argotorg / argotorg/solidity

SMTChecker: Incorrect treatment of overflow in unary minus

Open
#16,447 0 comments 1 reaction 1 assignee Claimed by @blishko View on GitHub
bug :bug: low impact medium effort smt
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
1d 11h
Merged PRs (30d)
21

Description

## Description

SMTChecker treats unary minus incorrectly.
It reports overflow in an unchecked block, where it should not be creating overflow verification targets. This is false positive.

It also does not report overflow in a checked block, where an overflow (and subsequent revert) is possible). This is false negative.

Only unary minus is effected. Other arithmetic operations work as expected.
The problem occurs both with BMC and CHC engine.

## Steps to Reproduce

```solidity
pragma solidity ^0.8.13;

contract C {

function checkedNegMin(int8 x) external pure returns (int8) {
int8 y = -x; // overflow should be reported here
return y;
}

function uncheckedNeg(int8 x) external pure returns (int8) {
unchecked {
int8 y = -x; // overflow should not be reported in unchecked block
return y;
}
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.