SMTChecker: doesn't recognize "OR" as arithmetic.
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 29
Description
The following sample is based on the standard "overflow" sample of the SMTChecker.
There is an added "require" which makes sure the addition can never overflow - but the SMTChecker doesn't recognize it.
running the normal
`solc overflow.sol --model-checker-targets "underflow,overflow" --model-checker-engine all --model-checker-show-unproved`
Fails and claims that "Overflow can happen here"
with parameter
`_y = 2**256 - 1`
The SMT failed to see that checking an "OR'ed" value is equivalent to checking them separately
(actually, I compare them to type(uint128).max, which mean I can even multiply them without overflow..
```js
// SPDX-License-Identifier: GPL-3.0
pragma solidity >=0.8.0;
contract Overflow {
uint immutable x;
uint immutable y;
function add(uint _x, uint _y) internal pure returns (uint) {
return _x + _y;
}
constructor(uint _x, uint _y) {
// added "require": this makes sure that both values are small enough, and are allowed to be added with no overflow
require( (_x | _y) < type(uint128).max );
(x, y) = (_x, _y);
}
function stateAdd() public view returns (uint) {
return add(x, y);
}
}
```
Contributor guide
Research direction
Start by reproducing the report with overflow.sol and the supplied solc command using the SMTChecker. Inspect how the checker handles a bitwise OR in the constructor require; done means it recognizes the constraint and no longer reports a spurious overflow in stateAdd().
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100