crytic/slither

[Bug-Candidate]: binary operation (type(...).max, <ternary operation>) cause crash

0xVolosnikov opened this issue · 0 comments

Describe the issue:

SplitTernaryExpression fails if there is a binary operation with the type(...).max as the first operand and the result of the "ternary if" as the second.

If the first operand is a "ternary if" and the second is a type(...).max , then everything is fine.

It looks like the reason is that the ElementaryTypeNameExpression is missing here.

Possibly related to 1153 issue comment

Code example to reproduce the issue:

contract FailingContract {
    function failingFunction(
        bool condition
    ) external returns(uint256 res) {
        res = type(uint256).max / (condition ? 10 : 1) ;
    }
}

Version:

0.8.3

Relevant log output:

Ternary operation not handled uint256(<class 'slither.core.expressions.elementary_type_name_expression.ElementaryTypeNameExpression'>)