crytic / crytic/slither

[Bug]: uninitialized-local-variables FP in destructuring assignment

Open
#1,505 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

Running slither on the provided code example produces a false positive regarding an uninitialized local variable.

The slither parser renames variables so that multiple declarations in the same function don't have the same name. Printing the IR of the provided code example shows that in the second branch, the returned identifier is renamed to `q_scope_0` while the identifier in the declaration remains `q`. The declaration identifier should have been renamed to `q_scope_0`. I think the solution to this might be to copy the `id` field from the json `ast` [here](https://github.com/crytic/slither/blob/master/slither/solc_parsing/declarations/function.py#L772-L775) so that it can be used for renaming lookup.

### Code example to reproduce the issue:

```
pragma solidity 0.8.13;

contract Test
{
function f1() public view returns (int, string memory) {
return (0,"hello");
}

function f2(bool a) public view returns (string memory) {
if (a) {
(int x, string memory z) = f1();
return z;
} else {
(int x, string memory z) = f1();
return z;
}

}
}
```

### Version:

0.9.1

### Relevant log output:

```shell
Test.f2(bool).q_scope_0 (test.sol#15) is a local variable never initialized
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#uninitialized-local-variables
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.