wip

Author: r0qs

docs/bugs.json

@@ -1,6 +1,6 @@
 [
     {
-        "uid": "SOL-2025-4",
+        "uid": "SOL-2025-1",
         "name": "InconsistentTreatmentOfStorageArraysOnSlotOverflowBoundary",
         "summary": "Fixed-length storage arrays crossing the 2^256 slot boundary can exhibit unexpected behavior when cleared (using the delete operator) or partially assigned, leading to silent data retention and inconsistent results.",
         "description": "Large static arrays in storage risk overlapping the 2^256 storage slot boundary. Partial assignments or delete operations may not properly reset all elements in such conditions, causing inconsistency during deletion and unexpected data retention. Although such situations are exceedingly rare in typical contracts, overflow on array deletion become more plausible when arrays are extremely large or the storage is manually positioned close to the storage boundaries. The compiler already warns about potential storage collisions in such scenarios.",

test/libsolidity/semanticTests/storage/delete_overflow_bug.sol

@@ -0,0 +1,27 @@
+contract C {
+    function getArray() internal pure returns (uint256[10][1] storage _x) {
+        assembly {
+            _x.slot := sub(0, 5)
+        }
+    }
+
+    function assignArray(uint256[10] memory y) public {
+        uint256[10][1] storage _x = getArray();
+        _x[0] = y;
+    }
+
+    function x() public view returns (uint256[10] memory) {
+        return getArray()[0];
+    }
+}
+// ----
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// assignArray(uint256[10]): 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ->
+// gas irOptimized: 245236
+// gas legacyOptimized: 245441
+// x() -> 1, 2, 3, 4, 5, 6, 7, 8, 9, 10
+// assignArray(uint256[10]): 10, 20, 30, 40, 50, 60, 70, 80, 90, 100 ->
+// x() -> 10, 0x14, 0x1e, 0x28, 0x32, 0x3c, 0x46, 0x50, 0x5a, 0x64
+// gas irOptimized: 198025
+// gas legacy: 200268
+// gas legacyOptimized: 198058

test/libsolidity/semanticTests/storage/delete_overflow_bug_collision.sol

@@ -0,0 +1,33 @@
+contract C {
+    function getArray() internal pure returns (uint256[10][1] storage _x) {
+        assembly {
+            _x.slot := sub(0, 5)
+        }
+    }
+
+    function fillArray() public {
+        uint256[10][1] storage _x = getArray();
+        for (uint i = 1; i < 10; i++)
+            _x[0][i] = i;
+    }
+
+    function clearArray() public {
+        uint256[10][1] storage _x = getArray();
+        delete _x[0];
+    }
+
+    function x() public view returns (uint256[10] memory) {
+        return getArray()[0];
+    }
+}
+// ----
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// fillArray()
+// gas irOptimized: 220705
+// gas legacyOptimized: 220871
+// x() -> 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
+// clearArray()
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// gas irOptimized: 181920
+// gas legacy: 184143
+// gas legacyOptimized: 181899

test/libsolidity/semanticTests/storage/delete_overflow_bug_large_mapping_storage_boundary.sol

@@ -0,0 +1,39 @@
+contract C {
+    uint256 public y = 42;
+
+    function getArray() internal pure returns (uint256[10][1] storage _x) {
+        assembly {
+            _x.slot := sub(0, 5)
+        }
+    }
+
+    function fillArray() public {
+        uint256[10][1] storage _x = getArray();
+        for (uint i = 1; i < 10; i++)
+            _x[0][i] = i;
+    }
+
+    function clearArray() public {
+        uint256[10][1] storage _x = getArray();
+        delete _x[0];
+    }
+
+    function x() public view returns (uint256[10] memory) {
+        return getArray()[0];
+    }
+}
+
+// ----
+// y() -> 42
+// x() -> 0, 0, 0, 0, 0, 0x2a, 0, 0, 0, 0
+// fillArray()
+// gas irOptimized: 203627
+// gas legacyOptimized: 203793
+// y() -> 5
+// x() -> 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
+// clearArray()
+// y() -> 0
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// gas irOptimized: 168243
+// gas legacy: 170463
+// gas legacyOptimized: 168219

test/libsolidity/semanticTests/storage/delete_overflow_bug_partial_assignment.sol

@@ -0,0 +1,33 @@
+contract C {
+    function getArray() internal pure returns (uint256[10][1] storage _x) {
+        assembly {
+            _x.slot := sub(0, 5)
+        }
+    }
+
+    function fillArray() public {
+        uint256[10][1] storage _x = getArray();
+        for (uint i = 1; i < 10; i++)
+            _x[0][i] = i;
+    }
+
+    function x() public view returns (uint256[10] memory) {
+        return getArray()[0];
+    }
+
+    function partialAssignArray() public {
+        uint256[10][1] storage _x = getArray();
+        _x[0] = [11, 12, 13];
+    }
+}
+// ----
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// fillArray()
+// gas irOptimized: 220705
+// gas legacyOptimized: 220871
+// x() -> 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
+// partialAssignArray()
+// x() -> 11, 12, 13, 0, 0, 0, 0, 0, 0, 0
+// gas irOptimized: 198025
+// gas legacy: 200268
+// gas legacyOptimized: 198058

test/libsolidity/semanticTests/storage/delete_overflow_bug_storage_layout.sol

@@ -0,0 +1,33 @@
+contract C {
+    function getArray() internal pure returns (uint256[10][1] storage _x) {
+        assembly {
+            _x.slot := sub(0, 5)
+        }
+    }
+
+    function fillArray() public {
+        uint256[10][1] storage _x = getArray();
+        for (uint i = 1; i < 10; i++)
+            _x[0][i] = i;
+    }
+
+    function x() public view returns (uint256[10] memory) {
+        return getArray()[0];
+    }
+
+    function partialAssignArray() public {
+        uint256[10][1] storage _x = getArray();
+        _x[0] = [11, 12, 13, 14, 15, 16, 17];
+    }
+}
+// ----
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// fillArray()
+// gas irOptimized: 220705
+// gas legacyOptimized: 220871
+// x() -> 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
+// partialAssignArray()
+// x() -> 11, 12, 13, 14, 15, 0x10, 0x11, 0, 0, 0
+// gas irOptimized: 198025
+// gas legacy: 200268
+// gas legacyOptimized: 198058

test/libsolidity/semanticTests/storage/storage_boundary_array_assignment.sol

@@ -0,0 +1,52 @@
+contract C layout at 2**256 - 5 {
+    uint256 a;
+
+    function getArray() internal pure returns (uint256[10][1] storage _x) {
+        assembly {
+            _x.slot := a.slot
+        }
+    }
+
+    function fillArray() public {
+        uint256[10][1] storage _x = getArray();
+        for (uint i = 1; i < 10; i++)
+            _x[0][i] = i;
+    }
+
+    function partialAssignArrayBeforeStorageBoundary() public {
+        uint256[10][1] storage _x = getArray();
+        _x[0] = [11, 12, 13];
+    }
+
+    function partialAssignArrayCrossStorageBoundary() public {
+        uint256[10][1] storage _x = getArray();
+        _x[0] = [14, 15, 16, 17, 18, 19, 20];
+    }
+
+    function clearArray() public {
+        uint256[10][1] storage _x = getArray();
+        delete _x[0];
+    }
+
+    function x() public view returns (uint256[10] memory) {
+        return getArray()[0];
+    }
+}
+// ----
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// fillArray()
+// gas irOptimized: 220749
+// gas legacyOptimized: 220915
+// partialAssignArrayBeforeStorageBoundary()
+// x() -> 11, 12, 13, 0, 0, 0, 0, 0, 0, 0
+// fillArray()
+// gas irOptimized: 186549
+// gas legacyOptimized: 186715
+// x() -> 11, 1, 2, 3, 4, 5, 6, 7, 8, 9
+// partialAssignArrayCrossStorageBoundary()
+// x() -> 14, 15, 0x10, 0x11, 0x12, 0x13, 0x14, 0, 0, 0
+// clearArray()
+// x() -> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+// gas irOptimized: 181930
+// gas legacy: 184143
+// gas legacyOptimized: 181900