Fix false-positive assertion violation (SWC-110) at PC 0 for contracts without assert (#1911)

mythril/analysis/module/modules/exceptions.py

@@ -83,6 +83,14 @@ def _analyze_state(self, state) -> List[Issue]:
         if opcode == "REVERT" and not is_assertion_failure(state):
             return []
 
+        # Skip INVALID at address 0: no legitimate compiled contract starts
+        # with an assertion.  This is typically an artifact of analyzing
+        # runtime bytecode as creation bytecode, which causes the symbolic
+        # executor to deploy garbage memory content whose first byte maps to
+        # an INVALID opcode.  Reporting it as SWC-110 is a false positive.
+        if opcode == "INVALID" and address == 0:
+            return []
+
         cache_address = annotations[0].last_jump
         if (
             cache_address,

tests/integration_tests/analysis_tests.py

@@ -82,6 +82,22 @@ def test_analysis_pending(file_name, tx_data, calldata):
         assert test_case["steps"][tx_data["TX_OUTPUT"]]["input"] == calldata
 
 
+def test_no_assert_false_positive_at_pc0():
+    """Regression test for issue #1911: a Solidity contract compiled with
+    --bin-runtime and heavy Yul optimizations should NOT produce a spurious
+    SWC-110 assertion violation at PC 0 when no assert() statements exist."""
+    bytecode_file = str(TESTDATA / "inputs" / "no_assert_false_positive.sol.o")
+    command = (
+        f"python3 {MYTH} analyze -f {bytecode_file} -t 2 -o jsonv2"
+        f" -m Exceptions --solver-timeout 60000 --no-onchain-data"
+    )
+    output = json.loads(output_of(command))
+    assert len(output[0]["issues"]) == 0, (
+        "Expected zero assertion-violation issues for a contract without assert(), "
+        f"but got {len(output[0]['issues'])}"
+    )
+
+
 test_data_code = [
     ("114", f"{TESTDATA}/input_contracts/tx.sol", True),
     ("123", f"{TESTDATA}/input_contracts/requirements_violation_pos.sol", True),

tests/testdata/inputs/no_assert_false_positive.sol.o

@@ -0,0 +1 @@
+60806040526004361061001d57636490a7dd60003560e01c146100bf575b600080fd5b35905b565b6100319150610022565b90565b8015150361001d57565b359061002582610034565b610031915061003e565b600460e0818303128061001d5761006d9083908301610027565b9261007b8360208401610027565b926100898160408501610027565b926100978260608301610049565b926100316100a88460808501610049565b936100b68160a08601610049565b9360c001610049565b348061001d576100dd6100d136610053565b959490949391936101fb565b60405190810181900390f35b906100f391610209565b506100fc610222565b80156101055750565b50600060018181816101b7565b8461011f575b5050505050565b91935083929091908361018c575b8415610141575b5050505038808080610118565b919350839290919082610183575b84610162575b5050505038808080610134565b501592509082610178575b505038808080610155565b50159050388061016d565b9350829361014f565b935081816101a8575b806101a1575b9361012d565b508261019b565b50818115610195575081610195565b935080816101c6575b93610112565b50831580156101c0575081826101f4575b1515806101eb575b806101c05750816101c0565b508215156101df565b50806101d7565b5050505061002592506100e9565b6000916102139182565b908161021d575090565b905090565b600160008181610233565b50505090565b9250821591839183610318575b84610252575b5050505038808061022d565b93509091839082610302575b846102f9575b846102f0575b841561027e575b5050505038808080610246565b9093509091839190836102e7575b8461029f575b5050505038808080610271565b5015925090826102b5575b505038808080610292565b159150819081159082908290826102d3575b505050505038806102aa565b9091929394505050505038808080806102c7565b9350819361028c565b9350829361026a565b93508293610264565b93508082610311575b9361025e565b508061030b565b93508381610356575b8061032d575b93610240565b50801580156103275750818261034f575b151580156103275750821515610327565b508361033e565b508361032156fea2646970667358221220b7c595f349cd7b0301a982a7a8dee69f2185795b25d6f6edd64074a7652f10ee64736f6c634300081d0033