crytic / crytic/slither

[Bug-Candidate]: ERC-4626 Conformance asset() function returning false result

Open
#2,095 5 comments 0 reactions 0 assignees View on GitHub
bug-candidate
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

slither-check-erc conformance test fails for multiple ERC-4626's which do have valid underlying ERC-20 assets(). Unsure of where the error is occuring; doesn't seem to be impacted by proxied contracts, non-proxies also fail.

On further inspection the underlying for the vaults that fail appear normal as well. Thought it could be something to do with the specific ERC20 implementation but one of the underlyings shown below that failed was WETH (https://etherscan.io/address/0x22ab31Cd55130435b5efBf9224b6a9d5EC36533F).

### Code example to reproduce the issue:

**Example contracts that return `asset() -> (ERC20) should return address` incorrectly:**

`slither-check-erc mainet:0x22ab31Cd55130435b5efBf9224b6a9d5EC36533F Market --erc erc4626`

`slither-check-erc mainet:0x7966C5BAe631294D7cFFcEA5430b78C2F76DB6Fa StakedApe --erc erc4626`

`slither-check-erc mainet:0xb5b29320d2Dde5BA5BAFA1EbcD270052070483ec CellarInitializableV2_2 --erc erc4626`

**Example contracts that return `asset() -> (ERC20) should return address` correctly:**

`slither-check-erc mainet:0x815C23eCA83261b6Ec689b60Cc4a58b54BC24D8D vTHOR --erc erc4626 `

`slither-check-erc mainet:0xe9d33286f0E37f517B1204aA6dA085564414996d Pool --erc erc4626`

### Version:

0.9.6

### Relevant log output:

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the provided slither-check-erc commands against the listed failing and passing ERC-4626 contracts using version 0.9.6, then compare the asset() conformance checks and their results. Done means identifying why valid asset() implementations are rejected and making the conformance test report the correct result for these examples.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, solidity
Domain
blockchain, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.