Skip to content

Fix naming-convention false positive on Yul-local function parameters#3038

Open
MarkLee131 wants to merge 2 commits into
crytic:masterfrom
MarkLee131:fix/naming-convention-yul-mangled-params
Open

Fix naming-convention false positive on Yul-local function parameters#3038
MarkLee131 wants to merge 2 commits into
crytic:masterfrom
MarkLee131:fix/naming-convention-yul-mangled-params

Conversation

@MarkLee131

Copy link
Copy Markdown

Fixes #3037. Also addresses #1815 (open since 2023).

naming-convention was flagging parameters of functions defined inside inline assembly with their parser-mangled internal name, e.g. Parameter LibArr.unsafeExtend.asm_0.extendInline().base__unsafeExtend_asm_0_extendInline is not in mixedCase for a source-level base_.

Root Cause

The Yul parser mangles every local identifier to <source_name>__<scope_chain> (solc_parsing/yul/parse_yul.py:130), so a Yul parameter base_ declared inside unsafeExtend's 0th assembly block ends up named base__unsafeExtend_asm_0_extendInline. The detector iterates contract.functions_declared, which includes synthetic Yul-local functions, and then runs is_mixed_case_with_underscore on the mangled name.

The mangled name is a parser artifact, not an identifier the developer wrote. Slither already tracks this distinction: synthetic Yul functions carry Function.internal_scope non-empty (set when the parser binds them under their containing YulBlock).

Fix

Skip Yul-local functions in the naming-convention loop:

for func in contract.functions_declared:
    if func.is_constructor:
        continue
    if func.internal_scope:
        # Synthetic function defined inside inline assembly. Its name and
        # parameter names are parser-mangled artifacts, not source identifiers.
        continue
    ...

Tests

Added tests/e2e/detectors/test_data/naming-convention/0.8.20/naming_convention_yul_local.sol. Covers two Yul-local function declarations (extendInline, memcpy) plus a tripwire tripwire(uint256 Bad_Param) that uses a deliberately non-mixedCase Solidity-level parameter. After the fix the snapshot contains exactly the tripwire finding; the Yul-local FPs are gone.

All 8 existing NamingConvention fixtures (0.4.25 / 0.5.16 / 0.6.11 / 0.7.6 × naming_convention.sol and no_warning_for_public_constants.sol) still pass with identical output.

The Yul parser mangles every local identifier to <source_name>__<scope_chain>
(solc_parsing/yul/parse_yul.py:130), so a Yul parameter `base_` declared
inside `unsafeExtend`'s 0th assembly block ends up named
`base__unsafeExtend_asm_0_extendInline`. The naming-convention detector
iterates `contract.functions_declared`, which includes these synthetic Yul-
local functions, and runs `is_mixed_case_with_underscore` on the mangled
name. The mangled name is a parser artifact, not an identifier the developer
wrote.

Synthetic Yul-local functions carry `Function.internal_scope` non-empty. Skip
them in the naming-convention loop so neither the synthetic function name nor
its parser-mangled parameters are checked.

Adds tests/e2e/detectors/test_data/naming-convention/0.8.20/naming_convention_yul_local.sol
covering two Yul-local function declarations (extendInline, memcpy) plus a
tripwire `tripwire(uint256 Bad_Param)` that uses a deliberately non-mixedCase
Solidity-level parameter. The snapshot after this change contains exactly the
tripwire finding; the Yul-local FPs are gone.

All 8 existing NamingConvention fixtures still pass with identical output.

Closes crytic#1815.
Generated via:
  python tests/e2e/detectors/test_detectors.py --compile
  pytest -k NamingConvention-0.8.20-naming_convention_yul_local --insta update

All 9 NamingConvention test cases pass with the fix applied.
@MarkLee131 MarkLee131 requested a review from smonicas as a code owner May 29, 2026 12:44
@CLAassistant

CLAassistant commented May 29, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[False-Positive]: naming-convention flags Yul-local function parameters by their parser-mangled name

2 participants