ityfuzz icon indicating copy to clipboard operation
ityfuzz copied to clipboard

Ityfuzz ignores contract ownership

Open iVoider opened this issue 1 year ago • 2 comments

Following contracts give corpus items with non-reverted status, though in fact default callers don't have permission to call functions due to onlyGovernor modifier. I thought that there is some voting mechanism based on token quantity, but even with flashloan and oracles disabled result doesn't change.

ETH: 0x72426BA137DEC62657306b12B1E869d43FeC6eC7,0xa7695eED05094E28AA575CB0cCa3CF17848a7981,0x0D017aFA83EAce9F10A8EC5B6E13941664A6785C,0xc0F42F73b8f01849a2DD99753524d4ba14317EB3,0x77314EB392b2be47C014cde0706908b3307Ad6a9,0xcecaD69d7D4Ed6D52eFcFA028aF8732F27e08F70,0x9c354503c38481a7a7a51629142963f98ecc12d0,0x80c898ae5e56f888365e235ceb8cea3eb726cb58,0x5A4eEe58744D1430876d5cA93cAB5CcB763C037D,0xDcEe70654261AF21C44c093C300eD3Bb97b78192,0x501804B374EF06fa9C427476147ac09F1551B9A0,0x3fF8654D633D4Ea0faE24c52Aec73B4A20D0d0e5,0x0c4576ca1c365868e162554af8e385dc3e7c66d9,0x89eb88fedc50fc77ae8a18aad1ca0ac27f777a90,0x21fb5812d70b3396880d30e90d9e5c1202266c89,0x2A8e1E676Ec238d8A992307B495b45B3fEAa5e86,0x5e3646A1Db86993f73E6b74A57D8640B69F7e259,0x1827F9eA98E0bf96550b2FC20F7233277FcD7E63,0x7d82e86cf1496f9485a8ea04012afeb3c7489397,0xe75d77b1865ae93c7eaa3040b038d7aa7bc02f70,0x39254033945AA2E4809Cc2977E7087BEE48bd7Ab,0xea2ef2e2e5a749d4a66b41db9ad85a38aa264cb3,0x856c4Efb76C1D1AE02e20CEB03A2A6a08b0b8dC3,0x9c459eeb3FA179a40329b81C1635525e9A0Ef094

iVoider avatar Jul 17 '23 09:07 iVoider

The problem lies again at control leak check. evm/host.rs. And different methods that are protected by modifiers occurs in both 3 places in fn call(&mut self, input: &mut CallInputs, state: &mut S) -> (InstructionResult, Gas, Bytes) where ControlLeak could be returned. As well as this, I investigated that many ordinary calls are not marked as reverted due to this issue. Maybe this place should be refactored. Is it ok to finish call execution, and not return ControlLeak, but pass it as another field?

iVoider avatar Jul 18 '23 07:07 iVoider

yeah, it is due to control leak. trying to fix in #156

shouc avatar Aug 02 '23 05:08 shouc