[Bug-Candidate]: ERC-4626 Conformance asset() function returning false result

[vikramarun]

Describe the issue:

slither-check-erc conformance test fails for multiple ERC-4626's which do have valid underlying ERC-20 assets(). Unsure of where the error is occuring; doesn't seem to be impacted by proxied contracts, non-proxies also fail.

On further inspection the underlying for the vaults that fail appear normal as well. Thought it could be something to do with the specific ERC20 implementation but one of the underlyings shown below that failed was WETH (https://etherscan.io/address/0x22ab31Cd55130435b5efBf9224b6a9d5EC36533F).

Code example to reproduce the issue:

Example contracts that return asset() -> (ERC20) should return address incorrectly:

slither-check-erc mainet:0x22ab31Cd55130435b5efBf9224b6a9d5EC36533F Market --erc erc4626

slither-check-erc mainet:0x7966C5BAe631294D7cFFcEA5430b78C2F76DB6Fa StakedApe --erc erc4626

slither-check-erc mainet:0xb5b29320d2Dde5BA5BAFA1EbcD270052070483ec CellarInitializableV2_2 --erc erc4626

Example contracts that return asset() -> (ERC20) should return address correctly:

slither-check-erc mainet:0x815C23eCA83261b6Ec689b60Cc4a58b54BC24D8D vTHOR --erc erc4626

slither-check-erc mainet:0xe9d33286f0E37f517B1204aA6dA085564414996d Pool --erc erc4626

Version:

0.9.6

Relevant log output:

No response

[smonicas]

It's because the return type of asset is ERC20 and not address

[vikramarun]

Yeah, but I'm confused why asset is being identified as an address when its actually a compliant ERC20

Example for that StakedApe vault, the underlying is: https://etherscan.io/address/0x7966C5BAe631294D7cFFcEA5430b78C2F76DB6Fa#code

If we run ERC20 checks against it, it passes as well

slither-check-erc mainet:0x7966C5BAe631294D7cFFcEA5430b78C2F76DB6Fa StakedApe --erc erc20

[smonicas]

It's because this line ERC20 public immutable asset; makes the automatically generated function to return an ERC20 type and not an address. The eip-4626 says that asset returns an address type and that's what slither-check-erc checks. If you want to know what it exactly checks for eip-4626 see here. It doesn't run slither-check-erc [address] --erc erc20 on the underlying asset address but only checks the function signature.

[vikramarun]

Got it, very helpful. Thank you. There are lots of vaults where the underlying asset is mapped this way and it makes it seem like there’s something wrong with the vault when often it behaves just fine so thought i’d bring up if there was a better way to message the error

[vikramarun]

As a follow-up, the standard does say that the asset must be an ERC20. Should this case be broadened to include both an address and an ERC20:

asset
The address of the underlying token used for the Vault for accounting, depositing, and withdrawing.

MUST be an EIP-20 token contract.