Skip to content

FunC ignores arg/ret order metadata when calling built-ins or asm functions via variables #1681

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Gusarich opened this issue May 21, 2025 · 0 comments

Comments

@Gusarich
Copy link

Gusarich commented May 21, 2025

The FunC compiler incorrectly handles built-in functions (e.g., moddiv) and asm functions with custom argument or return order annotations when they are invoked through variables. Specifically, it ignores the arg_order and ret_order metadata, leading to incorrectly ordered return values at runtime.

Minimal example (built-in and asm, direct vs indirect calls):

;; Correct: directly calls built-in, respects ret_order
(int, int) correctBuiltin(int a, int b) {
    return moddiv(a, b);
}

;; Incorrect: calling built-in via variable, ignores ret_order
(int, int) incorrectBuiltin(int a, int b) {
    var f = moddiv;
    return f(a, b);
}

;; Define the asm function with explicit ret_order
(int, int) myAsm(int a, int b) asm(-> 1 0) "SWAP";

;; Correct: directly calls asm function with explicit ret_order
(int, int) correctAsm(int a, int b) {
    return myAsm(a, b);
}

;; Incorrect: calls asm function via variable, ignores ret_order
(int, int) incorrectAsm(int a, int b) {
    var f = myAsm;
    return f(a, b);
}

() main () {
    ~dump([correctBuiltin(5, 1)]);    ;; [0 5] ✅
    ~dump([incorrectBuiltin(5, 1)]);  ;; [5 0] ❌
    ~dump([correctAsm(5, 1)]);        ;; [5 1] ✅
    ~dump([incorrectAsm(5, 1)]);      ;; [1 5] ❌
}

Expected Output:

[0 5]
[0 5]
[1 5]
[1 5]

Actual Output:

[0 5]
[5 0]
[5 1]
[1 5]

Cause:
When compiling function calls via variables, FunC currently ignores arg_order and ret_order metadata, causing incorrect assembly instructions and resulting in misordered runtime values.

Impact:
Contracts relying on indirect function calls to built-ins or annotated asm functions will silently produce incorrect results, potentially causing severe runtime logic errors.

Expected Behavior:
The compiler must correctly handle and apply arg_order and ret_order metadata, whether functions are called directly or indirectly.


LLM Fuzzing discovery (see tact-lang/tact#3123)

@Gusarich Gusarich changed the title FunC miscompiles builtin functions assigned to variables (ignores return-order metadata) FunC ignores arg/ret order metadata when calling built-ins or asm functions via variables May 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant