crytic / crytic/slither

[Bug-Candidate]: SlithIR Incorrect Tuple Order of Evaluation

Open
#2,810 0 comments 0 reactions 0 assignees View on GitHub
bug-candidate
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

The SlithIR incorrectly executes side effects like `++index` before capturing right-hand side tuple values for assignment, causing `(a, b) = (index, ++index)` to produce `a = 1` in the IR instead of the correct `a = 0`.

### Code example to reproduce the issue:

```solidity
pragma solidity ^0.8.0;

contract Test {
uint256 public index = 0;
uint256 public a;
uint256 public b;

function foo() public {
require(index == 0);
(a, b) = (index, ++index);
}
}
```

### Version:

0.11.3

### Relevant log output:

```shell
┌─ Node ID: 2
│ Expression: (a,b) = (index,++ index)
│ Type: NodeType.EXPRESSION
│ IRs:
│ 1. index(uint256) = index (c)+ 1
│ Type: Binary
│ 2. a(uint256) := index(uint256)
│ Type: Assignment
│ 3. b(uint256) := index(uint256)
│ Type: Assignment
└─
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.