argotorg / argotorg/solidity

SMTChecker: fail to report underflow

Open
#15,598 0 comments 0 reactions 0 assignees View on GitHub
bug :bug: smt
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
2d 19h
Merged PRs (30d)
29

Description

## Environment

- Compiler version: 0.8.27
- Target EVM version (as per compiler settings): None
- Framework/IDE (e.g. Truffle or Remix): Remix
- EVM execution environment / backend / blockchain client: None
- Operating system: Linux

## Steps to Reproduce
```solidity
contract C {
function dec() public returns (uint ) {
uint x;
uint y=x-1;
return y;
}
}
```
### Command
```
solc-0827 test.sol --model-checker-ext-calls trusted --model-checker-timeout 0 --model-checker-engine chc --model-checker-solvers z3 --model-checker-show-unproved
```
```
Warning: Source file does not specify required compiler version! Consider adding "pragma solidity ^0.8.27;"
--> test/test.sol

Warning: Function state mutability can be restricted to pure
--> test/test.sol:2:2:
|
2 | function dec() public returns (uint ) {
| ^ (Relevant source part starts here and spans across multiple lines).
```
### Remix
Transaction execution failed
### Analyse
SMTChecker should report underflow in **uint y=x-1;**. So this is a false negtive

Contributor guide

Open the contributing guide

Research direction

Start by running the provided solc 0.8.27 command against the Solidity snippet and confirm that SMTChecker with CHC and Z3 omits the underflow warning. Trace the SMTChecker path for the `uint y=x-1` expression and make the reported result include the underflow; done means the reproducer reports that arithmetic issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, solidity
Domain
compilers, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.