You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: program-analysis/echidna/advanced/interacting-with-offchain-data-via-ffi.md
+6-13Lines changed: 6 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,39 +1,34 @@
1
1
# Interacting with off-chain data using the `ffi` cheatcode
2
2
3
-
4
3
## Introduction
5
4
6
5
Since the implementation of the HEVM cheat codes in Echidna, it is possible to interact with off-chain data by means of the `ffi` cheatcode. This function allows the caller to execute an arbitrary command on the system running Echidna and read its output, enabling the possibility of getting external data into a fuzzing campaign.
7
6
8
-
9
7
## A word of caution
10
8
11
-
In general, the usage of cheatcodes is not encouraged, since manipulating the EVM execution environment can lead to unpredictable results and false positives or negatives in fuzzing tests.
9
+
In general, the usage of cheatcodes is not encouraged, since manipulating the EVM execution environment can lead to unpredictable results and false positives or negatives in fuzzing tests.
12
10
13
11
This piece of advice becomes more critical when using `ffi`. This cheatcode basically allows arbitrary code execution on the host system, so it's not just the EVM execution environment that can be manipulated. Running malicious or untrusted tests with `ffi` can have disastrous consequences.
14
12
15
13
The usage of this cheatcode should be extremely limited, well documented, and only reserved for cases where there is not a secure alternative.
16
14
17
-
18
15
## Pre-requisites
19
16
20
17
If reading the previous section didn't scare you enough and you still want to use `ffi`, you will need to explicitly tell Echidna to allow the cheatcode in the tests. This safety measure makes sure you don't accidentally execute `ffi` code.
21
18
22
-
To enable the cheatcode, set the 'allowFFI`flag to`true` in your Echidna configuration file:
19
+
To enable the cheatcode, set the 'allowFFI`flag to`true` in your Echidna configuration file:
23
20
24
21
```yaml
25
22
allowFFI: true
26
23
```
27
24
28
-
29
25
## Uses
30
26
31
27
Some of the use cases for `ffi` are:
32
28
33
-
* Making prices or other information available on-chain during a fuzzing campaign. For example, you can use `ffi` to feed an oracle with "live" data.
34
-
* Get randomness in a test. As you know, there is no randomness source on-chain, so using this cheatcode you can get a random value from the device running the fuzz tests.
35
-
* Integrate with algorithms not ported to Solidity language, or perform comparisons between two implementations. Some examples for this item include signing and hashing, or custom calculations algorithms.
36
-
29
+
- Making prices or other information available on-chain during a fuzzing campaign. For example, you can use `ffi` to feed an oracle with "live" data.
30
+
- Get randomness in a test. As you know, there is no randomness source on-chain, so using this cheatcode you can get a random value from the device running the fuzz tests.
31
+
- Integrate with algorithms not ported to Solidity language, or perform comparisons between two implementations. Some examples for this item include signing and hashing, or custom calculations algorithms.
37
32
38
33
## Example: Call an off-chain program and read its output
You can test this program with various inputs and see what the output is. If it works correctly, the program should output a 512-bit hex string that is the ABI-encoded representation of a 256-bit integer followed by a bytes32.
71
66
72
-
Now let's create the Solidity contract that will be run by Echidna to interact with the previous script.
67
+
Now let's create the Solidity contract that will be run by Echidna to interact with the previous script.
0 commit comments