llvm-context: disable call re-entrancy for send and transfer (#196)

crates/llvm-context/src/polkavm/evm/call.rs

@@ -8,6 +8,7 @@ use crate::polkavm::Dependency;
 
 const STATIC_CALL_FLAG: u32 = 0b0001_0000;
 const REENTRANT_CALL_FLAG: u32 = 0b0000_1000;
+const SOLIDITY_TRANSFER_GAS_STIPEND_THRESHOLD: u64 = 2300;
 
 /// Translates a contract call.
 #[allow(clippy::too_many_arguments)]
@@ -37,26 +38,24 @@ where
     let output_offset = context.safe_truncate_int_to_xlen(output_offset)?;
     let output_length = context.safe_truncate_int_to_xlen(output_length)?;
 
-    // TODO: What to supply here? Is there a weight to gas?
-    let _gas = context
-        .builder()
-        .build_int_truncate(gas, context.integer_type(64), "gas")?;
-
     let input_pointer = context.build_heap_gep(input_offset, input_length)?;
     let output_pointer = context.build_heap_gep(output_offset, output_length)?;
 
     let output_length_pointer = context.build_alloca_at_entry(context.xlen_type(), "output_length");
     context.build_store(output_length_pointer, output_length)?;
 
-    let deposit_pointer = context.build_alloca_at_entry(context.word_type(), "deposit_pointer");
-    context.build_store(deposit_pointer, context.word_type().const_all_ones())?;
-
-    let flags = if static_call {
-        REENTRANT_CALL_FLAG | STATIC_CALL_FLAG
+    let (flags, deposit_limit_value) = if static_call {
+        let flags = REENTRANT_CALL_FLAG | STATIC_CALL_FLAG;
+        (
+            context.xlen_type().const_int(flags as u64, false),
+            context.word_type().const_zero(),
+        )
     } else {
-        REENTRANT_CALL_FLAG
+        call_reentrancy_heuristic(context, gas, input_length, output_length)?
     };
-    let flags = context.xlen_type().const_int(flags as u64, false);
+
+    let deposit_pointer = context.build_alloca_at_entry(context.word_type(), "deposit_pointer");
+    context.build_store(deposit_pointer, deposit_limit_value)?;
 
     let flags_and_callee = revive_runtime_api::calling_convention::pack_hi_lo_reg(
         context.builder(),
@@ -119,7 +118,7 @@ where
 #[allow(clippy::too_many_arguments)]
 pub fn delegate_call<'ctx, D>(
     context: &mut Context<'ctx, D>,
-    gas: inkwell::values::IntValue<'ctx>,
+    _gas: inkwell::values::IntValue<'ctx>,
     address: inkwell::values::IntValue<'ctx>,
     input_offset: inkwell::values::IntValue<'ctx>,
     input_length: inkwell::values::IntValue<'ctx>,
@@ -137,11 +136,6 @@ where
     let output_offset = context.safe_truncate_int_to_xlen(output_offset)?;
     let output_length = context.safe_truncate_int_to_xlen(output_length)?;
 
-    // TODO: What to supply here? Is there a weight to gas?
-    let _gas = context
-        .builder()
-        .build_int_truncate(gas, context.integer_type(64), "gas")?;
-
     let input_pointer = context.build_heap_gep(input_offset, input_length)?;
     let output_pointer = context.build_heap_gep(output_offset, output_length)?;
 
@@ -221,3 +215,86 @@ where
         .resolve_library(path.as_str())?
         .as_basic_value_enum())
 }
+
+/// The Solidity `address.transfer` and `address.send` call detection heuristic.
+///
+/// # Why
+/// This heuristic is an additional security feature to guard against re-entrancy attacks
+/// in case contract authors violate Solidity best practices and use `address.transfer` or
+/// `address.send`.
+/// While contract authors are supposed to never use `address.transfer` or `address.send`,
+/// for a small cost we can be extra defensive about it.
+///
+/// # How
+/// The gas stipend emitted by solc for `transfer` and `send` is not static, thus:
+/// - Dynamically allow re-entrancy only for calls considered not transfer or send.
+/// - Detected balance transfers will supply 0 deposit limit instead of `u256::MAX`.
+///
+/// Calls are considered transfer or send if:
+/// - (Input length | Output lenght) == 0;
+/// - Gas <= 2300;
+///
+/// # Returns
+/// The call flags xlen `IntValue` and the deposit limit word `IntValue`.
+fn call_reentrancy_heuristic<'ctx, D>(
+    context: &mut Context<'ctx, D>,
+    gas: inkwell::values::IntValue<'ctx>,
+    input_length: inkwell::values::IntValue<'ctx>,
+    output_length: inkwell::values::IntValue<'ctx>,
+) -> anyhow::Result<(
+    inkwell::values::IntValue<'ctx>,
+    inkwell::values::IntValue<'ctx>,
+)>
+where
+    D: Dependency + Clone,
+{
+    // Branch-free SSA implementation: First derive the heuristic boolean (int1) value.
+    let input_length_or_output_length =
+        context
+            .builder()
+            .build_or(input_length, output_length, "input_length_or_output_length")?;
+    let is_no_input_no_output = context.builder().build_int_compare(
+        inkwell::IntPredicate::EQ,
+        context.xlen_type().const_zero(),
+        input_length_or_output_length,
+        "is_no_input_no_output",
+    )?;
+    let gas_stipend = context
+        .word_type()
+        .const_int(SOLIDITY_TRANSFER_GAS_STIPEND_THRESHOLD, false);
+    let is_gas_stipend_for_transfer_or_send = context.builder().build_int_compare(
+        inkwell::IntPredicate::ULE,
+        gas,
+        gas_stipend,
+        "is_gas_stipend_for_transfer_or_send",
+    )?;
+    let is_balance_transfer = context.builder().build_and(
+        is_no_input_no_output,
+        is_gas_stipend_for_transfer_or_send,
+        "is_balance_transfer",
+    )?;
+    let is_regular_call = context
+        .builder()
+        .build_not(is_balance_transfer, "is_balance_transfer_inverted")?;
+
+    // Call flag: Left shift the heuristic boolean value.
+    let is_regular_call_xlen = context.builder().build_int_z_extend(
+        is_regular_call,
+        context.xlen_type(),
+        "is_balance_transfer_xlen",
+    )?;
+    let call_flags = context.builder().build_left_shift(
+        is_regular_call_xlen,
+        context.xlen_type().const_int(3, false),
+        "flags",
+    )?;
+
+    // Deposit limit value: Sign-extended the heuristic boolean value.
+    let deposit_limit_value = context.builder().build_int_s_extend(
+        is_regular_call,
+        context.word_type(),
+        "deposit_limit_value",
+    )?;
+
+    Ok((call_flags, deposit_limit_value))
+}