crytic / crytic/slither

Incorrect SSA for conditional state variable mutation

Open
#468 3 comments 0 reactions 0 assignees View on GitHub
ir
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

Slither gives incorrect SSA for the following program involving a state variable:
```solidity
contract State {
int state = 0;
function f(int a) public returns (int) {
if (a < 1) {
state += 1;
}
return state;
}
}
```

Here is the resulting SSA:
```
f:
state_1(int256) := ϕ(['state_0', 'state_2'])
TMP_0(bool) = a_1 < 1
CONDITION TMP_0
state_2(int256) = state_1 + 1
RETURN state_2
```
![image](https://user-images.githubusercontent.com/11811606/80544663-60af6b80-8966-11ea-961f-2dcd53f72601.png)

The return instruction relies on state_2 which is only conditionally defined. If `a_1 < 1` evaluates to false I would say this SSA form crashes (or the logical equivalent). An alternative SSA might look like:

```
f:
state_1(int256) := ϕ(['state_0', 'state_2'])
TMP_0(bool) = a_1 < 1
CONDITION TMP_0
state_2(int256) = state_1 + 1
state_3 = ϕ(['state_1', 'state_2'])
RETURN state_2
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.