Skip to content

[Bug-Candidate]: SlithIR Incorrect Tuple Order of Evaluation #2810

@mathcelo

Description

@mathcelo

Describe the issue:

The SlithIR incorrectly executes side effects like ++index before capturing right-hand side tuple values for assignment, causing (a, b) = (index, ++index) to produce a = 1 in the IR instead of the correct a = 0.

Code example to reproduce the issue:

pragma solidity ^0.8.0;


contract Test {
    uint256 public index = 0;
    uint256 public a;
    uint256 public b;
    
    function foo() public {
        require(index == 0);
        (a, b) = (index, ++index);
    }
}

Version:

0.11.3

Relevant log output:

┌─ Node ID: 2
    │  Expression: (a,b) = (index,++ index)
    │  Type: NodeType.EXPRESSION
    │  IRs:
    │    1. index(uint256) = index (c)+ 1
    │       Type: Binary
    │    2. a(uint256) := index(uint256)
    │       Type: Assignment
    │    3. b(uint256) := index(uint256)
    │       Type: Assignment
    └─

Metadata

Metadata

Assignees

No one assigned

    Labels

    bug-candidateBugs reports that are not yet confirmed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions