crytic / crytic/slither

[Bug]: fixed-size array return values are unpacked unexpectedly in IR

Open
#1,827 0 comments 0 reactions 0 assignees View on GitHub
bug ir
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

When the return value of a function is a fix-sized array, and an array literal is returned, SlithIR will unpack the array literal, returning every element in the array literal.
For the example given below, the function only returns two values, one is a `fixed-size array`, and the other is a `uint`.
However, in the IR, the return operation has three arguments.
The array return value is unpacked unexpectedly.

### Code example to reproduce the issue:

```solidity
contract Contract {
function foo() public returns (uint[2] memory, uint) {
return ([uint(1), 2], 3);
}
}
```

### Version:

0.9.3

### Relevant log output:

```shell
INFO:Printers:Contract Contract
Function Contract.foo() (*)
Expression: ((uint256(1),2),3)
IRs:
TMP_0 = CONVERT 1 to uint256
RETURN TMP_0,2,3
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.