Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Keeper unsuccessful in calling processReport on fork environemnt. #36

Open
slundqui opened this issue Dec 12, 2024 · 3 comments
Open

Keeper unsuccessful in calling processReport on fork environemnt. #36

slundqui opened this issue Dec 12, 2024 · 3 comments

Comments

@slundqui
Copy link

slundqui commented Dec 12, 2024

When the keeper is required to call processReport, the call fails with an error.

To reproduce:

  1. Make random trades on Hyperdrive.
  2. One of the bots deposited into vault a.
  3. The keeper was successful in calling 3/4 functions (i.e., updateDebt, tend, strategyReport). processReport wasn't necessary on this call.
  4. The chain advanced time for 1 day.
  5. More trades were made on hyperdrive.
  6. There was a deposit and redeem to/from vault a, and a deposit to b.
  7. The keeper was successful in executing 3/4 functions (i.e., updateDebt, tend, strategyReport), but reverted on processReport.

This is the error hash I'm getting:

'0x08c379a0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000817661756c742070726f636573735f7265706f7274206661696c65643a2008c379a00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000b6e6f7420616c6c6f77656400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000'

Attempting to decode the hex string results in the following:

\x08�y�\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0bnot allowed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

Notice the not allowed in the decoded string.

This issue is easily reproducible when fuzzing on the fork we've set up. Attempt to deploy locally results in an issue (#35), but should be able to track down the line it's crashing at once the linked issue is solved.

@slundqui
Copy link
Author

Some potential things that may or may not be relevant:

  • The underlying fork is advancing time without calling any peripheral calls to e.g., update the underlying morpho vault's interest.
  • The TendConfig parameter on updateDebt and tend are using the following hard coded config parameters:
    tend_config = TendConfig(
        minOutput=0,
        minVaultSharePrice=0,
        positionClosureLimit=0,
        extraData=b"",
    )

@slundqui
Copy link
Author

slundqui commented Dec 16, 2024

Another fuzzing run resulted in a revert in the second call to strategyReport with the following crash code:

0x08c379a00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001c7374726174656779207265706f7274206661696c65643a20bb55fd2700000000

I'll take a look into what contract is throwing this code and see if I can decode it and/or track down what line is throwing the above errors.

Separate issue logged here:
#39

@slundqui
Copy link
Author

slundqui commented Dec 17, 2024

An additional run resulted in the following message in processReport

web3.exceptions.ContractLogicError: ('execution reverted: revert: vault process_report failed: \x08�y�\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\rtoo much loss\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', '0x08c379a0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000817661756c742070726f636573735f7265706f7274206661696c65643a2008c379a00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000d746f6f206d756368206c6f73730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000')

Note the too much loss in the decoded string.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant