💻Slither Intermediate Representation

Book an audit with Zokyo

Introduction to SlithIR

SlithIR stands as an intermediate representation (IR) used by Slither to facilitate enhanced analysis of Solidity contracts. The conversion to this IR simplifies the API, allowing for a more nuanced analysis, including taint and value tracking, which is crucial for identifying intricate patterns in smart contracts.

What is Intermediate Representation (IR)?

In compiler design, the concept of an "intermediate representation" (IR) is pivotal. It acts as an intermediary form during the translation of source code, holding enriched details about the program's structure and semantics. An IR can carry essential details such as taint information, source locations, and control flow nuances, crucial for a compiler’s optimization and transformation processes.

For example, consider the LLVM’s IR in comparison to C or x86 code. LLVM’s IR maintains a high level of abstraction while preserving essential transient details, like the variables and environmental state involved in a function call. This detailed representation allows for enhanced introspection, optimization, and information propagation during various compiler passes.

Why Does Slither Use SlithIR?

Solidity presents certain idiosyncrasies in its syntax and semantics. SlithIR assists in normalizing these peculiarities, ensuring a more streamlined and accurate analysis of the contracts. By translating Solidity into SlithIR, various operations, such as array pushes and function calls, get treated with specialized semantics, enhancing the depth and precision of the subsequent analyses.

For instance, SlithIR simplifies and enhances the analysis of complex aspects like variable tracking and control flow. It makes it easier to answer critical questions such as whether a user can influence a variable, aiding in the discovery of potential vulnerabilities from a static standpoint.

Usage Example

Executing a command like $ slither file.sol --print slithir will yield the IR of every function within a contract, demonstrating the operational semantics as per the SlithIR formulation.

Key Components in SlithIR Specification

• Variables: Different variables like StateVariable, LocalVariable, and TemporaryVariable are used.

• Operators: Various operators are defined, such as binary and unary operators, to represent different computations and assignments.

• Calls Operators: Different call operators, like high-level calls and low-level calls, are specified to represent various function and method invocations.

Conclusion

SlithIR stands as a powerful tool in the arsenal of Slither for static analysis of Solidity contracts, driving enhanced precision and depth in identifying vulnerabilities and optimization opportunities. Through the abstraction of SlithIR, the nuanced and enriched analysis becomes possible, even amidst the quirks and intricacies that Solidity presents as a language.

full documentation: https://github.com/crytic/slither/wiki/SlithIR#slithir