crytic / slither

Static Analyzer for Solidity and Vyper
https://blog.trailofbits.com/2018/10/19/slither-a-solidity-static-analysis-framework/
GNU Affero General Public License v3.0
5.14k stars 943 forks source link

[Bug- Candidate]: Failed to generate IR #2443

Open sasiyaluba opened 2 months ago

sasiyaluba commented 2 months ago

What bug did Slither miss and which detector did you anticipate would catch it?

When I run slither ./a.sol I get AssertionError

Frequency

Very Frequently

Code example to reproduce the issue:

pragma solidity ^0.8.0;

contract MyContract {
    uint256 public variable1;
    uint256 public variable2;
    bool public variable3;

    constructor() {
        variable1 = 0;
        variable2 = 0;
        variable3 = false;
    }

    function updateVariables(uint256 newValue1, uint256 newValue2, bool newValue3) public {
        require(newValue1 > 0, "Value1 must be greater than 0");
        require(newValue2 > 0, "Value2 must be greater than 0");

        variable1 = newValue1;
        variable2 = newValue2;
        variable3 = newValue3;

        // Add your complex logic here

        // Example: Update variable3 based on the values of variable1 and variable2
        if (variable1 > variable2) {
            variable3 = true;
        } else {
            variable3 = false;
        }
    }
}

Version:

0.10.1

Relevant log output:

(python_3.10) (python_3.10) kaka@admin:~/code/EM_team/common$ slither ./a.sol 
'solc --version' running
'solc ./a.sol --combined-json abi,ast,bin,bin-runtime,srcmap,srcmap-runtime,userdoc,devdoc,hashes --allow-paths .,/home/kaka/code/EM_team/common' running
Compilation warnings/errors on ./a.sol:
Warning: SPDX license identifier not provided in source file. Before publishing, consider adding a comment containing "SPDX-License-Identifier: <SPDX-License>" to each source file. Use "SPDX-License-Identifier: UNLICENSED" for non-open-source code. Please see https://spdx.org for more information.
--> a.sol

func MyContract.constructor()
variable1(uint256) := 0(uint256)
variable2(uint256) := 0(uint256)
variable3(bool) := False(bool)
func MyContract.updateVariables(uint256,uint256,bool)
ERROR:SlitherSolcParsing:
Failed to generate IR for MyContract.updateVariables. Please open an issue https://github.com/crytic/slither/issues.
MyContract.updateVariables (a.sol#14-30):
        require(bool,string)(newValue1 > 0,Value1 must be greater than 0)
        require(bool,string)(newValue2 > 0,Value2 must be greater than 0)
        variable1 = newValue1
        variable2 = newValue2
        variable3 = newValue3
        variable1 > variable2
        variable3 = true
        variable3 = false
Traceback (most recent call last):
  File "/home/kaka/miniconda3/envs/python_3.10/bin/slither", line 8, in <module>
    sys.exit(main())
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/__main__.py", line 746, in main
    main_impl(all_detector_classes=detectors, all_printer_classes=printers)
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/__main__.py", line 852, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/__main__.py", line 107, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/__main__.py", line 80, in process_single
    slither = Slither(target, ast_format=ast, **vars(args))
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slither.py", line 150, in __init__
    self._init_parsing_and_analyses(kwargs.get("skip_analyze", False))
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slither.py", line 170, in _init_parsing_and_analyses
    raise e
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slither.py", line 166, in _init_parsing_and_analyses
    parser.analyze_contracts()
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 556, in analyze_contracts
    self._convert_to_slithir()
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 783, in _convert_to_slithir
    raise e
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 768, in _convert_to_slithir
    func.generate_slithir_and_analyze()
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/core/declarations/function.py", line 1772, in generate_slithir_and_analyze
    node.slithir_generation()
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/core/cfg/node.py", line 717, in slithir_generation
    self._irs = convert_expression(expression, self)  # type:ignore
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slithir/convert.py", line 115, in convert_expression
    visitor = ExpressionToSlithIR(expression, node)
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/visitors/slithir/expression_to_slithir.py", line 180, in __init__
    print(ir)
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slithir/operations/binary.py", line 159, in __str__
    return f"{str(lvalue)}({lvalue.type}) = {self.variable_left} {self.type_str} {self.variable_right}"
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slithir/operations/binary.py", line 146, in type_str
    if self.node.scope.is_checked and self._type.can_be_checked_for_overflow():
  File "/home/kaka/miniconda3/envs/python_3.10/lib/python3.10/site-packages/slither/slithir/operations/operation.py", line 42, in node
    assert self._node
AssertionError
0xalpharush commented 2 months ago

I can not reproduce this. Is this the exact contract that you got this error on? This is not related to false negatives since the trace has a crash