crytic / crytic/slither

Calls to `return()` in assembly are not interpreted as return nodes

Open
#1,927 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

For solc versions >= 0.6.0, assembly code is parsed and included in the CFG the same as typical Solidity code, except that explicit return statements are not parsed as `RETURN` type nodes. Given the following contract:
```solidity
contract Contract {
function foo(uint a) public returns (uint x) {
assembly {
switch a
case 0 { x := 0 }
case 1 { x := 1 }
default {
return(0x0, 32)
}
}
}
}
```
and using the implicit return handling from #1880, I get the following CFG, with the return statement highlighted in red:
![image](https://github.com/crytic/slither/assets/6509209/7fb6c312-1273-4f65-8ccc-dfc7eef4a744)

Node 10 should really be a `NodeType.RETURN`, and probably should not have any sons. Node 11, at the bottom, is the implicit return node, which should not be reachable from the explicit return statement earlier inside the assembly block. There also probably shouldn't be a temporary variable for the value returned by `return()`, i.e., `TMP_2(None) = SOLIDITY_CALL return(uint256,uint256)(0,32)`. That is, unless my understanding of the return call in assembly is totally off.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.