You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Tolk optimizer incorrectly computes large numeric constants passed to ton(), due to unchecked arithmetic overflow. Specifically, parse_nanotons_as_floating_string() uses signed 64-bit integers (int64_t) without overflow checks, resulting in silently corrupted numeric constants.
Example Input:
fun onInternalMessage(): int {
return ton("10000000000");
}
Incorrect Output:
// automatically generated from file.tolk
PROGRAM{
0 DECLMETHOD onInternalMessage
onInternalMessage PROC:<{
//
-8446744073709551616 PUSHINT // incorrect due to overflow
}>
}END>c
Cause:
Internal numeric parsing (parse_nanotons_as_floating_string) uses int64_t without overflow checks.
Multiplying large numbers exceeds the limits of int64_t, causing arithmetic wraparound and incorrect constant values.
Impact:
Compiled contracts contain silently corrupted numeric constants, potentially causing severe logic and financial errors when deployed.
Expected behavior:
Numeric parsing must directly use arbitrary-precision integers (RefInt256) or explicitly detect overflow during parsing to guarantee correctness.
The Tolk optimizer incorrectly computes large numeric constants passed to
ton()
, due to unchecked arithmetic overflow. Specifically,parse_nanotons_as_floating_string()
uses signed 64-bit integers (int64_t
) without overflow checks, resulting in silently corrupted numeric constants.Example Input:
Incorrect Output:
Cause:
parse_nanotons_as_floating_string
) usesint64_t
without overflow checks.int64_t
, causing arithmetic wraparound and incorrect constant values.Impact:
Compiled contracts contain silently corrupted numeric constants, potentially causing severe logic and financial errors when deployed.
Expected behavior:
Numeric parsing must directly use arbitrary-precision integers (
RefInt256
) or explicitly detect overflow during parsing to guarantee correctness.LLM Fuzzing discovery (see tact-lang/tact#3123)
The text was updated successfully, but these errors were encountered: