crytic / crytic/slither

[Bug-Candidate]: Incorrect IR generated for interfaceId

Open
#1,810 1 comment 0 reactions 0 assignees View on GitHub
bug ir
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

Accesses to `interfaceId` get compiled to IR that seems incorrect for two reasons. First, a call to the `type` function is included in the IR as `SOLIDITY_CALL` , even though it doesn't correspond to a call at runtime. Second, the interface id is stored in a reference variable instead of a temporary variable.

### Code example to reproduce the issue:

interface IERC2981 {
function test() external;
}

contract Test {
function supportsInterface(bytes4 interfaceId)
public
view
virtual
returns (bool)
{
return interfaceId == type(IERC2981).interfaceId;
}
}

### Version:

0.9.3

### Relevant log output:

```shell
INFO:Printers:Contract IERC2981
Function IERC2981.test() (*)
Contract Test
Function Test.supportsInterface(bytes4) (*)
Expression: interfaceId == type()(IERC2981).interfaceId
IRs:
TMP_0(type(IERC2981)) = SOLIDITY_CALL type()(IERC2981)
REF_0 (->None) := 4171824493(bytes4)
TMP_1(bool) = interfaceId == REF_0
RETURN TMP_1
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with the provided IERC2981 and Test contracts on version 0.9.3, then inspect the IR generation for `type(IERC2981).interfaceId`. Done means the generated IR no longer emits a `SOLIDITY_CALL` for `type` and stores the interface ID in a temporary variable rather than a reference variable.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
compilers, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.