crytic / crytic/crytic-compile

Foundry.is_dependency flags all project sources as dependencies when the project is nested under a parent `lib/` directory

Open
#690 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
197
Forks
97
PR merge metrics
No merged PRs in 30d

Description

### Summary

`Foundry.is_dependency` decides whether a file is a dependency by checking for `lib` /
`node_modules` components **anywhere in the file's absolute path**. When a Foundry project is
checked out under a parent directory named `lib` — the normal layout when the project is a git
submodule (`/lib/`) — every source file's absolute path contains a `lib`
component, so **all of the project's own sources are misclassified as dependencies**.

### Impact

Dependency-aware consumers then silently skip the entire project. Concretely, with Slither,
the dead-code detector (and other dependency-respecting detectors) report **nothing** for a
project nested under `lib/`, while the *same* project analyzed as a standalone checkout (e.g.
in CI) reports findings. The result is a confusing local-vs-CI divergence with no error to
explain it — local appears clean, CI fails.

### Root cause

`crytic_compile/platform/foundry.py`, `is_dependency`:

```python
path_parts = Path(path).parts # absolute path
ret = ("lib" in path_parts
or "node_modules" in path_parts
or any(lib in path_parts for lib in libs_path))
```

`is_from_dependency()` always passes the **absolute** path, so a parent `lib/` directory in that path matches the check.

### Steps to reproduce

Place any Foundry project under a directory named `lib` (e.g. `…/lib/myproject/`), then:

```python
from crytic_compile.platform.foundry import Foundry

f = Foundry("/abs/path/lib/myproject") # project under a parent "lib/"
f.is_dependency("/abs/path/lib/myproject/src/Token.sol")
# -> True (BUG: a project source is reported as a dependency)
```

Or, end to end: run Slither on a Foundry project that is a git submodule under `lib/` and note that `dead-code` findings present in a standalone checkout do not appear.

### Expected vs. actual
* **Expected**: `src/Token.sol` is project code (`is_dependency` → `False`); only the project's *own* `lib/` contracts are dependencies.
* **Actual**: every source under the parent `lib/` is flagged as a dependency.

### Proposed fix
Classify the path **relative to the project root** (`self._project_root`, already available on the `Foundry` instance) before the component check, so only `lib` / `node_modules` / configured-libs directories *within* the project count.

I have a fix + test ready and will open a PR shortly.

### Versions
Observed with crytic-compile `0.3.10` (via Slither `0.11.3`); the same code is present on `master`.

### Related
#279 is the same family (dependency path-component detection vs. directory layout), but the opposite failure — dependencies *not found* when hoisted in a monorepo. This is the inverse: project *sources wrongly* flagged as dependencies.

Contributor guide

Open the contributing guide

Research direction

Read crytic_compile/platform/foundry.py, especially Foundry.is_dependency and is_from_dependency, then reproduce the absolute-path case described with a project under a parent lib/ directory. Done means project sources return False while dependency directories inside the project still return True; add or inspect the promised regression test before running the relevant test suite.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
build-system, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.