argotorg / argotorg/solidity

IR-based codegen: Modifying the length of a dynamic array to a large number in assembly, followed by a push() operation, will cause a revert.

Open
#15,417 0 comments 0 reactions 0 assignees View on GitHub
bug :bug:
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
1d 11h
Merged PRs (30d)
21

Description

- Compiler version: 0.8.27
- Target EVM version (as per compiler settings): None
- Framework/IDE (e.g. Truffle or Remix): Remix
- EVM execution environment / backend / blockchain client: None
- Operating system: None

## Steps to Reproduce
```solidity
contract A {
int[] public a;
function f() public {
assembly {
let converted := 14
let _1 := 50
sstore(0, keccak256(_1, converted))
// sstore(0, 1)
}
a.push(2);
}
}
```
### Remix
#### Legacy codegen
![image](https://github.com/user-attachments/assets/5bf1f759-56df-4362-b712-5548ba8e1189)

#### IR-based codegen
![image](https://github.com/user-attachments/assets/51859db8-ce70-43cb-acd0-28d7c2d3e9ee)
1. If we comment out a.push(2), transaction will not revert
2. If replaced with sstore(0, 1), it still will not revert

Contributor guide

Open the contributing guide

Research direction

Start with the supplied Solidity reproducer and compare execution under IR-based and legacy codegen, focusing on the dynamic-array push after the assembly storage write. Trace the compiler path involved and add a regression test; done means the IR-generated contract no longer reverts while the reproducer remains covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, solidity
Domain
blockchain, compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.