argotorg / argotorg/solidity

SMTChecker: doesn't recognize "OR" as arithmetic.

Open
#12,959 1 comment 0 reactions 0 assignees View on GitHub
smt
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
2d 19h
Merged PRs (30d)
29

Description

The following sample is based on the standard "overflow" sample of the SMTChecker.
There is an added "require" which makes sure the addition can never overflow - but the SMTChecker doesn't recognize it.

running the normal
`solc overflow.sol --model-checker-targets "underflow,overflow" --model-checker-engine all --model-checker-show-unproved`
Fails and claims that "Overflow can happen here"
with parameter
`_y = 2**256 - 1`

The SMT failed to see that checking an "OR'ed" value is equivalent to checking them separately
(actually, I compare them to type(uint128).max, which mean I can even multiply them without overflow..

```js
// SPDX-License-Identifier: GPL-3.0
pragma solidity >=0.8.0;

contract Overflow {
uint immutable x;
uint immutable y;

function add(uint _x, uint _y) internal pure returns (uint) {
return _x + _y;
}

constructor(uint _x, uint _y) {
// added "require": this makes sure that both values are small enough, and are allowed to be added with no overflow
require( (_x | _y) < type(uint128).max );
(x, y) = (_x, _y);
}

function stateAdd() public view returns (uint) {
return add(x, y);
}
}
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the report with overflow.sol and the supplied solc command using the SMTChecker. Inspect how the checker handles a bitwise OR in the constructor require; done means it recognizes the constraint and no longer reports a spurious overflow in stateAdd().

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.