[False-Positive]: Vyper constant-states
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the false alarm that Slither raises and how you know it's inaccurate:
Slither can report that a non-constant state variable that is being updated should be constant.
Additionally, there seems to be some non-determinism involved as it is not reported every time (running Slither multiple times without changing the file can yield a different amount of results each time)
See in the log output two consecutive run results.
[EDIT] the issue seems to be fixed on the `dev` branch
### Frequency
Very Frequently
### Code example to reproduce the issue:
```Vyper
# @version 0.3.7
x: public(uint256)
@external
def foo():
x:uint256 = 12
x += 1
self.x = x
```
### Version:
`0.10.1`
### Relevant log output:
```shell
~/shared/ slither contracts/lending/Foo.vy
INFO:Detectors:
Foo.foo().x (contracts/lending/Foo.vy#7) shadows:
- Foo.x (contracts/lending/Foo.vy#3) (state variable)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#local-variable-shadowing
INFO:Detectors:
Foo.x (contracts/lending/Foo.vy#3) should be constant
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#state-variables-that-could-be-declared-constant
INFO:Slither:contracts/lending/Foo.vy analyzed (1 contracts with 94 detectors), 2 result(s) found
~/shared/ slither contracts/lending/Foo.vy
INFO:Detectors:
Foo.foo().x (contracts/lending/Foo.vy#7) shadows:
- Foo.x (contracts/lending/Foo.vy#3) (state variable)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#local-variable-shadowing
INFO:Slither:contracts/lending/Foo.vy analyzed (1 contracts with 94 detectors), 1 result(s) found
```
Contributor guide
Research direction
Run Slither 0.10.1 repeatedly against the Vyper example in the issue and compare the detector output between runs. Review the dev branch, where the reporter says the issue is fixed; done means the updated state variable is not falsely reported as constant and repeated runs are consistent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100