crytic / crytic/slither

Echidna printer is not precise enough when showing the location of asserts in a codebase

Open
#2,104 2 comments 0 reactions 0 assignees View on GitHub
echidna enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

Currently, the echidna printer shows which functions directly or indirectly call `assert`. For instance:

```json
"assert": {
"FullMathEchidnaTest": [
"checkMulDivRoundingUp(uint256,uint256,uint256)"
]
},
```

However, in order to know if an assertion was reached or not, we need to know at least the pair of filename and line where it is located in the source code. Moreover, a single function can contain many asserts, so this needs to be expanded to include a list of the code locations. I tried to modify the echidna printer code, but there is a blocker:

```python
def _extract_assert(slither: SlitherCore) -> Dict[str, List[str]]:
ret: Dict[str, List[str]] = {}
for contract in slither.contracts:
functions_using_assert = []
for f in contract.functions_entry_points:
for v in f.all_solidity_calls():
if v == SolidityFunction("assert(bool)"):
functions_using_assert.append(_get_name(f))
...
```
Every value `v` from `f.all_solidity_calls()` has no `source_mapping` information: all of them are `None`. We need that information in order to map back to the source code.

Finally, if we implement this approach, will have a limitation when the code is inlined:

```solidity
if (...) { assert(..); }
```

Here Echidna will incorrectly assume that the line number will imply that the assertion is reached. In order to provide a more precise position, we will need the `opIx` mapping of each expression (which can be observed in the output of `solc --asm file.sol`) but this is not available from slither.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.