crytic / crytic/slither

Incorrect SSA for indirect call to function modifying global state

Open
#434 0 comments 3 reactions 0 assignees View on GitHub
bug ir
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

SSA doesn't track global state modification through indirect call. Consider the following two test cases, one performs the correct behavior but the other doesn't. I have attached screenshots of the resulting SSA IR in graph form

## Correct:
```
pragma solidity >=0.4.16 <0.7.0;
contract Contract {
int public a;
function f() public {
e();
a += 1;
}

function e() public {
a -= 1;
}
}
```

![correct](https://user-images.githubusercontent.com/11811606/78846590-1d925600-79c1-11ea-905a-0370cdd4b8e4.png)

## Incorrect:
```
pragma solidity >=0.4.16 <0.7.0;
pragma solidity >=0.4.16 <0.7.0;
contract Contract {
int public a;
function f() public {
g();
a += 1;
}

function e() public {
a -= 1;
}

function g() public {
e();
}
}
```

![image](https://user-images.githubusercontent.com/11811606/78846635-40bd0580-79c1-11ea-8d84-f5adffe8c9d0.png)

---

The correct version uses a phi node to track the alteration to global state through the function call. However, when we add one more layer of indirection, it no longer tracks that alteration.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.