crytic / crytic/slither

[Bug]: Reference variable used to store result of address.code call

Open
#2,129 1 comment 0 reactions 0 assignees View on GitHub
bug ir
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

The IR generated for calls to the `code` function uses a reference variable for its lvalue. The lvalue should instead be a `TMP` variable because it stores a `bytes` value rather than a location.

### Code example to reproduce the issue:

```
contract C {
function test() external {
uint z = msg.sender.code.length;
}
}
```

### Version:

0.9.6

### Relevant log output:

```shell
INFO:Printers:Contract C
Function C.test() (*)
Expression: z = msg.sender.code.length
IRs:
REF_0(bytes) = SOLIDITY_CALL code(address)(msg.sender)
REF_1(None) -> REF_0.length
z(uint256) := REF_1(None)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.