Skip to content

fix(vyper): model loop bounds and range arguments correctly - #3085

Open
zloglevel wants to merge 1 commit into
crytic:masterfrom
zloglevel:master
Open

fix(vyper): model loop bounds and range arguments correctly#3085
zloglevel wants to merge 1 commit into
crytic:masterfrom
zloglevel:master

Conversation

@zloglevel

Copy link
Copy Markdown

Summary

Fix Vyper loop modeling in the CFG and SlithIR generation.

Root Cause

Vyper loops were modeled with an inclusive upper bound:

counter_var <= len(iterable)
counter_var <= range_end

This caused one extra modeled iteration and could produce an invalid access at iterable[len(iterable)].

For two-argument range(start, end), Slither also initialized the artificial counter to 0 and used the first argument as the endpoint. This did not match Vyper's half-open range semantics.

Changes

  • Use counter_var < len(iterable) for array iteration.
  • Use counter_var < end for range(end).
  • Initialize the artificial counter with start for range(start, end).
  • Use the second positional argument as the endpoint.
  • Preserve Vyper's bound keyword behavior without treating it as the range endpoint.
  • Add regression coverage for dynamic array iteration and two-argument ranges.
  • Update affected Vyper CFG/SlithIR snapshots.

Testing

30 passed
ruff check passed
git diff --check passed

Signed-off-by: zloglevel <loglevel@outlook.com>
@zloglevel
zloglevel requested a review from smonicas as a code owner August 19, 2026 16:07
@CLAassistant

CLAassistant commented Aug 19, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants