v0.23.2 crash on analysis

Hey guys ,

I was considering to add mythril to our CI/CD but sadly it crashes on start on our contracts. I tried both PIP python3.9 version on MacOS and Docker edition python3.8 and it crashes on analysis argument.

running :

docker run --rm -v ${PWD}:/code mythril/myth:latest a /code/contracts/TokenVesting.sol --solc-json  /code/myth.json

myth.json simply points to where openzeppelin contracts are located.

will cause :

mythril.mythril.mythril_analyzer [CRITICAL]: Exception occurred, aborting analysis. Please report this issue to the Mythril GitHub page.
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/svm.py", line 375, in execute_state
    new_global_states = Instruction(
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 264, in evaluate
    result = instruction_mutator(global_state)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 195, in wrapper
    new_global_states = self.call_on_state_copy(func, func_obj, global_state)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 130, in call_on_state_copy
    return func(func_obj, global_state_copy)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 1923, in revert_
    global_state.current_transaction.end(
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/transaction/transaction_models.py", line 199, in end
    raise TransactionEndSignal(global_state, revert)
mythril.laser.ethereum.transaction.transaction_models.TransactionEndSignal: (<mythril.laser.ethereum.state.global_state.GlobalState object at 0x7f62ed528640>, True)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/mythril/mythril_analyzer.py", line 141, in fire_lasers
    sym = SymExecWrapper(
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/analysis/symbolic.py", line 169, in __init__
    self.laser.sym_exec(
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/svm.py", line 194, in sym_exec
    self._execute_transactions(created_account.address)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/svm.py", line 242, in _execute_transactions
    execute_message_call(self, address, func_hashes=func_hashes)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/transaction/symbolic.py", line 144, in execute_message_call
    laser_evm.exec()
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/svm.py", line 282, in exec
    new_states, op_code = self.execute_state(global_state)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/svm.py", line 446, in execute_state
    new_global_states = self._end_message_call(
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/svm.py", line 499, in _end_message_call
    new_global_states = Instruction(
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 264, in evaluate
    result = instruction_mutator(global_state)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 195, in wrapper
    new_global_states = self.call_on_state_copy(func, func_obj, global_state)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 130, in call_on_state_copy
    return func(func_obj, global_state_copy)
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 2443, in staticcall_post
    return self.post_handler(global_state, function_name="staticcall")
  File "/usr/local/lib/python3.8/dist-packages/mythril-0.23.2-py3.8.egg/mythril/laser/ethereum/instructions.py", line 2506, in post_handler
    for i in range(min(memory_out_size, global_state.last_return_data.size)):
TypeError: 'BitVec' object cannot be interpreted as an integer

The analysis was completed successfully. No issues were detected.

is there any workaround ?

[0xsha]

Interesting ! thanks @norhh for checking it out , seems i’m still facing the issue on MacOS/Python3.9 and I finally found why. What a non-deterministic one, it was in config !! the issue comes from enabling optimizer for solc .

Commit

commit 635a37afa507d53e078a56ce103a66f70541fe03 (HEAD -> develop, origin/develop, origin/HEAD)

Python

Python 3.9.12 (main, Mar 26 2022, 15:52:10)

command used

python3 myth a ./token-vesting-contract/contracts/TokenVesting.sol --solc-json ./token-vesting-contract/myth.json

while using optimizer option so basically here is the PoC .

{
    "remappings": [
      "@openzeppelin/contracts/=./node_modules/@openzeppelin/contracts/"
    ],
    "optimizer": {
      "enabled": true
    }
  }
  

Crash

....
return self.post_handler(global_state, function_name="staticcall")
  File "/Users/mac/Developer/Python/mythril/mythril/laser/ethereum/instructions.py", line 2517, in post_handler
    for i in range(min(memory_out_size, ret_size)):
TypeError: 'BitVec' object cannot be interpreted as an integer

guess we are so close to a proper solution.

[norhh]

Can you confirm if it works?