evm: add reachable code/opcodes verification eof

packages/evm/src/eof/errors.ts

@@ -58,6 +58,8 @@ export enum EOFError {
   InvalidJUMPF = 'invalid jumpf target (output count)',
   InvalidReturningSection = 'invalid returning code section: section is not returning',
   RJUMPVTableSize0 = 'invalid RJUMPV: table size 0',
+  UnreachableCodeSections = 'unreachable code sections',
+  UnreachableCode = 'unreachable code (by forward jumps)',
 }
 
 export enum SimpleErrors {

packages/evm/src/eof/stackDelta.ts

@@ -4,9 +4,10 @@ export const stackDelta: {
     outputs: number
     name: string
     intermediates: number
+    terminating?: boolean
   }
 } = {
-  0x00: { inputs: 0, outputs: 0, name: 'STOP', intermediates: 0 },
+  0x00: { inputs: 0, outputs: 0, name: 'STOP', intermediates: 0, terminating: true },
   0x01: { inputs: 2, outputs: 1, name: 'ADD', intermediates: 0 },
   0x02: { inputs: 2, outputs: 1, name: 'MUL', intermediates: 0 },
   0x03: { inputs: 2, outputs: 1, name: 'SUB', intermediates: 0 },
@@ -144,20 +145,20 @@ export const stackDelta: {
   0xe1: { inputs: 1, outputs: 0, name: 'RJUMPI', intermediates: 2 },
   0xe2: { inputs: 1, outputs: 0, name: 'RJUMPV', intermediates: 1 },
   0xe3: { inputs: 0, outputs: 0, name: 'CALLF', intermediates: 2 },
-  0xe4: { inputs: 0, outputs: 0, name: 'RETF', intermediates: 0 },
-  0xe5: { inputs: 0, outputs: 0, name: 'JUMPF', intermediates: 2 },
+  0xe4: { inputs: 0, outputs: 0, name: 'RETF', intermediates: 0, terminating: true },
+  0xe5: { inputs: 0, outputs: 0, name: 'JUMPF', intermediates: 2, terminating: true },
   0xe6: { inputs: 0, outputs: 1, name: 'DUPN', intermediates: 1 },
   0xe7: { inputs: 0, outputs: 0, name: 'SWAPN', intermediates: 1 },
   0xe8: { inputs: 0, outputs: 0, name: 'EXCHANGE', intermediates: 1 },
   0xec: { inputs: 4, outputs: 1, name: 'EOFCREATE', intermediates: 1 },
-  0xee: { inputs: 2, outputs: 1, name: 'RETURNCONTRACT', intermediates: 1 },
-  0xf3: { inputs: 2, outputs: 0, name: 'RETURN', intermediates: 0 },
+  0xee: { inputs: 2, outputs: 1, name: 'RETURNCONTRACT', intermediates: 1, terminating: true },
+  0xf3: { inputs: 2, outputs: 0, name: 'RETURN', intermediates: 0, terminating: true },
   0xf7: { inputs: 1, outputs: 1, name: 'RETURNDATALOAD', intermediates: 0 },
   0xf8: { inputs: 4, outputs: 1, name: 'EXTCALL', intermediates: 0 },
   0xf9: { inputs: 3, outputs: 1, name: 'EXTDELEGATECALL', intermediates: 0 },
   0xfb: { inputs: 3, outputs: 1, name: 'EXTSTATICCALL', intermediates: 0 },
-  0xfd: { inputs: 2, outputs: 0, name: 'REVERT', intermediates: 0 },
-  0xfe: { inputs: 0, outputs: 0, name: 'INVALID', intermediates: 0 },
+  0xfd: { inputs: 2, outputs: 0, name: 'REVERT', intermediates: 0, terminating: true },
+  0xfe: { inputs: 0, outputs: 0, name: 'INVALID', intermediates: 0, terminating: true },
 }
 
 /*

packages/evm/src/eof/verify.ts

@@ -102,16 +102,29 @@ function validateOpcodes(container: EOFContainer, evm: EVM) {
 
   const validJumps = new Set<number>()
 
+  // Add all reachable code sections to
+  const reachableSections: { [key: number]: Set<number> } = {}
+
   let codeSection = -1
   for (const code of container.body.codeSections) {
     codeSection++
 
+    reachableSections[codeSection] = new Set()
+
     const returningFunction = container.body.typeSections[codeSection].outputs === 0x80
 
+    // Tracking set of reachable opcodes
+    const reachableOpcodes = new Set<number>()
+    reachableOpcodes.add(0)
+
     // Validate that each opcode is defined
     let ptr = 0
     let lastOpcode: number = 0 // Note: code sections cannot be empty, so this number will always be set
+
     while (ptr < code.length) {
+      if (!reachableOpcodes.has(ptr)) {
+        validationError(EOFError.UnreachableCode)
+      }
       validJumps.add(ptr)
       const opcode = code[ptr]
 
@@ -131,6 +144,16 @@ function validateOpcodes(container: EOFContainer, evm: EVM) {
           validationError(EOFError.InvalidRJUMP)
         }
         addJump(target)
+        reachableOpcodes.add(target)
+
+        if (opcode === 0xe0) {
+          // For RJUMP check that the instruction after RJUMP is reachable
+          // If this is not the case, then it is not yet targeted by a forward jump
+          // And hence violates the spec
+          if (!reachableOpcodes.has(ptr + 3)) {
+            validationError(EOFError.UnreachableCode)
+          }
+        }
       } else if (opcode === 0xe2) {
         // RJUMPV
         const tableSize = code[ptr + 1] + 1
@@ -158,13 +181,15 @@ function validateOpcodes(container: EOFContainer, evm: EVM) {
             validationError(EOFError.OpcodeIntermediatesOOB)
           }
           addJump(target)
+          reachableOpcodes.add(target)
         }
 
         // Special case for RJUMPV: move ptr over the table (the immediate starting byte will be added later)
         ptr += 2 * tableSize
       } else if (opcode === 0xe3 || opcode === 0xe5) {
         // CALLF / JUMPF
         const target = readUint16(code, ptr + 1)
+        reachableSections[codeSection].add(target)
         if (target >= container.header.codeSizes.length) {
           validationError(EOFError.InvalidCallTarget)
         }
@@ -207,13 +232,38 @@ function validateOpcodes(container: EOFContainer, evm: EVM) {
         validationError(EOFError.OpcodeIntermediatesOOB)
       }
       ptr++ // Move to next opcode
+      if (stackDelta[opcode].terminating === undefined) {
+        // If the opcode is not terminating we can add the next opcode to the reachable opcodes
+        // It can be reached by sequential instruction flow
+        reachableOpcodes.add(ptr)
+      }
     }
 
     // Validate that the final opcode terminates
     if (!terminatingOpcodes.has(lastOpcode)) {
       validationError(EOFError.InvalidTerminator)
     }
   }
+
+  // Verify that each code section can be reached from code section 0
+  const sectionAccumulator = new Set<number>()
+  sectionAccumulator.add(0) // 0 is always reachable
+  const toCheck = [0]
+
+  while (toCheck.length > 0) {
+    const checkArray = reachableSections[toCheck.pop()!]
+    for (const checkSection of checkArray) {
+      if (!sectionAccumulator.has(checkSection)) {
+        // Only check the reachable section if
+        sectionAccumulator.add(checkSection)
+        toCheck.push(checkSection)
+      }
+    }
+  }
+
+  if (sectionAccumulator.size !== container.header.codeSizes.length) {
+    validationError(EOFError.UnreachableCodeSections)
+  }
 }
 
 function validateStack(_container: EOFContainer, _evm: EVM) {