CVD-Risk

Summary of Code Patterns for Each Risk Mstore Misoptimization. (1) Legacy Code Generation Pipeline: The legacy pipeline runs the Yul optimizer on inline assembly blocks individually, leading to incorrect memory optimizations. (2) Inline Assembly Blocks: The inline assembly blocks do not refer to any variables defined in the surrounding Solidity code; Memory writes within such assembly blocks are removed if the memory is not read within the same block. (3) Subsequent Access to Written Memory: Memory written in one assembly block is accessed in a subsequent assembly block, leading to potential errors due to removed writes. (4) Fixed Memory Offsets: Use of fixed memory offsets for intermediate values between assembly blocks, which can cause unexpected overwrites if the writes are removed. (5) Static Memory Reservation: Attempts to reserve static memory by modifying the free memory pointer, which can be incorrectly optimized out, leading to incorrect memory states. Storage Excessive Deletion. (1) Use of Optimized Code Generation: The vulnerability is more likely to occur with optimized viaIR code generation, but it can also theoretically happen in optimized legacy code generation. (2) Inline Assembly with return(...) or stop(): The vulnerability requires the use of inline assembly blocks that contain the return(...) or stop() instructions. (3) Storage Write Before Conditional Termination: A storage write occurs before the call to a function that may terminate early using inline assembly return(...) or stop(). (4) Conditional Early Termination: The function called has a code path that conditionally terminates early (using inline assembly) and another path that returns to the caller. (5) Control Flow Path After the Write: The continuing control flow path either: Overwrites the initial storage write, reverts. (6) Complex Control Flow: The storage write and the early termination can occur within complex control flow structures or arbitrarily nested function calls. Keccak256 Reuse Error. (1) Multiple Keccak-256 Computations: Computing multiple Keccak-256 hashes of the same content but with different lengths inside inline assembly. (2) Optimizer Enabled: The optimizer must be enabled for the bug to manifest. (3) Memory Content: Keccak-256 hashes of the same memory content but different sizes are considered equal. (4) Specific Lengths: The lengths of the Keccak-256 computations, when rounded up to the nearest multiple of 32, are the same. (5) Content Deduction: The memory contents at different positions can be deduced to be equal. Immutable Mutation. (1) Immutable Variables of Signed Integer Type: The bug is triggered when using immutable variables of a signed integer type that is shorter than 256 bits. (2) Use of Inline Assembly: The unclean value can only be accessed using inline assembly. Without inline assembly, the Solidity compiler performs additional cleanup, preventing the bug from manifesting. (3) Legacy Code Generator: The bug is present in the legacy code generator of the Solidity compiler. The new Yul-IR-based code generator correctly implements cleanup for immutable values. ABI Encoding Error. (1) Last Component of the Tuple: The last component of the tuple must be a statically-sized calldata array with the base type being either uint or bytes32 (e.g., bytes32[10] or uint[2][2][2]). (2) Dynamic Component in the Tuple: The tuple must contain at least one dynamic component, such as bytes or a struct containing a dynamic array.