Stateful fuzzing method 1 where fails in Tswap.

[GaurangBharadava]

look at this code.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import {Test} from "forge-std/Test.sol";
import {HandlerStatefulFuzzCatches} from "../../../src/invariant-break/HandlerStatefulFuzzCatches.sol";
import {StdInvariant} from "forge-std/StdInvariant.sol";
import {MockUSDC} from "../../mocks/MockUSDC.sol";
import {YeildERC20} from "../../mocks/YeildERC20.sol";
import {IERC20} from "@openzeppelin/contracts/interfaces/IERC20.sol";

contract HandlerBreakTest is Test {
    HandlerStatefulFuzzCatches handlerStatefullFuzzCatches;
    MockUSDC mockUSDC;
    YeildERC20 yeildErc20;
    IERC20 [] supposedToken;
    uint256 startingAmount;

    address user = makeAddr("USER");
    function setUp() external {
        vm.startPrank(user);
        yeildErc20 = new YeildERC20();
        mockUSDC = new MockUSDC();
        supposedToken = new IERC20[](2);
        startingAmount = yeildErc20.INITIAL_SUPPLY();
        mockUSDC.mint(user, yeildErc20.INITIAL_SUPPLY());
        vm.stopPrank();
        supposedToken[0] = yeildErc20;
        supposedToken[1] = mockUSDC;

        handlerStatefullFuzzCatches = new HandlerStatefulFuzzCatches(supposedToken);
        targetContract(address(handlerStatefullFuzzCatches));
    }

    function testStartingAmountIsSame() public view {
        assert(startingAmount == yeildErc20.balanceOf(user));
        assert(startingAmount == mockUSDC.balanceOf(user));
    }

    function statefulFuzz_testInvariantBreak() public {
        vm.startPrank(user);
        handlerStatefullFuzzCatches.withdrawToken(mockUSDC);
        handlerStatefullFuzzCatches.withdrawToken(yeildErc20);
        vm.stopPrank();

        assert(mockUSDC.balanceOf(address(handlerStatefullFuzzCatches)) == 0);
        assert(yeildErc20.balanceOf(address(handlerStatefullFuzzCatches)) == 0);

        assert(mockUSDC.balanceOf(user) == startingAmount);
        assert(yeildErc20.balanceOf(user) == startingAmount);
    }


}

in this code we are trying to break invariant of withdrawing function. but i have question that user has not deposited and without depositing in the contract how can we withdraw tokens?
please explain me.

[EngrPips]

Hello @GaurangBharadava, That is the primary assignment of the Handler contract to handle incorrect calls and to ensure that only calls that make sense go through to the implementation contract.

[EngrPips]

We have to approve the handlerStatefullFuzzCatches because we want the handlerStatefullFuzzCatches to be able to use our balance on the ERC20 contract. For an ERC20 token, you need to approve an address before they can transfer your balance. when we execute this line of code handlerStatefulFuzzCatches.depositToken(yeildERC20, amount); we basically call the depositToken function on the handlerStatefulFuzzCatches function, and inside that function, the handlerStatefulFuzzCatches contract call the the transferFrom function on the yeildERC20 token which means it wants to transfer our token to itself, but the yeildERC20 contract will not allow them except that we have approved the handlerStatefulFuzzCatches. Does this make sense? Please ask questions if anything is confusing.

[GaurangBharadava]

ummm, i am bit confused,
I understood that you told.
Now look at this.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;

import {IERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";

/*
 * This contract represents a vault for ERC20 tokens.
 *
 * INVARIANT: Users must always be able to withdraw the exact balance amout out. 
 */
contract HandlerStatefulFuzzCatches {
    error HandlerStatefulFuzzCatches__UnsupportedToken();

    using SafeERC20 for IERC20;

    mapping(IERC20 => bool) public tokenIsSupported;
    mapping(address user => mapping(IERC20 token => uint256 balance)) public tokenBalances;

    modifier requireSupportedToken(IERC20 token) {
        if (!tokenIsSupported[token]) revert HandlerStatefulFuzzCatches__UnsupportedToken();
        _;
    }

    constructor(IERC20[] memory _supportedTokens) {
        for (uint256 i; i < _supportedTokens.length; i++) {
            tokenIsSupported[_supportedTokens[i]] = true;
        }
    }

    function depositToken(IERC20 token, uint256 amount) external requireSupportedToken(token) {
        tokenBalances[msg.sender][token] += amount;
        token.safeTransferFrom(msg.sender, address(this), amount);
    }

    function withdrawToken(IERC20 token) external requireSupportedToken(token) {
        uint256 currentBalance = tokenBalances[msg.sender][token];
        tokenBalances[msg.sender][token] = 0;
        token.safeTransfer(msg.sender, currentBalance);
    }
}

And the depositYeild function is this:

function depositYeildERC20(uint256 _amount) public {
        uint256 amount = bound(_amount, 0, yeildERC20.balanceOf(user));
        vm.startPrank(user);
        yeildERC20.approve(address(handlerStatefulFuzzCatches), amount);
        handlerStatefulFuzzCatches.depositToken(yeildERC20, amount);
        vm.stopPrank();    
}

In this function we prank user to call approve function. lets not talk about approve function. lets call deposit token function directly.
if it is called then is it right that the caller or msg.sender is user? then lets look in HandlerStatefulFuzzCatches contract deposite function which is called by user, so the msg.sender is user. and then in that function it is calling safeTransferFrom function. and as i understood this safeTransferFrom function is also called by user which is msg.sender am i right? or else this function is called by the HandlerStatefulFuzzCatches contract. I am confused at this. if i will understand this then i able to understand that why we have approved token to the contract.
please explain me.

[EngrPips]

Yeah, the user will be the msg.sender inside of the depositToken function of the handlerStatefulFuzzCatches contract so inside that function, the handlerStatefulFuzzCatches contract called the safeTransferFrom function on the token contract so inside the safeTransferFrom function of the token contract the handlerStatefulFuzzCatches contract will be the msg.sender

If anything is confusing please ask questions

[GaurangBharadava]

Ohh that what i want to understand.
thanks buddy.

[EngrPips]

Anytime, Friend. Keep crushing it.