mirror of
https://github.com/pezkuwichain/revive.git
synced 2026-10-21 03:06:17 +00:00
98d818f958
This PR introduces powerful code size optimizations. This is achieved with an additional IR layer in between Yul and LLVM IR. It works quite well (see below for a comparison) because it captures optimization gains that neither solc nor LLVM can realize. The feature is gated behind `--newyork` or a corresponding standard JSON input setting and **off by default**. ### How it works We implemented an SSA IR modelled after or inspired by the [MLIR SCF dialect](https://mlir.llvm.org/docs/Dialects/SCFDialect/). Yul is translated into this IR and the IR implements mainly the following optimizations: - **Type narrowing**: narrows 256-bit values to I1..I160 where provable (bidirectional + interprocedural), so LLVM emits native 32/64-bit ops instead of software 256-bit arithmetic. - **FMP range proof**: exposes the `mload(0x40) < heap_size` bound to LLVM IPSCCP, eliminating trailing overflow checks on FMP-derived offsets. Single largest code-size contributor. - **Heap analysis**: skips big-endian byte-swaps where native little-endian layout is safe. - **mem_opt / keccak fusion+folding**, **compound outlining** (mapping sload/sstore), **guard narrowing**, **inlining** tuned for PolkaVM, and **exact + fuzzy function dedup**. ### Results The optimizations implemented with the newyork IR bring substantial code size improvements. - Integration contracts: approximately **-20% to -50%** code size. - OpenZeppelin Wizard corpus: around **-47%** code size. This table shows the code size improvements on various OpenZeppelin ERC implementations, taken from their [contracts wizard](https://wizard.openzeppelin.com/), with almost all features enabled. | Contract | Default: (bytes) | With `--newyork`: (bytes) | Reduction | |---|---:|---:|---:| | erc1155 | 59,206 | 30,649 | -48.2% | | erc20 | 81,697 | 42,893 | -47.5% | | erc721 | 92,052 | 49,423 | -46.3% | | oz_gov | 141,861 | 81,159 | -42.8% | | oz_rwa | 77,274 | 37,975 | -50.9% | | oz_simple_erc20 | 29,950 | 16,554 | -44.7% | | oz_stable | 82,117 | 39,032 | -52.5% | | **Total** | **564,157** | **297,685** | **-47.2%** | We believe this to be a reasonably representative dataset and conclude that the newyork IR achieves drastic code size reductions on real world dApp implementations. ### Methodology, security and runtime performance Since the main contributors to these improvements are the FMP range proofs and the type narrowing, we don't expect big runtime performance regressions (it may even benefit runtime performance in some cases). The PR also includes docs (`book/src/developer_guide/newyork_{optimizer,ir}.md`) and many new integration tests, including regression tests for known FMP soundness traps. The PR was authored collaboratively and reviewed extensively by the `revive` maintainers, as well as Claude Opus, Claude Fable, Qwen, Minimax and Deepseek LLMs, over a span of many months. The `newyork` compiler pipeline introduces no new regressions over our integration and differential test suites (containing over 30000 test cases). This was achieved by careful manual reviews and many LLM bughunt loops. Additionally, a final security review by Anthropic's Fable 5 LLM found no remaining soundness issues. Nonetheless, like any brand new software, please consider this an experimental feature upon release. --------- Signed-off-by: xermicus <bigcyrill@hotmail.com> Signed-off-by: xermicus <cyrill@parity.io> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: neo <me@90f9.org> Co-authored-by: LJ <81748770+elle-j@users.noreply.github.com>
67 lines
2.5 KiB
Plaintext
67 lines
2.5 KiB
Plaintext
/// Soundness PoC: newyork's fuzzy function deduplication
|
|
/// (`simplify.rs::deduplicate_functions_fuzzy`) abstracts `switch` case
|
|
/// match values into parameterizable literal positions
|
|
/// (`fuzzy_encode_statement` emits a placeholder per case value), so two
|
|
/// functions that are structurally identical *except for their switch case
|
|
/// match values* hash to the same fuzzy form and are merged.
|
|
///
|
|
/// However `replace_literals_with_params` advances the literal counter for
|
|
/// each switch case but NEVER substitutes `case.value`. The merged canonical
|
|
/// function therefore keeps ITS OWN case values; the removed function's call
|
|
/// sites are redirected to the canonical function with the (now ignored)
|
|
/// differing values appended as dead extra arguments.
|
|
///
|
|
/// Result: `g`'s callers silently execute `f`'s switch dispatch. `g(111)`
|
|
/// should hit `g`'s `case 111` and return 1111, but after the merge it falls
|
|
/// through to the default of `f` (whose cases are 100/200/300) and returns
|
|
/// the default value. EVM (and unoptimized semantics) returns 1111.
|
|
object "FuzzySwitchBug" {
|
|
code {
|
|
let size := datasize("FuzzySwitchBug_deployed")
|
|
codecopy(0, dataoffset("FuzzySwitchBug_deployed"), size)
|
|
return(0, size)
|
|
}
|
|
object "FuzzySwitchBug_deployed" {
|
|
code {
|
|
let sel := calldataload(0)
|
|
let x := calldataload(32)
|
|
let r := 0
|
|
switch sel
|
|
case 0 { r := f(x) }
|
|
case 1 { r := f(x) }
|
|
case 2 { r := g(x) }
|
|
case 3 { r := g(x) }
|
|
default { r := 0 }
|
|
mstore(0, r)
|
|
return(0, 32)
|
|
|
|
function f(a) -> out {
|
|
let t := add(a, 1)
|
|
t := mul(t, 2)
|
|
t := add(t, 3)
|
|
t := xor(t, 4)
|
|
t := add(t, 5)
|
|
out := 0
|
|
switch a
|
|
case 100 { out := add(t, 1000) }
|
|
case 200 { out := add(t, 2000) }
|
|
case 300 { out := add(t, 3000) }
|
|
default { out := 9999 }
|
|
}
|
|
function g(a) -> out {
|
|
let t := add(a, 1)
|
|
t := mul(t, 2)
|
|
t := add(t, 3)
|
|
t := xor(t, 4)
|
|
t := add(t, 5)
|
|
out := 0
|
|
switch a
|
|
case 111 { out := add(t, 1000) }
|
|
case 222 { out := add(t, 2000) }
|
|
case 333 { out := add(t, 3000) }
|
|
default { out := 9999 }
|
|
}
|
|
}
|
|
}
|
|
}
|