Help understanding SlitherIR SSA form in loops with if/else branches

[almirmcunhajr]

Hi everyone,

I'm trying to understand how Slither builds its SSA form in the presence of loops with internal branching. I have two simple examples and I would appreciate clarification on how the IR is constructed.

First example (simple while loop)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Example {
    int x;

    constructor() {
        x = 10;

        while (x > 0) {
            x = x - 1;
        }
    }
}

Command:

slither test.sol --print slithir-ssa

Output:

Function Example.constructor()
    Expression: x = 10
    IRs:
        x_1(int256) := 10(int256)
    Expression: x > 0
    IRs:
        x_2(int256) := ϕ(['x_3', 'x_1'])
        TMP_0(bool) = x_2 > 0
        CONDITION TMP_0
    Expression: x = x - 1
    IRs:
        TMP_1(int256) = x_2 (c)- 1
        x_3(int256) := TMP_1(int256)

This makes sense to me: there's a phi node x_2 that merges the initial value x_1 and the updated one x_3, and it is used in the condition and body.

---

Second example (loop with if/else)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Example {
    int x;

    constructor() {
        x = 10;

        while (x > 0) {
            if (x % 2 == 0) {
                x = x - 2;
            } else {
                x = x - 1;
            }
        }
    }
}

Command:

slither test.sol --print slithir-ssa

Output:

Function Example.constructor()
    Expression: x = 10
    IRs:
        x_1(int256) := 10(int256)
    Expression: x > 0
    IRs:
        TMP_0(bool) = x_1 > 0
        CONDITION TMP_0
    Expression: x % 2 == 0
    IRs:
        TMP_1(int256) = x_1 % 2
        TMP_2(bool) = TMP_1 == 0
        CONDITION TMP_2
    Expression: x = x - 2
    IRs:
        TMP_3(int256) = x_1 (c)- 2
        x_2(int256) := TMP_3(int256)
    Expression: x = x - 1
    IRs:
        TMP_4(int256) = x_1 (c)- 1
        x_3(int256) := TMP_4(int256)
    IRs:
        x_4(int256) := ϕ(['x_2', 'x_3'])

In this second case, I'm trying to understand how the loop semantics are handled. Specifically:

• The phi node x_4 merges the two branches, but it doesn't appear to be used afterward.
• The condition x > 0 and the arithmetic expressions use x_1 instead of a value from a phi node representing the updated value across iterations, like in the first example.

In my understanding, this structure seems a bit confusing since the loop condition and arithmetic expressions continue to use the initial value x_1, it looks like the updated value (x_4) from the if/else branch isn't actually used in subsequent iterations.

Thanks in advance for any help understanding this case!