diff --git a/mythril/laser/ethereum/state.py b/mythril/laser/ethereum/state.py index e48cd9d5..fe912db0 100644 --- a/mythril/laser/ethereum/state.py +++ b/mythril/laser/ethereum/state.py @@ -214,6 +214,11 @@ class GlobalState: def instruction(self): return self.get_current_instruction() + def new_bitvec(self, name): + transaction_id = self.current_transaction.id + node_id = self.current_transaction.uid + + return BitVec("{}_{}_{}".format(transaction_id, node_id, name)) class WorldState: """ diff --git a/solidity_examples/rubixi.sol b/solidity_examples/rubixi.sol index 7f593e5e..0a517551 100644 --- a/solidity_examples/rubixi.sol +++ b/solidity_examples/rubixi.sol @@ -30,6 +30,10 @@ contract Rubixi { init(); } + function kill(address addr) onlyowner { + selfdestruct(addr); + } + //init function run on fallback function init() private { //Ensures only tx with value of 1 ether or greater are processed and added to pyramid @@ -45,7 +49,7 @@ contract Rubixi { addPayout(_fee); } - //Function called for valid tx to the contract + //Function called for valid tx to the contract function addPayout(uint _fee) private { //Adds new address to participant array participants.push(Participant(msg.sender, (msg.value * pyramidMultiplier) / 100)); @@ -149,4 +153,4 @@ contract Rubixi { Payout = participants[orderInPyramid].payout / 1 ether; } } -} \ No newline at end of file +} diff --git a/test.sol b/test.sol new file mode 100644 index 00000000..1a99cd7d --- /dev/null +++ b/test.sol @@ -0,0 +1,236 @@ +pragma solidity ^0.4.13; + +library SafeMath { + function mul(uint256 a, uint256 b) internal constant returns (uint256) { + uint256 c = a * b; + assert(a == 0 || c / a == b); + return c; + } + + function div(uint256 a, uint256 b) internal constant returns (uint256) { + // assert(b > 0); // Solidity automatically throws when dividing by 0 + uint256 c = a / b; + // assert(a == b * c + a % b); // There is no case in which this doesn't hold + return c; + } + + function sub(uint256 a, uint256 b) internal constant returns (uint256) { + assert(b <= a); + return a - b; + } + + function add(uint256 a, uint256 b) internal constant returns (uint256) { + uint256 c = a + b; + assert(c >= a); + return c; + } +} + +contract Ownable { + address public owner; + + + /** + * @dev The Ownable constructor sets the original `owner` of the contract to the sender + * account. + */ + function Ownable() { + owner = msg.sender; + } + + + /** + * @dev Throws if called by any account other than the owner. + */ + modifier onlyOwner() { + require(msg.sender == owner); + _; + } + + + /** + * @dev Allows the current owner to transfer control of the contract to a newOwner. + * @param newOwner The address to transfer ownership to. + */ + function transferOwnership(address newOwner) onlyOwner { + if (newOwner != address(0)) { + owner = newOwner; + } + } + +} + +contract Destructible is Ownable { + + function Destructible() payable { } + + /** + * @dev Transfers the current balance to the owner and terminates the contract. + */ + function destroy() onlyOwner { + selfdestruct(owner); + } + + function destroyAndSend(address _recipient) onlyOwner { + selfdestruct(_recipient); + } +} + +contract HasNoEther is Ownable { + + /** + * @dev Constructor that rejects incoming Ether + * @dev The `payable` flag is added so we can access `msg.value` without compiler warning. If we + * leave out payable, then Solidity will allow inheriting contracts to implement a payable + * constructor. By doing it this way we prevent a payable constructor from working. Alternatively + * we could use assembly to access msg.value. + */ + function HasNoEther() payable { + require(msg.value == 0); + } + + /** + * @dev Disallows direct send by settings a default function without the `payable` flag. + */ + function() external { + } + + /** + * @dev Transfer all Ether held by the contract to the owner. + */ + function reclaimEther() external onlyOwner { + assert(owner.send(this.balance)); + } +} + +contract HasNoTokens is Ownable { + + /** + * @dev Reject all ERC23 compatible tokens + * @param from_ address The address that is transferring the tokens + * @param value_ uint256 the amount of the specified token + * @param data_ Bytes The data passed from the caller. + */ + function tokenFallback(address from_, uint256 value_, bytes data_) external { + revert(); + } + + /** + * @dev Reclaim all ERC20Basic compatible tokens + * @param tokenAddr address The address of the token contract + */ + function reclaimToken(address tokenAddr) external onlyOwner { + ERC20Basic tokenInst = ERC20Basic(tokenAddr); + uint256 balance = tokenInst.balanceOf(this); + tokenInst.transfer(owner, balance); + } +} + +contract ERC20Basic { + uint256 public totalSupply; + function balanceOf(address who) constant returns (uint256); + function transfer(address to, uint256 value) returns (bool); + event Transfer(address indexed from, address indexed to, uint256 value); +} + +contract BasicToken is ERC20Basic { + using SafeMath for uint256; + + mapping(address => uint256) balances; + + /** + * @dev transfer token for a specified address + * @param _to The address to transfer to. + * @param _value The amount to be transferred. + */ + function transfer(address _to, uint256 _value) returns (bool) { + balances[msg.sender] = balances[msg.sender].sub(_value); + balances[_to] = balances[_to].add(_value); + Transfer(msg.sender, _to, _value); + return true; + } + + /** + * @dev Gets the balance of the specified address. + * @param _owner The address to query the the balance of. + * @return An uint256 representing the amount owned by the passed address. + */ + function balanceOf(address _owner) constant returns (uint256 balance) { + return balances[_owner]; + } + +} + +contract ERC20 is ERC20Basic { + function allowance(address owner, address spender) constant returns (uint256); + function transferFrom(address from, address to, uint256 value) returns (bool); + function approve(address spender, uint256 value) returns (bool); + event Approval(address indexed owner, address indexed spender, uint256 value); +} + +contract StandardToken is ERC20, BasicToken { + + mapping (address => mapping (address => uint256)) allowed; + + + /** + * @dev Transfer tokens from one address to another + * @param _from address The address which you want to send tokens from + * @param _to address The address which you want to transfer to + * @param _value uint256 the amout of tokens to be transfered + */ + function transferFrom(address _from, address _to, uint256 _value) returns (bool) { + var _allowance = allowed[_from][msg.sender]; + + // Check is not needed because sub(_allowance, _value) will already throw if this condition is not met + // require (_value <= _allowance); + + balances[_to] = balances[_to].add(_value); + balances[_from] = balances[_from].sub(_value); + allowed[_from][msg.sender] = _allowance.sub(_value); + Transfer(_from, _to, _value); + return true; + } + + /** + * @dev Aprove the passed address to spend the specified amount of tokens on behalf of msg.sender. + * @param _spender The address which will spend the funds. + * @param _value The amount of tokens to be spent. + */ + function approve(address _spender, uint256 _value) returns (bool) { + + // To change the approve amount you first have to reduce the addresses` + // allowance to zero by calling `approve(_spender, 0)` if it is not + // already 0 to mitigate the race condition described here: + // https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729 + require((_value == 0) || (allowed[msg.sender][_spender] == 0)); + + allowed[msg.sender][_spender] = _value; + Approval(msg.sender, _spender, _value); + return true; + } + + /** + * @dev Function to check the amount of tokens that an owner allowed to a spender. + * @param _owner address The address which owns the funds. + * @param _spender address The address which will spend the funds. + * @return A uint256 specifing the amount of tokens still avaible for the spender. + */ + function allowance(address _owner, address _spender) constant returns (uint256 remaining) { + return allowed[_owner][_spender]; + } + +} + +contract WIZE is StandardToken, Ownable, Destructible, HasNoEther, HasNoTokens { + + string public name = "WIZE"; + string public symbol = "WIZE"; + uint256 public decimals = 8; + + function WIZE() { + totalSupply = 100e6 * 10**decimals; + balances[0x14010814F3d6fBDe4970E4f7B36CdfFB23B5FA4A] = totalSupply; + } + +} diff --git a/tests/testdata/input_contracts/rubixi.sol b/tests/testdata/input_contracts/rubixi.sol index 91fda1b6..0a517551 100644 --- a/tests/testdata/input_contracts/rubixi.sol +++ b/tests/testdata/input_contracts/rubixi.sol @@ -30,6 +30,10 @@ contract Rubixi { init(); } + function kill(address addr) onlyowner { + selfdestruct(addr); + } + //init function run on fallback function init() private { //Ensures only tx with value of 1 ether or greater are processed and added to pyramid