1/5
--- ### Teasing Out Verification Efforts: When Testing Reveals More Imagine you're eagerly unearthing "edge cases"—these rare conditions that expose the flaws in your code. You think you've covered every possible scenario, and then bam, you find one where the function isn't rounding up as you expect. During an audit, you might notice a particular line of code and think, "Hey, this isn't necessary," and that realization paves the way forward. It’s one small step on a path kidding with obstacles, but inching closer toward certainty in our codebase assures us that we can progress with confidence. This is the initial dance of auditing: sifting through the good to uncover and resolve the glitches. ### The Tricky Business of Computing Square Roots in Solidity Arriving at the last leg of our verification voyage, we encounter the square root function—a mountain of complexity in and of itself. Crafting square roots in Solidity can be likened to scaling a steep, unforgiving cliff. Why? Solidity's inherent limitations make iterating through looped calculations, like those needed for conventional square root algorithms, gas guzzling and inefficacious. Let's take a glance at a common Solidity pattern drawn from Uniswap, known as the `uni square root`. The routine cradles a `while` loop that continuously revises the value of 'x' until it meets certain criteria. Yet, this is inherently taxing on gas—Ethereum's precious computational resource. Sighing in inefficiency, we introduce our bespoke approach: harnessing the raw power of assembly within Solidity to enact the venerable Babylonian method for square root calculations. ### Babbling About Babylonian Methods Under the hood, buried in our code repository—affectionately dubbed 'Mathmasters'—you'll find an assembly implementation of the square root function. Revealing this intricate tapestry of low-level operations may beckon the curious to tarry and unpack the underlying math (and for those with eager minds, Wikipedia hosts a treasure trove of information on this age-old algorithm). Here’s a fun notion to ponder: imagine setting a variable 'Z' to the enigmatic '181y181' as part of such an algorithm. Cryptic, isn't it? Without venturing too far down the assembly rabbit hole in this narrative, let's acknowledge the cast of operations at play—bitwise 'or', multiplication 'mole', and the likes. Each actor contributes to our goal: a mathematically sound square root. Yet, the task remains to assure that this cryptic code delivers what we desire. ### Putting the Code to the Test In the pursuit of certainty, our weapon of choice is testing—particularly 'fuzz tests'. These are crafty little scenarios that prod and poke at our functions with a barrage of inputs to catch any inconsistencies. Specifically, when it comes to the Mathmasters square root, we have golden references like the Uniswap square root and another variant from a Github repository known as 'transmissions11 solmate'. By juxtaposing our implementation against these known quantities, we perform a form of differential testing, ensuring that our new square root function stands up to the rigors of their results. We double down on this effort with a battery of fuzz tests—named `test square root fuzz uni` and `test square root fuzz solmate`. As you might discern, we’re dealing with a methodical comparison of Mathmasters' square root to those other Noble Square Roots of the Blockchain Realm. It's a meticulous process, one that fosters confidence in the soundness of our function. You could, if you wished, dive deeper, pause the reading, and verify these values yourself. After all, ownership of understanding in code is empowerment. ### The Runaround With Fuzzing and the Search for Edge Cases Now, to the practicality of testing. In our Forge testing configuration, we grapple with the choice of how extensive our trials should be. Should we settle for a modest number of runs or pursue an exhaustive battery of tests to the point of absurdity? Remember, even with a high number of fuzz runs, stumbling upon an edge case through sheer luck is akin to finding a grain of sand in the desert. So, imagine our conundrum—we can run this ad infinitum, convincing ourselves we’ve dodged all bugs, yet without reaching absolute certainty. In the realm of mathematical functions like square roots, 99% confident just doesn’t cut it; we need 100% assuredness. ### Formal Verification and Heuristics: Ensuring Mathematical Soundness The path to unshakable confidence in our square root function splits in two. First, we have the arduous trail of formal verification—a rigorous mathematical approach to prove the correctness of our algorithm. It's a technique not for the faint of heart, but it stands as the bastion of reliability in critical code. Next, we offer a simpler guide—a heuristic signpost that might tip you off during an audit. This is the subtle hint, the nudge to say, "Something’s amiss here," sparking a deeper examination of the code. In short, we're bestowed with a powerful ensemble: an assembly-written `square root` function awaiting verification and a duo of fuzz tests checking it against seasoned contenders. It's within this matrix we labor, seeking confidence, not through luck or endless runs, but through methodical cross-examination and, if necessary, the steely resolve of formal substantiation. Perpetually challenged yet undaunted, we persist in perfecting our code, meter by meter. Our goal? Mathematical accuracy and efficiency that would make even the ancients nod in approval. The quest for the perfect solidity square root function is not just a tale of logic and loops—it’s an odyssey of precision, perseverance, and discovery. And as we set out on this expedition, we unleash a message to our fellow developers: may your code be elegant, your functions gas-light, and your results squared away impeccably! --- _The exquisite dance of coding in Solidity, with its quirks and its demands, requires a delicate balance of skill and insight. Our exploration of the square root function serves as both a cautionary tale and a beacon of hope for what can be achieved through a combination of coding finesse and unwavering dedication to accuracy._ **Remember**: `"In a world of while loops and gas fees, async-await the arrival of an efficient square root solution."` Dive into the depths of mathematical lore and coding prowess with us. Test, fuzz, and verify until you can declare with certitude: "This is the square root function that Solidity deserves."
A comprehensive guide to auditing square root functions in Solidity - This lesson covers formal verification of the square root function and also highlights a potential edge case that might be missed by a fuzzer. The video will introduce the student to two different approaches to finding a square root: using the Babylonian method in assembly and using the Solmate library's approach.
Previous lesson
Previous
Next lesson
Next
Give us feedback
Course Overview
About the course
Assembly
Writing smart contracts using Huff and Yul
Ethereum Virtual Machine OPCodes
Formal verification testing
Smart contract invariant testing
Halmos, Certora, Kontrol
Security researcher
$49,999 - $120,000 (avg. salary)
Smart Contract Auditor
$100,000 - $200,000 (avg. salary)
Guest lecturers:
Josselin Feist
Head of Blockchain at Trail of Bits
Last updated on January 17, 2025
Solidity Developer
Assembly and Formal VerificationDuration: 30min
Duration: 4h 38min
Duration: 3h 57min
Duration: 1h 56min
Course Overview
About the course
Assembly
Writing smart contracts using Huff and Yul
Ethereum Virtual Machine OPCodes
Formal verification testing
Smart contract invariant testing
Halmos, Certora, Kontrol
Security researcher
$49,999 - $120,000 (avg. salary)
Smart Contract Auditor
$100,000 - $200,000 (avg. salary)
Guest lecturers:
Josselin Feist
Head of Blockchain at Trail of Bits
Last updated on January 17, 2025
Testimonials
Read what our students have to say about this course.
Chainlink
Chainlink
Gustavo Gonzalez
Solutions Engineer at OpenZeppelin
Francesco Andreoli
Lead Devrel at Metamask
Albert Hu
DeForm Founding Engineer
Radek
Senior Developer Advocate at Ceramic
Boidushya
WalletConnect
Idris
Developer Relations Engineer at Axelar