iamrecursion
commented
1 year ago So this is a legitimate overflow in that the offset in the load_slice function is huge. That means that we very rapidly overflow usize::max.
However, this should be impossible to do in a valid contract. To expand memory to usize::max bytes would take more gas than the block gas limit as far as I can tell, which means that the expression we are getting as input is potentially bogus.
I don't have more time to investigate this for now, but some thoughts:
- Constant folding of the input may be the culprit. If we are folding a subtraction that wraps around to something close to
U256::maxwe could see this behavior. - It's very hard to say what's going on here without a smaller repro as the contract is huge.
- Even when the underlying cause is found, we probably want to bound memory to a maximum size for constant offsets such that we can better-enforce sensible behavior below the block gas limit.
Describe the Bug
In debug mode the tool will panic with an overflow when running the Seaport contract
To Reproduce
Run the Seaport contract with the tool.
Results in the following error
Expected Behaviour
No overflow should happen.