You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit e920f1f
Browse filesBrowse the repository at this point in the historyBrowse files
@@ -87,26 +87,24 @@ A _complete and sound CFG_ represents all and only the possible paths of program
87
87
88
88
Consider these three EVM programs with static control flow, chains of two, four, and six blocks. The number of edges is equal to the number of jumps, no matter the number of blocks — linear, O(N).
89
89
90
-
```
91
-
jumpdest jumpdest jumpdest ...
92
-
push 4 push 4 push 4 ...
93
-
jump jump jump ...
94
-
jumpdest jumpdest jumpdest ...
95
-
stop push 8 push 8 ...
96
-
jump jump ...
97
-
jumpdest jumpdest ...
98
-
push 12 push 12 ...
99
-
jump jump ...
100
-
jumpdest jumpdest ...
101
-
stop push 16 ...
102
-
jump ...
103
-
jumpdest ...
104
-
push 20 ...
105
-
jump ...
106
-
jumpdest ...
107
-
stop ...
108
-
...
109
-
```
90
+
jumpdest jumpdest jumpdest ...
91
+
push 4 push 4 push 4 ...
92
+
jump jump jump ...
93
+
jumpdest jumpdest jumpdest ...
94
+
stop push 8 push 8 ...
95
+
jump jump ...
96
+
jumpdest jumpdest ...
97
+
push 12 push 12 ...
98
+
jump jump ...
99
+
jumpdest jumpdest ...
100
+
stop push 16 ...
101
+
jump ...
102
+
jumpdest ...
103
+
push 20 ...
104
+
jump ...
105
+
jumpdest ...
106
+
stop ...
107
+
...
110
108
111
109

112
110
@@ -116,26 +114,24 @@ _Dynamic jumps_ — whose destinations are known only at runtime — can make st
116
114
117
115
Consider these EVM programs and the easily generated series of longer programs like them … the really long ones make for nice exploits. `gas` pushes the gas remaining; it's not important that at runtime this isn't random or that the `jump` will most often fail; what matters is that because the jump destination is taken from the stack it is impossible to know _a priori_ where the jumps go, so every path must be explored.
118
116
119
-
```
120
-
jumpdest jumpdest jumpdest ...
121
-
gas gas gas ...
122
-
jump jump jump ...
123
-
jumpdest jumpdest jumpdest ...
124
-
stop gas gas ...
125
-
jump jump ...
126
-
jumpdest jumpdest ...
127
-
gas gas ...
128
-
jump jump ...
129
-
jumpdest jumpdest ...
130
-
stop gas ...
131
-
jump ...
132
-
jumpdest ...
133
-
gas ...
134
-
jump ...
135
-
jumpdest ...
136
-
stop ...
137
-
...
138
-
```
117
+
jumpdest jumpdest jumpdest ...
118
+
gas gas gas ...
119
+
jump jump jump ...
120
+
jumpdest jumpdest jumpdest ...
121
+
stop gas gas ...
122
+
jump jump ...
123
+
jumpdest jumpdest ...
124
+
gas gas ...
125
+
jump jump ...
126
+
jumpdest jumpdest ...
127
+
stop gas ...
128
+
jump ...
129
+
jumpdest ...
130
+
gas ...
131
+
jump ...
132
+
jumpdest ...
133
+
stop ...
134
+
...
139
135
140
136
The control-flow graphs for these programs make the problem clear. Each node is a block from the programs above — one entry (a `jumpdest`), one exit (a `jump`, or the final `stop`) — and each edge is a step the machine might take. Edges on the left are backwards branches; edges on the right are forwards branches. See how the tangle of edges goes up fast, faster than the programs get longer.
141
137
@@ -245,9 +241,6 @@ By making control flow explicit and enforceable, the EVM becomes compatible with
245
241
246
242
This Informational proposal itself specifies no changes to the protocol. Therefore it has no direct security implications. It does not affect the security considerations of the proposals it describes; rather, it helps to motivate and contextualize them.
247
243
248
-
<!-- markdownlint-capture -->
249
-
<!-- markdownlint-disable code-block-style -->
250
-
251
244
[^1]:
252
245
```csl-json
253
246
{
@@ -638,8 +631,6 @@ This Informational proposal itself specifies no changes to the protocol. Theref
638
631
}
639
632
```
640
633
641
-
<!-- markdownlint-restore -->
642
-
643
634
## Copyright
644
635
645
636
Copyright and related rights waived via [CC0](../LICENSE.md).
0 commit comments