}\rangle}\right\}]$, where $\pi_{\emptyset}$ and $\sigma_{\emptyset}$ are empty mappings, and ${\mathcal{X}}_{pc}\sqsupseteq\pi_{{}_{\bot}}$ for all $pc\in P,pc\not=0$, and then iteratively refining the values of these variables as follows:

1. 1.

   substitute the current values of the constraint variables in the right-hand side of each constraint, and then evaluate the right-hand side if needed;

2. 2.

   if each constraint ${\mathcal{X}}\sqsupseteq E$ holds, where $E$ is the value of the evaluation of the right-hand side of the previous step, then the process finishes; otherwise

3. 3.

   for each ${\mathcal{X}}\sqsupseteq E$ which does not hold, let $E^{\prime}$ be the current value of ${\mathcal{X}}$. Then update the current value of ${\mathcal{X}}$ to $E\sqcup E^{\prime}$. Once all these updates are (iteratively) applied we repeat the process at step 1.