Getters are reverting in Fuzz testing #2073

tamermint · 2024-07-22T09:57:48Z

tamermint
Jul 22, 2024

Hey all,

My getters in Invariants.t.sol are reverting. My Invariants.t.sol :

//SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;
//need to ask the question - > which properties will always be true
// What are our invariants?
// 1. Total supply of DSC should be less than total value of collateral
// 2. Getter view functions should never revert -> evergreen invariant

import {StdInvariant} from "forge-std/StdInvariant.sol";
import {Test, console} from "forge-std/Test.sol";
import {DeployDSC} from "../../script/DeployDSC.s.sol";
import {DSCEngine} from "../../src/DSCEngine.sol";
import {DecentralisedStableCoin} from "../../src/DecentralisedStableCoin.sol";
import {HelperConfig} from "../../script/Helperconfig.s.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {Handler} from "./Handler.t.sol";

contract Invariants is StdInvariant, Test {
    DeployDSC deployer;
    DSCEngine dsce;
    DecentralisedStableCoin dsc;
    HelperConfig helper;
    Handler handler;
    address weth;
    address wbtc;

    function setUp() external {
        deployer = new DeployDSC();
        (dsc, dsce, helper) = deployer.run();
        /* targetContract(address(dsce)); */
        handler = new Handler(dsce, dsc); //we first call and initialise the handler to deploy the dscengine and dsc
        targetContract(address(handler)); //we then set the target to the handler contract, which will narrow down the way Std invariant does the tests
        (,, weth, wbtc,) = helper.activeNetworkConfig();
    }

    function invariant_protocolMustHaveMoreValueThanTotalSupply() public view {
        //first get the total collateral value in the protocol
        uint256 totalSupply = dsc.totalSupply();
        uint256 totalWethDeposited = IERC20(weth).balanceOf(address(dsce));
        uint256 totalWbtcDeposited = IERC20(wbtc).balanceOf(address(dsce));

        uint256 wethUsdValue = dsce.getUsdValue(weth, totalWethDeposited);
        uint256 wbtcUsdValue = dsce.getUsdValue(wbtc, totalWbtcDeposited);

        console.log("Total weth: ", weth);
        console.log("Total wbtc: ", wbtc);
        console.log("Total supply: ", totalSupply);
        console.log("Times mint is called: ", handler.timesMintIsCalled());

        assert(wethUsdValue + wbtcUsdValue >= totalSupply);
    }

    function invariants_gettersShouldNeverRevert() public view {
        dsce.getLiquidationBonus();
        dsce.getLiquidationPrecision();
        dsce.getLiquidationThreshold();
        dsce.getMinHealthFactor();
        dsce.getPrecision();
        dsce.getAdditionalFeedPrecision();
    }
}

This is what my logs say :

forge test --mt invariants_gettersShouldNeverRevert -vv  
[⠊] Compiling...
No files changed, compilation skipped

Ran 1 test for test/fuzz/Invariants.t.sol:Invariants
[PASS] invariants_gettersShouldNeverRevert() (runs: 128, calls: 16384, reverts: 16)
Logs:
  Bound result 3891
  Bound result 50331235357612112210372945027
  Bound result 54
  Bound result 701791
  Bound result 511
  Bound result 6407966163352819226981716498019
  Bound result 5664699257285471306676221400016
  Bound result 0
  Bound result 17626118384973473788608995900
  Bound result 0
  Bound result 967
  Bound result 20028955244155045322391713298043
  Bound result 26822966995746437996595346471
  Bound result 28214412150980
  Bound result 0
  Bound result 8120043631690570102850
  Bound result 38529983996322932524183998920
  Bound result 3856632707
  Bound result 0
  Bound result 43890316505963701923075557630
  Bound result 6211888243868514335996870968915
  Bound result 52320671450787176934816396574
  Bound result 0
  Bound result 0
  Bound result 623
  Bound result 3644391120919377474575716959105
  Bound result 0
  Bound result 0
  Bound result 0
  Bound result 0
  Bound result 0
  Bound result 0
  Bound result 464947828064756412689982895
  Bound result 451
  Bound result 78772728340641964717200702721
  Bound result 0
  Bound result 464947828064756412689982895
  Bound result 6078346698600433843615755021
  Bound result 2943463530213169073792553590831
  Bound result 0
  Bound result 758
  Bound result 46741672556842953658183126666
  Bound result 0
  Bound result 3748
  Bound result 0
  Bound result 4
  Bound result 46575391410196876481553646207
  Bound result 4773
  Bound result 1757
  Bound result 745966928568449027947657
  Bound result 0
  Bound result 0
  Bound result 35201290778601377917073922
  Bound result 0
  Bound result 0
  Bound result 1766517061867053783415022732561
  Bound result 31
  Bound result 31913268937762029258374109438826
  Bound result 434
  Bound result 1709887171791166637970876793428
  Bound result 333246
  Bound result 3862
  Bound result 329728081
  Bound result 0
  Bound result 127287
  Bound result 0
  Bound result 411
  Bound result 2597159348
  Bound result 0
  Bound result 0
  Bound result 5708
  Bound result 21285717313282096
  Bound result 1642
  Bound result 0
  Bound result 15722484419411792348615033005
  Bound result 9446679270
  Bound result 3611215967764098937837992186
  Bound result 0
  Bound result 1476
  Bound result 0
  Bound result 0
  Bound result 64810179167557069785997462819
  Bound result 1290
  Bound result 0
  Bound result 1419
  Bound result 132826186442998098376945
  Bound result 5782283102970936382382224171540
  Bound result 0
  Bound result 0
  Bound result 47217842087483561259243233748
  Bound result 0
  Bound result 2057267796471173
  Bound result 25472995672784830072039758
  Bound result 283656
  Bound result 0
  Bound result 4900
  Bound result 11270078331832651851531979501180
  Bound result 4
  Bound result 0
  Bound result 44161281606112635230205011048
  Bound result 1
  Bound result 0
  Bound result 0
  Bound result 0
  Bound result 57916762324458803764267324045
  Bound result 0
  Bound result 19457282382603213443892614823
  Bound result 0
  Bound result 5352
  Bound result 12216593098491501205870487188
  Bound result 8712162405796642963659
  Bound result 6110
  Bound result 49435403568613056413754770185
  Bound result 247426033706425181
  Bound result 0
  Bound result 1233
  Bound result 3114575441
  Bound result 1778
  Bound result 1926929963772309440243132
  Bound result 65599185380735578295525798545
  Bound result 180207753267693768412998079
  Bound result 2231725013054011334918907
  Bound result 0
  Bound result 611739856905229545483505010946
  Bound result 543747
  Bound result 0

Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 5.11s (5.10s CPU time)

Ran 1 test suite in 5.45s (5.11s CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

More logging reveals that the invariant_protocolMustHaveMoreValueThanTotalSupply() is also being tested even though I am not explicitly mentioning this in the testing - is this because the target address is set to the handler and it's calling randomly? Can we restrict? Here is the detailed logging :

