Skip to content

latest block used for remote fuzzing instead of -b parameter #5

@zjuchenyuan

Description

@zjuchenyuan

When I use your example for remote fuzzing, I found it will use latest block to call eth_getStorageAt, instead of the -b 5752250 parameter.

the output log

eth_getCode
   > {
   >   "jsonrpc": "2.0",
   >   "method": "eth_getCode",
   >   "params": [
   >     "0x7Dc4f41294697a7903C4027f6Ac528C5d14cd7eB",
   >     "latest"
   >   ],
   >   "id": 0
   > }
 <   {
 <     "id": 0,
 <     "jsonrpc": "2.0",
 <     "result": "0x606060405236156100ee5763ffffffff7c010000000000000000000000000000000000000000000000000000000060003504166306fdde0381146100f0578063095ea7b31461018057806318160ddd146101b357806323b872dd146101d5578063313ce5671461020e5780635353a2d81461023457806370a082311461028c57806379c65068146102ba5780638da5cb5b146102db57806395d89b4114610307578063a3895fff14610397578063a9059cbb146103ef578063b414d4b614610422578063c112dfa314610452578063dd62ed3e1461046a578063e724529c1461049e578063f2fde38b146104c1575bfe5b34156100f857fe5b6101006104df565b604080516020808252835181830152835191928392908301918501908083838215610146575b80518252602083111561014657601f199092019160209182019101610126565b505050905090810190601f1680156101725780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b341561018857fe5b61019f600160a060020a036004351660243561056c565b604080519115158252519081900360200190f35b34156101bb57fe5b6101c36105d7565b60408051918252519081900360200190f35b34156101dd57fe5b61019f600160a060020a03600435811690602435166044356105dd565b604080519115158252519081900360200190f35b341561021657fe5b61021e610708565b6040805160ff9092168252519081900360200190f35b341561023c57fe5b61028a600480803590602001908201803590602001908080601f0160208091040260200160405190810160405280939291908181526020018383808284375094965061071195505050505050565b005b341561029457fe5b6101c3600160a060020a0360043516610746565b60408051918252519081900360200190f35b34156102c257fe5b61028a600160a060020a0360043516602435610765565b005b34156102e357fe5b6102eb610809565b60408051600160a060020a039092168252519081900360200190f35b341561030f57fe5b610100610818565b604080516020808252835181830152835191928392908301918501908083838215610146575b80518252602083111561014657601f199092019160209182019101610126565b505050905090810190601f1680156101725780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b341561039f57fe5b61028a600480803590602001908201803590602001908080601f016020809104026020016040519081016040528093929190818152602001838380828437509496506108a395505050505050565b005b34156103f757fe5b61019f600160a060020a03600435166024356108d8565b604080519115158252519081900360200190f35b341561042a57fe5b61019f600160a060020a03600435166109b3565b604080519115158252519081900360200190f35b341561045a57fe5b61028a60ff600435166109c8565b005b341561047257fe5b6101c3600160a060020a03600435811690602435166109f8565b60408051918252519081900360200190f35b34156104a657fe5b61028a600160a060020a03600435166024351515610a25565b005b34156104c957fe5b61028a600160a060020a0360043516610aa7565b005b60018054604080516020600284861615610100026000190190941693909304601f810184900484028201840190925281815292918301828280156105645780601f1061053957610100808354040283529160200191610564565b820191906000526020600020905b81548152906001019060200180831161054757829003601f168201915b505050505081565b600160a060020a03338116600081815260076020908152604080832094871680845294825280832086905580518681529051929493927f8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925929181900390910190a35060015b92915050565b60045481565b600160a060020a03331660009081526006602052604081205460ff161561060657506000610701565b600160a060020a0384166000908152600560205260409020548290101561062f57506000610701565b600160a060020a038085166000908152600760209081526040808320339094168352929052205482901061066557506000610701565b600160a060020a038316600090815260056020526040902054828101101561068f57506000610701565b600160a060020a0380851660008181526005602081815260408084208054899003905560078252808420338716855282528084208054899003905594881680845291815291849020805487019