Skip to content

Tolk optimizer arithmetic overflow in ton() constants leads to incorrect values #1679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Gusarich opened this issue May 20, 2025 · 0 comments

Comments

@Gusarich
Copy link

The Tolk optimizer incorrectly computes large numeric constants passed to ton(), due to unchecked arithmetic overflow. Specifically, parse_nanotons_as_floating_string() uses signed 64-bit integers (int64_t) without overflow checks, resulting in silently corrupted numeric constants.

Example Input:

fun onInternalMessage(): int {
    return ton("10000000000");
}

Incorrect Output:

// automatically generated from file.tolk
PROGRAM{
  0 DECLMETHOD onInternalMessage
  onInternalMessage PROC:<{
    // 
    -8446744073709551616 PUSHINT	// incorrect due to overflow
  }>
}END>c

Cause:

  • Internal numeric parsing (parse_nanotons_as_floating_string) uses int64_t without overflow checks.
  • Multiplying large numbers exceeds the limits of int64_t, causing arithmetic wraparound and incorrect constant values.

Impact:
Compiled contracts contain silently corrupted numeric constants, potentially causing severe logic and financial errors when deployed.

Expected behavior:
Numeric parsing must directly use arbitrary-precision integers (RefInt256) or explicitly detect overflow during parsing to guarantee correctness.


LLM Fuzzing discovery (see tact-lang/tact#3123)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant