slither icon indicating copy to clipboard operation
slither copied to clipboard

[Bug]: `delegatecall_in_loop` detector fails on some custom errors

Open axic opened this issue 4 years ago • 2 comments

Describe the issue:

This is probably related to #1173. Some detectors, like delegatecall_in_loop, crash the parser with some custom error cases.

Code example to reproduce the issue:

This is as far as I got minimizing the example:

contract A {
    error E(A a);

    function f() payable external {
      g();
    }
    
    function g() private {
      bool something = h();
      if (something) {
        revert E(this);
      }
    }

    function h() private returns (bool something) {
    }
}

The revert E(this); line is causing the issue.

Version:

0.8.2

Relevant log output:

Missing function Variable not found: E(A) (context A)
Traceback (most recent call last):
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 743, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 84, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 69, in process_single
    return _process(slither, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 110, in _process
    detector_results = slither.run_detectors()
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in run_detectors
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in <listcomp>
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/abstract_detector.py", line 152, in detect
    for r in [output.data for output in self._detect()]:
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 89, in _detect
    values = detect_delegatecall_in_loop(c)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 13, in detect_delegatecall_in_loop
    delegatecall_in_loop(f.entry_point, 0, [], results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 38, in delegatecall_in_loop
    delegatecall_in_loop(ir.function.entry_point, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 38, in delegatecall_in_loop
    delegatecall_in_loop(ir.function.entry_point, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 25, in delegatecall_in_loop
    if node.type == NodeType.STARTLOOP:
AttributeError: 'NoneType' object has no attribute 'type'
None
Error in .
Traceback (most recent call last):
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 743, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 84, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 69, in process_single
    return _process(slither, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 110, in _process
    detector_results = slither.run_detectors()
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in run_detectors
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in <listcomp>
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/abstract_detector.py", line 152, in detect
    for r in [output.data for output in self._detect()]:
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 89, in _detect
    values = detect_delegatecall_in_loop(c)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 13, in detect_delegatecall_in_loop
    delegatecall_in_loop(f.entry_point, 0, [], results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 38, in delegatecall_in_loop
    delegatecall_in_loop(ir.function.entry_point, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 38, in delegatecall_in_loop
    delegatecall_in_loop(ir.function.entry_point, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 25, in delegatecall_in_loop
    if node.type == NodeType.STARTLOOP:
AttributeError: 'NoneType' object has no attribute 'type'

axic avatar Apr 16 '22 20:04 axic

Hi @axic, thanks for reporting this

I confirm that this is still present with 0.8.3

montyly avatar Apr 27 '22 08:04 montyly

Some impacted detectors include: delegatecall-loop, msg-value-loop, calls-loop, costly-loop.

gsangeryee avatar Jul 07 '22 08:07 gsangeryee