AVM

AVM copied to clipboard

For more security, can you change old spongycastle (based on old bouncycastle) to bouncycastle? - https://www.bouncycastle.org/ - https://www.bouncycastle.org/releasenotes.html - http://www.bouncycastle.org/latest_releases.html - https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncy%20castle - https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=bouncycastle - https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

Neustradamus

In the README.md file: **How it Works section:** - AVM Architecture diagram link is broken - Storage System diagram link is broken

raullaprida

(!) BigInteger should specify range explicitly

2

BigIntegers are limited in the AVM ABI at: https://github.com/aionnetwork/AVM/blob/master/org.aion.avm.userlib/src/org/aion/avm/userlib/abi/ABIStreamingEncoder.java#L480 a) This limitation is not specified in documentation. https://github.com/aionnetwork/docs/issues/64 b) The actual limits of the BigIntegers should be mentioned in code...

fulldecent

At https://avm-api.aion.network/avm/blockchain#log(byte%5B%5D) Apparently saving to logs and then retrieving it will not give the same value because there is padding. This is not documented.

fulldecent

Assertion failure during contract deployment

2

Test case: 1. Clone https://github.com/fulldecent/aion-aip040 2. Checkout 0xa0beeb017dd82747692965c3ca7b6f1a2a3c1b777d4472ce54174e224ca61962 3. Initialize 4. `./mvnw clean install` Expected AVM never has an assertion failure no matter what customers of AVM do Actual AVM...

fulldecent

BigInteger check should throw not assert

2

https://github.com/aionnetwork/AVM/blob/master/org.aion.avm.userlib/src/org/aion/avm/userlib/AionBuffer.java#L388 Because BigIntegers are possible to get to this point which are large. It also says > // BigInteger instances can't be larger than 32-bytes, in AVM. If this is...

fulldecent

There should be a deploy method for the main class

2

If a class has a method named `deploy` and this method is annotated Callable then it should be called at deploy time. This will remove the need for accessing `Blockchain.getData()`...

fulldecent

Remove Blockchain.getStorage / Blockchain.putStorage

12

The function signature for Blockchain.getStorage / Blockchain.putStorage encourages boilerplate code and this results in unsafe implementations. 1. Assumption: every contract using Blockchain.putStorage are implementing hashmaps/arrays 2. Assumption: every contract using...

fulldecent

Type safe storage API

1

Everybody will be encoding/decoding useful types from a byte array. This can be included in the user lib. Supporting types from the ABI. https://github.com/fulldecent/aion-aip040/blob/master/src/main/java/org/aion/AVMBlockchainWrapper.java

fulldecent

AVM should surely be running continuous integration. Please link to the build results at the top of the README.md.

fulldecent