foreign
[Music]
welcome to this lightning talk about the
unspecified evaluation order in solidity
or how our colleague Tina and Richard
who unfortunately couldn't make it to
Bogota won the underhanded solidity
contest the goal of the underhanded
solidity contest is to provide harmless
or unsuspicious looking smart contracts
with hidden bugs or pitfalls thereby
exposing weird behavior and solidity in
a fun way let's Jump Right In here's an
excerpt from the solidity docs what it's
basically saying is the evaluation the
evaluation order of Expressions is not
specified IF function f takes two
arguments which are further function
calls to functions G and H it's unclear
in which order they are evaluated
I don't function G is a related first or
function H is evaluated first but we can
never be sure which one obviously
function f is evaluated last because it
depends on the result of the other
functions let's consider this example
what let's say we call a function with
an argument of two what's the correct
result here
is it four or five
well it depends on the evaluation order
and it's not really specified for the
solidity compiler
this is not unique to solidity
insufficient specification to of
expected Behavior can be found in all
kinds of different programming languages
a big headache for everyone involved
does this matter in practice yes of
course it does as it can lead to
unexpected Behavior results by analyzing
the code generator of the solidity
compiler our collecting and found three
cases of unusual evaluation orders which
this talk is about yes most of the time
evaluation order is as expected from
Left of right but not always first two
examples are the opcodes add mode and
mule mode and here the evaluation order
surprisingly is from right to left so if
we evaluate F of 2 it first evaluates
a incremented by one and only later
evaluates the first argument which
results in add mode with argument three
two
instead of
2 2 as you might have expected
interestingly this is actually
documented in the solidity however not
where you expect in solidity there are
currently two ways on how code can be
compiled the default code generation and
the new code generation via the UL IR
pipeline in in the documentation
describing the Euro pipeline it's
actually documented that here the
evaluation order will no longer be from
right to left but also left right the
most interesting one is the order of
evaluation inside events this one is
really special
the parameters are evaluated in a
bizarre order
first the indexed parameters are
evaluated from right to left then the
remaining parameters are evaluated from
left to right wow who knew that
with solidity death has this in mind
when coding no one right
this can lead to really strange or
unexpected Behavior
and this is what tenen leveraged and
used for his submission to the
underhanded solidity contest 2022
he wrote a simple decentralized exchange
where liquidity providers and the admin
shared the collected fees in a
legitimate tax the admin shouldn't be
able to screw over the liquidity
providers by changing the fees
afterwards this is the heart of tenant
submission looks legit right
what's wrong here let's see
so the admin calls functions change
admin fees once he wants to update the
fee it looks like function retire old
admin fee is called first which execute
claim fee this by and distributes the
fees based on the old fee amount to the
liquidity provider before calling set
new admin fee which updates the admin
fee to the new admin fee but remember
what we just learned before indexed
events are evaluated from right to left
so actually set admin fees evaluated
first so the fee is updated and only
afterwards retire old admin fee
distribute the liquidity fee to the
liquidity liquidity providers based on
the new fee really surprising
so one important thing to mention here
the solidity compiler as that has two
ways to compile code the default way and
the new way using the Yule IR pipeline
in the Yule IR pipeline this is no
longer true they are the function
evaluation order is strictly from left
to right however by default the solidity
compiler uses the old code generation
but this may change at any time in the
future
thanks a lot happy to take any question
one minute left
foreign