...
  [114330] Handler::depositCollateral(115792089237316195423570985008687907853269984665640564039457584007913129639935 [1.157e77], 275678157591424809853640 [2.756e23])
    ├─ [0] console::log("Bound result", 275678157591424809853640 [2.756e23]) [staticcall]
    │   └─ ← [Stop] 
    ├─ [0] VM::startPrank(0x000000000000000000000000000000000000039d)
    │   └─ ← [Return] 
    ├─ [29712] ERC20Mock::mint(0x000000000000000000000000000000000000039d, 275678157591424809853640 [2.756e23])
    │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x000000000000000000000000000000000000039d, value: 275678157591424809853640 [2.756e23])
    │   └─ ← [Stop] 
    ├─ [24739] ERC20Mock::approve(DSCEngine: [0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512], 275678157591424809853640 [2.756e23])
    │   ├─ emit Approval(owner: 0x000000000000000000000000000000000000039d, spender: DSCEngine: [0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512], value: 275678157591424809853640 [2.756e23])
    │   └─ ← [Return] true
    ├─ [41538] DSCEngine::depositCollateral(ERC20Mock: [0xDB8cFf278adCCF9E9b5da745B44E754fC4EE3C76], 275678157591424809853640 [2.756e23])
    │   ├─ emit CollateralDeposited(user: 0x000000000000000000000000000000000000039d, tokens: ERC20Mock: [0xDB8cFf278adCCF9E9b5da745B44E754fC4EE3C76], amount: 275678157591424809853640 [2.756e23])
    │   ├─ [8988] ERC20Mock::transferFrom(0x000000000000000000000000000000000000039d, DSCEngine: [0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512], 275678157591424809853640 [2.756e23])
    │   │   ├─ emit Transfer(from: 0x000000000000000000000000000000000000039d, to: DSCEngine: [0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512], value: 275678157591424809853640 [2.756e23])
    │   │   └─ ← [Return] true
    │   └─ ← [Stop] 
    ├─ [0] VM::stopPrank()
    │   └─ ← [Return] 
    └─ ← [Stop] 

  [96660] Handler::mintDsc(3661, 412)
    ├─ [43714] DSCEngine::getAccountInformation(0x00000000000000000000000000000000000002c1) [staticcall]
    │   ├─ [8993] MockV3Aggregator::latestRoundData() [staticcall]
    │   │   └─ ← [Return] 1, 200000000000 [2e11], 1, 1, 1
    │   ├─ [8993] MockV3Aggregator::latestRoundData() [staticcall]
    │   │   └─ ← [Return] 1, 100000000000 [1e11], 1, 1, 1
    │   └─ ← [Return] 35282013681 [3.528e10], 234601476000 [2.346e11]
    ├─ [0] console::log("Bound result", 3661) [staticcall]
    │   └─ ← [Stop] 
    ├─ [0] VM::startPrank(0x00000000000000000000000000000000000002c1)
    │   └─ ← [Return] 
    ├─ [33269] DSCEngine::mintDsc(3661)
    │   ├─ [993] MockV3Aggregator::latestRoundData() [staticcall]
    │   │   └─ ← [Return] 1, 200000000000 [2e11], 1, 1, 1
    │   ├─ [993] MockV3Aggregator::latestRoundData() [staticcall]
    │   │   └─ ← [Return] 1, 100000000000 [1e11], 1, 1, 1
    │   ├─ [14949] DecentralisedStableCoin::mint(0x00000000000000000000000000000000000002c1, 3661)
    │   │   ├─ emit Transfer(from: 0x0000000000000000000000000000000000000000, to: 0x00000000000000000000000000000000000002c1, value: 3661)
    │   │   └─ ← [Return] true
    │   └─ ← [Stop] 
    ├─ [0] VM::stopPrank()
    │   └─ ← [Return] 
    └─ ← [Stop] 

  [9318] Invariants::invariants_gettersShouldNeverRevert()
    ├─ [215] DSCEngine::getLiquidationBonus() [staticcall]
    │   └─ ← [Return] 10
    ├─ [237] DSCEngine::getLiquidationPrecision() [staticcall]
    │   └─ ← [Return] 100
    ├─ [282] DSCEngine::getLiquidationThreshold() [staticcall]
    │   └─ ← [Return] 50
    ├─ [281] DSCEngine::getMinHealthFactor() [staticcall]
    │   └─ ← [Return] 1000000000000000000 [1e18]
    ├─ [325] DSCEngine::getPrecision() [staticcall]
    │   └─ ← [Return] 1000000000000000000 [1e18]
    ├─ [303] DSCEngine::getAdditionalFeedPrecision() [staticcall]
    │   └─ ← [Return] 10000000000 [1e10]
    └─ ← [Stop] 
    ```

Answered by EngrPips

Jul 23, 2024

From the output you shared, this invariant_protocolMustHaveMoreValueThanTotalSupply() was not been tested. The call to redeemCollateral is pretty normal and understandable, as the fuzzer can call any function on the handler contract. You can maybe use the selector options to limit the function you want it to call if you don't want it calling some functions when you are doing getters test.

        bytes4[] memory selectors = new bytes4[](2);
        selectors[0] = TSwapPoolTestHandler.deposit.selector;
        selectors[1] = TSwapPoolTestHandler.swap_pool_token_for_weth.selector;

        targetSelector(FuzzSelector({addr: address(tswap_pool_test_handler_contract), selectors: selectors}));
…

View full answer

EngrPips · 2024-07-22T11:42:26Z

EngrPips
Jul 22, 2024

[9318] Invariants::invariants_gettersShouldNeverRevert()
    ├─ [215] DSCEngine::getLiquidationBonus() [staticcall]
    │   └─ ← [Return] 10
    ├─ [237] DSCEngine::getLiquidationPrecision() [staticcall]
    │   └─ ← [Return] 100
    ├─ [282] DSCEngine::getLiquidationThreshold() [staticcall]
    │   └─ ← [Return] 50
    ├─ [281] DSCEngine::getMinHealthFactor() [staticcall]
    │   └─ ← [Return] 1000000000000000000 [1e18]
    ├─ [325] DSCEngine::getPrecision() [staticcall]
    │   └─ ← [Return] 1000000000000000000 [1e18]
    ├─ [303] DSCEngine::getAdditionalFeedPrecision() [staticcall]
    │   └─ ← [Return] 10000000000 [1e10]
    └─ ← [Stop]

It doesn't seem like these calls reverted.

5 replies

EngrPips Jul 22, 2024

Can you please show the logs that show this: More logging reveals that the invariant_protocolMustHaveMoreValueThanTotalSupply() is also being tested even though I am not explicitly mentioning this in the testing

tamermint Jul 23, 2024
Author

Here you go :

  [102881] Handler::redeemCollateral(5799, 3582)
    ├─ [2808] DSCEngine::getCollateralBalanceOfUser(0x00000000000000000000013Aafe00671B7a18e4A, ERC20Mock: [0xDB8cFf278adCCF9E9b5da745B44E754fC4EE3C76]) [staticcall]
    │   └─ ← [Return] 106122369680 [1.061e11]
    ├─ [0] console::log("Bound result", 3582) [staticcall]
    │   └─ ← [Stop] 
    ├─ [0] VM::prank(0x00000000000000000000013Aafe00671B7a18e4A)
    │   └─ ← [Return] 
    ├─ [85721] DSCEngine::redeemCollateral(ERC20Mock: [0xDB8cFf278adCCF9E9b5da745B44E754fC4EE3C76], 3582)
    │   ├─ emit CollateralRedeemed(redeemedFrom: 0x00000000000000000000013Aafe00671B7a18e4A, redeemedTo: 0x00000000000000000000013Aafe00671B7a18e4A, tokens: ERC20Mock: [0xDB8cFf278adCCF9E9b5da745B44E754fC4EE3C76], amount: 3582)
    │   ├─ [29988] ERC20Mock::transfer(0x00000000000000000000013Aafe00671B7a18e4A, 3582)
    │   │   ├─ emit Transfer(from: DSCEngine: [0xe7f1725E7734CE288F8367e1Bb143E90bb3F0512], to: 0x00000000000000000000013Aafe00671B7a18e4A, value: 3582)
    │   │   └─ ← [Return] true
    │   ├─ [8993] MockV3Aggregator::latestRoundData() [staticcall]
    │   │   └─ ← [Return] 1, 200000000000 [2e11], 1, 1, 1
    │   ├─ [8993] MockV3Aggregator::latestRoundData() [staticcall]
    │   │   └─ ← [Return] 1, 100000000000 [1e11], 1, 1, 1
    │   └─ ← [Revert] DSCEngine__BreaksHealthFactor(999999966246569777 [9.999e17])
    └─ ← [Revert] DSCEngine__BreaksHealthFactor(999999966246569777 [9.999e17])

  [9318] Invariants::invariants_gettersShouldNeverRevert()
    ├─ [215] DSCEngine::getLiquidationBonus() [staticcall]
    │   └─ ← [Return] 10
    ├─ [237] DSCEngine::getLiquidationPrecision() [staticcall]
    │   └─ ← [Return] 100
    ├─ [282] DSCEngine::getLiquidationThreshold() [staticcall]
    │   └─ ← [Return] 50
    ├─ [281] DSCEngine::getMinHealthFactor() [staticcall]
    │   └─ ← [Return] 1000000000000000000 [1e18]
    ├─ [325] DSCEngine::getPrecision() [staticcall]
    │   └─ ← [Return] 1000000000000000000 [1e18]
    ├─ [303] DSCEngine::getAdditionalFeedPrecision() [staticcall]
    │   └─ ← [Return] 10000000000 [1e10]
    └─ ← [Stop] 

Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 16.14ms (3.38ms CPU time)

Ran 1 test suite in 1.09s (16.14ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)

Failing tests:
Encountered 1 failing test in test/fuzz/Invariants.t.sol:Invariants
[FAIL. Reason: invariants_gettersShouldNeverRevert persisted failure revert]
        [Sequence]
                sender=0x00000000000000000000013Aafe00671B7a18e4A addr=[test/fuzz/Handler.t.sol:Handler]0x2e234DAe75C793f67A35089C9d99245E1C58470b calldata=depositCollateral(uint256,uint256) args=[221809 [2.218e5], 106122369680 [1.061e11]]
                sender=0x00000000000000000000000000000000000004d1 addr=[test/fuzz/Handler.t.sol:Handler]0x2e234DAe75C793f67A35089C9d99245E1C58470b calldata=mintDsc(uint256,uint256) args=[115792089237316195423570985008687907853269984665640564039457584007913129639932 [1.157e77], 2454623510644256224596375677685454400661286202004 [2.454e48]]
                sender=0x00000000000000000000013Aafe00671B7a18e4A addr=[test/fuzz/Handler.t.sol:Handler]0x2e234DAe75C793f67A35089C9d99245E1C58470b calldata=redeemCollateral(uint256,uint256) args=[5799, 3582]
 invariants_gettersShouldNeverRevert() (runs: 1, calls: 1, reverts: 1)

Encountered a total of 1 failing tests, 0 tests succeeded

EngrPips Jul 23, 2024

From the output you shared, this invariant_protocolMustHaveMoreValueThanTotalSupply() was not been tested. The call to redeemCollateral is pretty normal and understandable, as the fuzzer can call any function on the handler contract. You can maybe use the selector options to limit the function you want it to call if you don't want it calling some functions when you are doing getters test.

        bytes4[] memory selectors = new bytes4[](2);
        selectors[0] = TSwapPoolTestHandler.deposit.selector;
        selectors[1] = TSwapPoolTestHandler.swap_pool_token_for_weth.selector;

        targetSelector(FuzzSelector({addr: address(tswap_pool_test_handler_contract), selectors: selectors}));
        targetContract(address(tswap_pool_test_handler_contract));

You can use something like the code above to instruct the fuzzer on which functions to call and which functions not to call.

Answer selected by tamermint

tamermint Jul 23, 2024
Author

Thank you Sir!

EngrPips Jul 23, 2024

You are welcome, sir.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Getters are reverting in Fuzz testing #2073

{{title}}

Replies: 1 comment 5 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Getters are reverting in Fuzz testing #2073

tamermint Jul 22, 2024

Replies: 1 comment · 5 replies

EngrPips Jul 22, 2024

EngrPips Jul 22, 2024

tamermint Jul 23, 2024 Author

EngrPips Jul 23, 2024

tamermint Jul 23, 2024 Author

EngrPips Jul 23, 2024

tamermint
Jul 22, 2024

Replies: 1 comment 5 replies

EngrPips
Jul 22, 2024

tamermint Jul 23, 2024
Author

tamermint Jul 23, 2024
Author