[Bug]: IR generation crashes on ERC7739-style calldata tuple destructuring ('NoneType' object has no attribute 'parameters'), silently dropping inheriting contracts from analysis
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
### What happened
Slither fails to build IR for Uniswap Calibur's `ERC7739._isValidTypedDataSig`, which destructures a calldata tuple returned by OpenZeppelin's `draft-ERC7739Utils` through `using ERC7739Utils for *`. The parse error is:
```
'NoneType' object has no attribute 'parameters'
```
The damaging part is the failure mode: every contract that inherits Calibur is then dropped from analysis entirely, while the run still completes and reports zero findings for them. We proved the silent drop by injecting an arbitrary low-level call into a subclass: zero findings; the identical injection in a non-inheriting contract was flagged immediately.
### Reproduction
```
git clone --recurse-submodules https://github.com/Uniswap/calibur
cd calibur
slither .
```
Or, for the silent-drop demonstration specifically: our repo keeps a canary test that plants a known vulnerability in a Calibur-inheriting fixture and asserts Slither misses it: https://github.com/xanderslabs/avok.js/blob/main/contracts/test/SlitherCanary.t.sol
Note `via_ir` cannot be disabled as a workaround: Calibur does not compile without it (stack too deep).
### Versions
Reproduced on Slither 0.11.5 and 0.11.6 (latest at time of filing), Python via pipx, solc 0.8.29, macOS. (Aderyn 0.6.8 also panics on the same project, for what it's worth.)
### Impact
Calibur is an audited, deployed EIP-7702 delegate that projects are encouraged to subclass; any such subclass currently gets a clean Slither run that has analyzed nothing. A hard error on IR failure (or a per-contract 'not analyzed' report) would make this failure loud instead of silent.
Contributor guide
Research direction
Reproduce the failure with the Calibur repository using `git clone --recurse-submodules ...`, then run `slither .` with the reported Slither and solc versions. Trace IR generation for `ERC7739._isValidTypedDataSig` and the calldata tuple destructuring through `ERC7739Utils`. Done means inheriting contracts are analyzed instead of silently dropped, or the run clearly reports that analysis failed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, solidity
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100