What to Do When Tx Reverts and the Revert Reason is Swallowed – MarekKowalski

okay uh so I hope everyone is feeling great after lunch and a short break we are changing gears a little bit and this presentation will be a little bit more technical before we Deep dive I want to have a very simple question to the audience how many of you have done any coding in your life uh okay that's great how many of you have done coding in solidity okay perfect okay so uh what to do when transaction DS and transaction rver is swallowed like what does it even mean for transaction uh reason to be swallowed uh I want to show this uh piece of code I hope it's readable from where you're sitting um does anyone know from which Library this code is does it look familiar to anyone especially this uh this part safe erc20 ERC operation did not succeed does this sound familiar to anyone okay well so this one is very personal to me like it's it's a it's a history which counts me since uh 2020 this piece of code is from uh open spping Library open spping library is what you use pretty much in every single product that you do this is a wrapper for erc20 token which you use used to move tokens in a safe way and uh the what it does it delegates the call to uh you know token and then checks if uh if it returned data uh and then expect it to return Bolan if and if anything went wrong it will just give you this error message save year C20 year C20 operation did not succeed and what have happened underneath is that there was interaction with the actual token and the reason for this failure is gone like you will not see it in in the results so this is what we mean by error message being swallowed like it's it's no longer visible and uh this is a story for uh from 2020 we were doing this project for a client we were integrating other protocol and uh the balancer protocol and these are very complex interactions between uh you know two protocols which are hard to control and actually uh organizers of this event have been very nice and they prepared for this presentation the um the depiction of how this project went so if you look here you will see the developer who actually is getting this error for those who sit in the back like this was actually his face and I am here you know this is this is the helplessness I I felt when you know this situation happened and in here you can see the client like he is holding a stick to our back and asking like why is it taking so long uh and this this is a personal situation for me because like the developer was so frustrated by carrying this cross on his back that he actually quit the job like he told me that he's quitting the job because of this erc20 operation did not succeed and because I was F helpless I figured out okay I need to do something about it and we need to develop ways to uh debug this things in a manageable way so how do you debug this things in a manageable way um you can do this by using this RPC call uh so this debug Trace transaction will oh this is perfect thank you we'll uh give you a big gson which looks somewhere like here and to make it more readable um it's a big gson it's a gon which has 1 gab or 2 GB of text information but if you want to know why your transaction reverted you can actually search search search for revert uh and every element of this big gson is actually one state of your virtual machine so whenever there is a rever reason uh from the stack you can read a position and the length of uh place in memory which is pointing to an error and is this particular situation this is the reason for the failure which has been swallowed so this is how we were doing this back in 2020 and uh if you think it's Bonkers it is Bonkers this is not how you want to spend your days uh so we had to do something better so what does this better mean uh well we started scripting around this we developed some tools and uh this is sort of like a meme uh that theory of automating uh some repeated task for like this that you spend some time uh you know writing your Automation and then you have like less work afterwards and reality is that you you spend some time and then you debug whatever you developed and uh there is ongoing development and then you go to events like this one and make talks about it and then later on maybe it it becomes a main thing we are yet to learn what uh what is here on the on the right hand uh side uh so um there is a QR code for the tool the tool is open source and it's deployed on web um and I will show you how you can use it so this uh particular situation by crazy coincidence is actually showing a transaction which I was debugging on if Global hakon and one of the members of hakon is actually with us here uh it's a easy uh project uh uh owner and and manager and he came to me on hakon a lot of people come uh to stand of mentors and ask like hey can you help me Deb back why things don't work so he already had code deployed to seoa and for like we open the transaction with failed and this is what you see on sepolia so you can see this is not very helpful uh and on screen it's even less readable but the only thing you can see that this is a fail and there is some status code uh so now what you can do you can copy this uh error message you can go to the online Tool uh evm debugger this is how it looks like you can just paste this hash you can select the network that uh you like want you know this transaction to analyze and it it's a goal in this particular case it will be very fast because it's already cached if you do this for some uh transaction that it hadn't had chance to run through and cach it takes two to 5 minutes but this is very fast so uh what it does it uh simulates the ENT entire transaction on the back end and extract this very huge gon file that you have seen before and these uh bottom left part are actually all the states of virtual machine it's a very very very very long list and a lot of engineer has come into like having this work as smoothly as it can so this is like a basic data that it analyzed but it also pulled all the sources of all the contracts that uh took part in this transaction and it decompiled them and most importantly it is able to generate something like that so what you can see on the screen this is like a entry point and then you can see all the internal and external calls that has been made by this transaction and for the calls we are also able to decode stack parameters and you can see their values and what is personally most interesting for me is that you can see this utility functions these ules this is something that uh not many people in solidity world are even aware of so U is a autogenerated code uh generated by solidity compiler which uh does all the heavy lifting so anytime you have error about the coding or something internal like this is the place of code you you have this error and to my knowledge neither tenderly no remix will show you any of this and we are able to extract it so if you go to the very down you can see that at some point it's calling Panic error something and if we click at this we are moved to this Frame and now uh when uh now I'm using arrows up and arrow down to just time travel through the states of the virtual machine and you can see that as I moving uh one step further we are actually in a check division uh inter integer and it's getting two parameters it's checking if the second parameter is zero and if you try to divide by zero you will have a bit time uh and we can move a little bit uh back and actually until the moment where we reach the actual line of uh uh you know source code and we can even see which division uh so I hope it's okay it's not very visible at this part this division is high it so you can actually see from here the total payout is zero and that in this error we are dividing by zero um so that's one way to use it uh before I move to another example I feel there there maybe some questions at this point so I would like to address any questions that are concerning this part and maybe move move to the next one anyone okay so I will show you another one which is a little bit more um uh more advanced uh so again there is uh so this is a transaction which we'll be analyzing and this is actually a transaction which succeeded and um what I want to oh sorry this one I will actually close so actually uh this is a transaction which was doing some claim tokens with a meracle proof so like a um meracle proof verification and the interesting thing is that you have a piece of code like this a library uh that is looking at the uh proof and from these parameters we can see the entire proof decoded from the parameters oh sorry um and what is possible you can place yourself in any line of source code and we can see see in here that there was 12 passes through this line of code which is understandable because it's a it's a for Loop and for Loop over 12 elements and in each pass I can uh you know jump to every pass and for example select a state in which ketak is being called and when I select a state where kak is being called uh in memory I will see what the uh range so what is the parameter that is being Ked and uh evm Works in a way that whatever the result was is landing here so like with this tool you can uh inspect any internal state of uh you know your computation uh and it's a postmortal analysis so uh it's it's a historical transaction uh so you can just see with a magnifying glass what exactly happened and where um okay so so I said about why uh I said what we are doing and maybe I still have few minutes to say about how we are doing this uh so the way we are doing this is that um like where is oh where is this diagram who no sign up later go away okay that's good so essentially this whole uh tool Works in a way that user provides us transaction hash and chain ID and we are using our backend so the green uh part are backend components so we are generating the trays and then uh we are uh we have our main front end store which is uh you know in a front end application which extracts all the information about all the contracts which took part in this uh transaction and then it's using another backend service to fetch the source cut from ether scan so if on ether scan we have source code of this contract we are downloading the source code and we are recompiling it with the same Flags to generate Source maps and we get something like that uh if you cannot see anything you are not really missing much because this is as readable as uh you know Matrix output uh but we learn how to read it uh and really this is all the information you need to map the uh ranges of bite code into the actual instructions of uh of solidity and uh yeah and and I don't have time to explain this format but it's very highly compressed and very efficient and trust me this is all we are using to get this done so we are really combining all the states of virtual machine all the source maps and uh uh and the source codes to get this interface and what is important uh and I'm jumping here whoops um what is important is that this is all open source uh there are two links here uh one is our GitHub uh so we are welcome and all the code like front end and back end is in GitHub so you're welcome to uh set it up locally play with this it takes 3 minutes to um deploy frontend which is hitting our backend services and this is the easiest way to start hacking with this uh you can run backend uh yourself but back end is AWS Lambda so we need to know a little bit about aw s but you are free to use uh lambdas which are deployed on our AWS account and I mean it's it's a free Tool uh and uh all the analytic logic uh for extracting all this crazy amount of data this is running on the front end anyway so this is mostly the part that you could be interested in modifying and there is our Discord server and on our Discord server you can get help if you like want to do something and are not sure what how and maybe we can do uh you know like discuss things so uh really this tool I think is a great asset for people who are doing security audits because it allows for learning what is happening inside the transaction and that's really all because I saved three minutes for questions and I will be very happy to answer any questions that anyone of you might have yes Tyler yeah okay I will repeat the question in case not everyone heard uh Tyler asked what are the different ways to uh Supply us with a code that we will do analysis from there are no ways uh we only analyze code which has been verified on ether scan so whatever is verified F scan we will be able to pull recompile and use that's all yeah maybe someone else have some other question okay then anybody has questions well thank you maybe we can have a round of applause for M thank you thank you so much amazing so I'm jumping in guys you didn't see me before because I was