Skip to content

Conversation

feliam
Copy link
Contributor

@feliam feliam commented Aug 27, 2020

Rather than stopping when the last tx has not uncovered any new code at any of the explored states.
Stop when each state in its own did not find any new code.

What?

Consider this example....

contract MotivatingExample {
    event Log(string);
    int  stateA = 0;
    int  stateB = 0;
    function f(int input) public {
    	stateA=input;
        }
    function g() public {
        stateB = stateA;
        }
    function h() payable public {
        if(stateB == 61){
          emit Log("Bug found");
         }
    }
}

You need a trace with f()-g()-h() to emit the bug log. though in the first explored tx manticore will fork and explore f(), and g(), and h() all in different states hitting most of the code. Then in the second TX no new coverage would be found and the third tx will never be tried. IFFyou used the global coverage stopping condition

This adds a way to stop only when no state made any progress in its own world. Clearly a longer process.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant