Michal Převrátil - Wake Framework - Swiss Knife to Ethereum Tooling

Transcript

okay all right so hi everyone I'm super excited to be here my name is michaelo I'm the lead developer of security tooling for ethereum at eky blockchain and I'm also an auditor we are an auditing company mainly focusing on projects built on ethereum and salana and except for that we are also open source tooling Builders and wake which this talk is all about is just one of them we work with many well-known projects like for example Lio 1 in axar or safe and we've we've received a grant from coinbase so what is wake first of all wake is a framework it's a framework for

testing so anyone can write a simple unit test testing a simple case like uh a test uh a case from a solid code so anyone can taste that's just like a simple uh one feature of Sol code they can also Al do fuzzing which is like a special technique quite different from unit testing in a way that it generates random data it generates random transactions and it runs those random data and random transactions so each time someone runs the fastest they observe a completely different Behavior because of that randomization they can be also used for integration testing so that anyone can Fork a main net or maybe a test net and

then start with the Fork chain and then deploy their contract to that pre uh Fork chain so they have already predeployment that can detect common issues in the code like V lities or just code quality issues there are also printers that are very similar to detectors but still different and the difference is that they just print anything or extract information about the code so they analyze the code so there's some compilation behind and then there's data extraction and that's the difference from detectors V is also a language server so

that anyone who wants to write and Sol code they need to install an extension for vs code because vs code itself doesn't support solidity and there are many extensions out there tools for solidity is just one of them and bake is used like a back end for the extension for the tools for solidity extension so so tools for solidity is just the front end for for wake and if you wonder which extension for vope is just the best for you you should definitely visit our talk which takes place right here after my to and like the tol is named a Swiss knife to ethereum tooling and I think that the table quite explains why we

call wake a Swiss knife with taken a well-known like I would say tools or maybe Frameworks uh and compare them to W the second one from the right is Foundry I haven't found the logo with with founder text so there's founder there's hardhead there's of course wake there's AP framework slitter and so on and we are comparing the main features like testing I've added fuzzing because I think that fuzzing can be really useful uh detectors language server and if the tool is maintained or not and I think that there's a huge Advantage for developers because they can use just a single tool to do everything so just a single tool to rule

them all but uh vake is written in Python and you may wonder why would you use python in 2024 I would like to give you a few good answers for that first of all machine time is less expensive than the human time so I think let generally true and at the same time the most time spent in development is spent or should be spent on testing and debugging of issues found in in the testing phase and vake has got a pretty nice debugging features and this is given by the fact that V is written in Python and python itself is a very good like tool or language for debugging there's an interactive

debugger so anyone can just stop in at any line of the testing code in Python and then interact with the any variable or anything and I think this is like a huge Advantage there's the console look support So anyone can just insert console locks into solid the code uh recompile the project and then see those locks like in the terminal so anyone can debug even the solid code itself and there are very very nice C traces I've got an example on the next slide so let's move to the next slide and this is an example of a c Trace so this is a call to a function called execute vote it's an example from the

Lio project which actually forked from Aragon and we are calling that function we are calling it through a proxy and as you can see V has uh properly detected that we are calling that through a fallback function there's a status next to each call Trace which says if the call like failed or succeeded if it failed there's like an error that better res Skypes why uh the call like failed so it's right here and there are also like names of the functions and names of the parameters and so on and I think this can be pretty useful when debugging an issue in the code and this is another example let's

say we are debugging some project and our test failed on a reverting transaction and we need to debu that re reverting transaction so we can print anything about some data in in the project like a vote we are voting in a project we can print the address of a voter like here the address of a delegate because a delegate votes for a vot for a voter we can print that error that occured in the transaction and we can print the cold trace for a transaction and I think this is really really useful when you don't know why your fail why your test failed so yeah there's the C TR and then we can just check that the L of a voter was zero and this is the reason why the transaction

failed so yeah so I think this is a very nice example of an interactive debugger which is built into wake as I said human time is more expensive than the machine time but when it comes to execution times it is also very efficient we took the Unis Swope V3 core project it already contains tests written in hardhead we took those tests as a reference and Rewritten 271 tests into w a framework into wake framework and into Browning framework and we run those tests and measured the complete time for all the tests and the results results are in the table so as

you can see vake is pretty fast it managed to run all those 271 tests in less than 4 seconds which is in my opinion amazing another reason for using vake is differential testing or python in general is just differential testing let's say that you are building like a very complex project that involves math and you cannot follow the math directly in the solity code and the reason for that is that it would be super expensive like super gas expensive in this example there's a formula that it's used to compute some floating interest it's not

that important but exactly it computes but it's needed to multiply M multiply multiple different uh exponential values and that cannot be done in every transaction because it would be very expensive so the project we were auditing which is called ipor uh took a quite different approach it does the same but in a different way also there's some value computed and there's Division and our advantage in Python is that we can use floating Point numbers so we can just use floating points we can compute uh the value just follow by following the formula and then we can compare that value computed to the value that is in the contract and contract and see the

difference if it's huge or if it's okay for us and this is the power of differential testing VAB hex this is an example like an incomplete table of all findings that were found using vake it was found using fuzzing using differential testing and there are quite high or critical vulnerabilities and also projects that are well known like Brahma which is a very nice project built on safe or for example slid I believe many of you know slid there's also Axel which is like cross-chain solution for interchain transfers between multiple chains or for example IO but there's more in the testing framework module V supports fuzzing as I

said it's a useful technique when we Generate random data we Generate random sequences of transactions we run those tests again again and we are trying to find some issues in the code and there's a workshop that t takes place today don't worry there's a QR code at the end of the presentation so you will be able to scan the QR code and seal all of our talks and workshops so you won't miss anything there's also Fork testing support So anyone can Fork the main net the test net with pre-deployed contract and then deploy their own contract that interact with those pepoy and there's nice feature which is ether scan integration and it means that when interacting with those pepoy contract and printing call traces the names of

those pepoy contracts and the functions and everything will be just resolved because of the ether scan support so they can automat automatically fetch the source code from ether scan and show the names of the predeployment support so the tests can be run in coverage analysis mode and then the coverage can be like analyzed in vsod right directly in vs code you can see the lines that were covered using the testing there's cross chain testing support that was heavily inspired by axar we needed to test a project that uses cross chain transfers and there's a support for multiple chains in the testing module and I think this is quite unique like not every framework supports

cross-chain testing there's also the possibility of reproducing the test using random seat random seats this is especially useful in fuzzing when we need to Generate random data and we need to reproduce that issue that we've discovered again and again and this is possible thanks to random seeds so anyone can just use the same random seat and observe the same behavior in testing and then there's also parallel execution so anyone can run just a single test multiple times or maybe different tests and this is especially useful again with fuzzing so that uh anyone can just generate multiple random seats and then La launch them in parallel so it like executes multiple

transactions at the same time at multiple CPU cores there's also the static analysis framework and I think the main feature here is detectors so we've decided to take quite a different approach from other static analysis tools by the way if you don't use any static analysis tool I really recommend using one because it can be super useful to detect like early bugs in the code but we've decided to take a quite different approach and we've tried we've decided to like make like make better quality of the detectors over quantity based on our analysis around 20% of detectors in slitter are for outdated versions of solidity or they

are already covered by SOC which means that solid compiler already like reports the issues in the code there's also the user experience page and we are trying to make the best user experience as possible so there's an GitHub exchange integration so anyone can just like push the code to GitHub and those W detectors can be automatically run and the detections can can be seen in GitHub UI and if you're pushing to different branches then you won't have duplicates in that UI because they are merged thanks to the GitHub integration also if you're using an extension called to for solidity which uses vake in the background the detections are

automatically highlighted in the code so it's pretty easy to find them to debug them and so on and they are automatically reloaded so whenever typing some cod in solidity those detections are re reloaded which is pretty nice it's not needed to click on something or something like that so it's it's straight for straightforward very easy and there are also commments so we are trying to achieve the best best precision as we can but still there may be some false positives and it's possible to ignore those false positives thanks to commments that can be added to the code there's of course an API for creating custom detectors so anyone can create like single propose or maybe General detectors that can be used anywhere with solid de code I've got a

very nice example here so this is an example of a detection on the command line and as you can see there's a relative path to the dediction actually if the terminal supports a future like uh links then anyone can just control click on this path and it will open vs code just with this line of the code so it's possible to more inspect the single detection I think it's very nice there there's also the severity of the issue and the confidence of that issue and of course the label or like the title that describes that issue so I think this is a very nice user experience and this is another example and this is like from the programmer's

perspective so let's say that we have some project that follows some invariance I would say so that we have some unsafe functions and they should always have the only only modifier so we want to detect if really all the functions use these use the only only modifier so this is like the only code that has to be different from a template so if we want to detect these issues like that only owner is not used in unsa functions we just needs to type this it's super easy I would say so we need a a function definition visit function so this no this Noe contains information about a single function in the code we

can check the name of the function we can convert it to lowercase so we've got the lowercase name of the function we can check if unsafe is in the name of the function and then we probably want to check the visibility so if the visibility is public or external and if it's so then we check all the modifiers that are attached to that single function and if there's none that would have have the name only owner then we have found an unsa function that doesn't have the only owner modifier so I think this is very easy very nice example of detectors there are also printers that are used for source code instruction so

the API is basically the same it follows the same logic as detectors but it can be used for data extraction and not for detecting some issues and what can be extracted from the code perhaps graphs like inheritance graph like like control flow graphs like cross reference graphs things like that it can also be an AI of a contract it can be a storage layout it can be some interesting statistic like numbers for for example lines of code number of functions things like that and there's also a language server integration and I'd like to see I i' would like to explain that on uh on an image on an animation and of course there's there's an API for creating

custom printers this is an example of a storage layout printer which shows how really nice can the printers be it's very user like the user experience is really nice I would say and it shows us storage layout of a single contract and yeah it's basically the storage layout and this is an example of a custom printer and as you can see the logic is almost the same like it follows the same principles in a way that we Define a visit function this time we want to visit a contract definition because our goal is to print all public and external functions includ including those inherited inherited ones in a contract

so we've got a contract a single presentation of a contract we can iterate over all base contracts then over each function in the contract then we can check out the selector of a function that should be somehow unique and then we can just check if we've seen the selector or if the selector actually exists if SE if we've seen that selector if the function is implemented and if the visibility is public or external and we can just print the name of the function and this is that example of vs code printers and it does the same in that it shows all the public and external functions but the the presentation is quite different so we won't print

anything to the terminal as a text but instead we can just show the names of the functions right in VSC and anyone can click on those references and go straight to the references of the public and external functions and this is the feature that we have released just yesterday for ethereum tri and there's a workshop that shows how to create your own clickable buttons that do something and you can just scan the QR code which is right on the next slide so you can visit all our talks and workshops and that's pretty much it thank you for your attention [Applause]

I uh thank you for the presentation um I maybe I don't maybe I might have missed but is there a local test net uh test net node uh during uh the development in the W frame yeah you can use a development chain we are using anvil in most cases because wake is highly optimized for Anvil so it's highly recommended to use Anvil which is the part of founder project and that's basically the best Note like a development chain that can be used for testing and if you need Fork testing that you would Fork a m net or a test net then you can use any note but there's no like bundled in in vake you can use any any note you you want to any other questions I did that answer

for your question okay perfect anyone else have a question from the audience no all right then please give another big round of applause to Michael [Applause]