fix(avm)!: de-risk memory injection attacks#19620
Conversation
…nd trace continuity
sirasistant
left a comment
There was a problem hiding this comment.
to radix mem refactor looks good
Flakey Tests🤖 says: This CI run detected 3 tests that failed, but were tolerated due to a .test_patterns.yml entry. |
IlyasRidhuan
left a comment
There was a problem hiding this comment.
Nice job looks great!
| #[LAST_HAS_SEL_ON] | ||
| last * (1 - sel) = 0; | ||
|
|
||
| // Latch condition is boolean because `last` cannot be activated at first row due to #[LAST_HAS_SEL_ON]. |
There was a problem hiding this comment.
But does #[LAST_HAS_SEL_ON] only guarantee it because there exists a sel' from #[TRACE_CONTINUITY]? So sel cannot be activated on the first row (which means latch can't either)
There was a problem hiding this comment.
This does not follow from trace continuity. It follows from sel being shifted and therefore cannot be active on the first row (precomputed.first_row == 1). From #[LAST_HAS_SEL_ON], we have sel == 0 implies last == 0 and therefore last is mutually exclusive to precomputed.first_row.
We employed this reasoning many times and I might have been concise here due to habit of it.
There was a problem hiding this comment.
Gotcha, there are 2 instance of sel' in the trace, in #[TRACE_CONTINUITY] and in #[START_AFTER_LATCH]
BEGIN_COMMIT_OVERRIDE feat(avm): contract instance mutation (#19499) fix(avm): Fix note hash exists fuzzing (#19616) fix(avm): Build trace on coverage prover runs (#19627) chore(avm): Use PC alias type consistently (#19625) feat(avm): mutate global gas fees and timestamp (#19500) docs: avm docs (#19603) fix(avm): Increase chances of fuzzer finding limits (#19656) fix(avm)!: de-risk memory injection attacks (#19620) fix(avm): Fix TS ECC add infinity handling (#19657) fix(avm): Fix jumpif in fuzzer (#19655) feat(avm): protocol contractg mutations (#19586) chore(avm): analyze fuzzer corpus distribution (#19614) feat(avm): fuzzer treats enqueued call size as coverage (#19615) refactor(avm): Refactor calldata copy and return data copy fuzzing (#19666) feat(avm): boundary values for mutations (#19617) END_COMMIT_OVERRIDE
Linear issue AVM-180