Skip to content

fix(StdStorage): fix uint256 underflow infinite loop in find()#833

Merged
DaniPopes merged 1 commit intofoundry-rs:masterfrom
decofe:danipopes/fix-stdstorage-find-loop
Mar 15, 2026
Merged

fix(StdStorage): fix uint256 underflow infinite loop in find()#833
DaniPopes merged 1 commit intofoundry-rs:masterfrom
decofe:danipopes/fix-stdstorage-find-loop

Conversation

@decofe
Copy link
Contributor

@decofe decofe commented Mar 14, 2026

The reverse-iteration loop in find() uses for (uint256 i = reads.length; --i >= 0;) — since i is a uint256, --i >= 0 is always true. When i wraps past zero, the loop runs forever instead of terminating.

For tokens whose balanceOf reads multiple storage slots and returns a derived value (reflection tokens), checkSlotMutatesCall never finds a matching slot, and the loop never breaks — causing deal() to hang indefinitely.

Fix: for (uint256 i = reads.length; i > 0;) { --i; ... }

Additionally, caps the number of storage slots checked to 256 to prevent excessive RPC calls on contracts with complex storage access patterns.

Adds a regression test with a mock reflection token and a fork test with BabyDoge on BSC.

Closes #740
Closes #409

Co-Authored-By: DaniPopes 57450786+DaniPopes@users.noreply.github.com

Prompted by: DaniPopes

Co-Authored-By: DaniPopes <57450786+DaniPopes@users.noreply.github.com>
@DaniPopes DaniPopes merged commit f5495c9 into foundry-rs:master Mar 15, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(StdCheats): deal() hangs on reflection tokens bug(StdStorage): find() hangs when dealing tokens with custom balanceOf

2 participants