055835186815293519093600080516020610b9183398151915292908290030190a35060015b9392505050565b60035460ff1681565b60005433600160a060020a0390811691161461072d5760006000fd5b8051610740906001906020840190610af0565b505b5b50565b600160a060020a0381166000908152600560205260409020545b919050565b60005433600160a060020a039081169116146107815760006000fd5b600160a060020a0380831660009081526005602090815260408083208054860190556004805486019055825481518681529151941693600080516020610b91833981519152929181900390910190a3600054604080518381529051600160a060020a03808616931691600080516020610b91833981519152919081900360200190a35b5b5050565b600054600160a060020a031681565b6002805460408051602060018416156101000260001901909316849004601f810184900484028201840190925281815292918301828280156105645780601f1061053957610100808354040283529160200191610564565b820191906000526020600020905b81548152906001019060200180831161054757829003601f168201915b505050505081565b60005433600160a060020a039081169116146108bf5760006000fd5b8051610740906002906020840190610af0565b505b5b50565b600160a060020a03331660009081526006602052604081205460ff1615610901575060006105d1565b600160a060020a0333166000908152600560205260409020548290101561092a575060006105d1565b600160a060020a0383166000908152600560205260409020548281011015610954575060006105d1565b600160a060020a0333811660008181526005602090815260408083208054889003905593871680835291849020805487019055835186815293519193600080516020610b91833981519152929081900390910190a35060015b92915050565b60066020526000908152604090205460ff1681565b60005433600160a060020a039081169116146109e45760006000fd5b6003805460ff191660ff83161790555b5b50565b600160a060020a038083166000908152600760209081526040808320938516835292905220545b92915050565b60005433600160a060020a03908116911614610a415760006000fd5b600160a060020a038216600081815260066020908152604091829020805460ff191685151590811790915582519384529083015280517f48335238b4855f35377ed80f164e8c6f3c366e54ac00b96a6402d4a9814a03a59281900390910190a15b5b5050565b60005433600160a060020a03908116911614610ac35760006000fd5b6000805473ffffffffffffffffffffffffffffffffffffffff1916600160a060020a0383161790555b5b50565b828054600181600116156101000203166002900490600052602060002090601f016020900481019282601f10610b3157805160ff1916838001178555610b5e565b82800160010185558215610b5e579182015b82811115610b5e578251825591602001919060010190610b43565b5b50610b6b929150610b6f565b5090565b610b8d91905b80821115610b6b5760008155600101610b75565b5090565b905600ddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3efa165627a7a723058206207b73e7941c1dd2b7939144dac73f605db1c23379631ede33b0d6246ccf0e60029"
 <   }
eth_getTransactionCount
   > {
   >   "jsonrpc": "2.0",
   >   "method": "eth_getTransactionCount",
   >   "params": [
   >     "0x7Dc4f41294697a7903C4027f6Ac528C5d14cd7eB",
   >     "latest"
   >   ],
   >   "id": 1
   > }
 <   {
 <     "id": 1,
 <     "jsonrpc": "2.0",
 <     "result": "0x1"
 <   }
eth_getBalance
   > {
   >   "jsonrpc": "2.0",
   >   "method": "eth_getBalance",
   >   "params": [
   >     "0x7Dc4f41294697a7903C4027f6Ac528C5d14cd7eB",
   >     "latest"
   >   ],
   >   "id": 2
   > }
 <   {
 <     "id": 2,
 <     "jsonrpc": "2.0",
 <     "result": "0x0"
 <   }
eth_getStorageAt
   > {
   >   "jsonrpc": "2.0",
   >   "method": "eth_getStorageAt",
   >   "params": [
   >     "0x7Dc4f41294697a7903C4027f6Ac528C5d14cd7eB",
   >     "0x0",
   >     "latest"
   >   ],
   >   "id": 3
   > }
 <   {
 <     "id": 3,
 <     "jsonrpc": "2.0",
 <     "result": "0x0cb899da7d25dad39b63c500fff8ac4f85ad3fc3"
 <   }

steps to reproduce

Here I use ganache-cli to see the network requests, and I use moralis archive node to fetch eth history state.

# ganache-cli -f "https://speedy-nodes-nyc.moralis.io/<MORALIS_ID>/eth/mainnet/archive" \
    -l 100000000 -g 5000000000  -h 0.0.0.0 -v

# python3 fuzzer/main.py -a examples/RemiCoin/abi.json \
    -c 0x7dc4f41294697a7903c4027f6ac528c5d14cd7eb -b 5752250 --evm byzantium \
    -g 20 --rpc-host 127.0.0.1 --rpc-port 8545

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions