crytic / crytic/slither

[Bug-Candidate]: Source mapping indexes exceed source length when special characters are present in Solidity files

Open
#2,692 6 comments 0 reactions 0 assignees View on GitHub
bug-candidate
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

We are encountering an issue with Slither’s source mapping when analyzing Solidity files that include certain special Unicode characters. In our use case, the source mapping index returned for some functions exceeds the length of the source file. For example, we observed that for a file with a total length of 54,863 characters, Slither reported an internal function with a start index of 55,053.

After investigation, we suspect that the presence of characters such as:
```
+.*•´.*:˚.°*.˚

½
```
may be causing encoding or processing issues within Slither (or its underlying CryticCompile component), leading to miscalculation of character positions.

**Steps to Reproduce:**
1. Create a Solidity file (e.g., `Test.sol`) that includes a library or contract containing these special characters in comments or string literals.
2. Run Slither (via CryticCompile) on the file.
3. Observe that the source mapping for at least one function returns a start index greater than the total file length.

### Code example to reproduce the issue:

(https://github.com/Vectorized/solady/blob/main/src/utils/FixedPointMathLib.sol)

### Version:

0.11.0

### Relevant log output:

```shell

```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the report with Test.sol and the referenced FixedPointMathLib.sol through Slither and CryticCompile. Compare the reported source-mapping start index with the source length when the listed Unicode characters appear in comments or string literals. Done means the reproduction no longer produces an index beyond the source length, with regression coverage for the affected input.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, solidity
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.