crytic / crytic/slither

[Bug]: IR disorder in nested ternary operation

Open
#1,797 1 comment 0 reactions 0 assignees View on GitHub
bug cfg ir
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

When one ternary expression is used nestedly as a condition of another ternary operation, the condition IR operation of the outer ternary expression is missing.

In the following bug-revealing example, the two cases of inner ternary expression `x != 10 ? x > 10 : x < 10` is assigned to `TMP_1` and `TMP_2`, respectively.
However, the outer ternary, `(x != 10 ? x > 10 : x < 10) ? 1 : 2` is not converted to IR operations.
There should be some Condition operation for the outer ternary expression.
For example, `CONDITION ϕ[TMP_1, TMP_2]` guarding the two return cases.

### Code example to reproduce the issue:

```solidity
contract A {
function foo(uint x) public returns (uint) {
return (x != 10 ? x > 10 : x < 10) ? 1 : 2;
}
}
```

### Version:

0.9.3

### Relevant log output:

```shell
INFO:Printers:Contract A
Function A.foo(uint256) (*)
Expression: 1
IRs:
RETURN 1
Expression: 2
IRs:
RETURN 2
Expression: x != 10
IRs:
TMP_0(bool) = x != 10
CONDITION TMP_0
Expression: (x > 10)
IRs:
TMP_1(bool) = x > 10
Expression: (x < 10)
IRs:
TMP_2(bool) = x < 10
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the Solidity contract in the report and inspect the generated IR for the nested ternary expression. Trace the IR generation path for ternary conditions and compare it with the shown inner expressions; done means the outer ternary emits a condition operation guarding its two return cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, solidity
Domain
compilers, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.