Skip to content

Fix incorrect-equality false positives for boundary constants#2952

Open
ep0chzer0 wants to merge 2 commits intocrytic:masterfrom
ep0chzer0:fix/incorrect-equality-magic-numbers
Open

Fix incorrect-equality false positives for boundary constants#2952
ep0chzer0 wants to merge 2 commits intocrytic:masterfrom
ep0chzer0:fix/incorrect-equality-magic-numbers

Conversation

@ep0chzer0
Copy link
Contributor

Summary

  • Comparisons against boundary values (0, type(T).max) should not be flagged as dangerous strict equalities
  • These values cannot be manipulated by an attacker to break the equality check

Root Cause

The detector flags all strict equality comparisons involving tainted values (balances, timestamps, etc.) without considering whether the comparison target is a safe boundary value.

Fix

Added is_comparing_against_safe_constant() method that excludes:

  • Literal 0 - cannot reach zero by adding value
  • type(T).max values - cannot reach max through normal operations

Test Coverage

Updated test file with new cases:

  • good4/good5() - comparing block.timestamp/number == 0 (NOT flagged)
  • TestSafeConstants.good0/1/2() - comparing balance against 0 and type(uint256).max (NOT flagged)
  • bad0/bad1() - comparing against arbitrary values 1, 100 (STILL flagged)

Impact

  • Eliminates false positives for common patterns like balance == 0 and allowance == type(uint256).max
  • Maintains detection of genuinely dangerous comparisons like balance == 100 ether

Fixes #2759

@ep0chzer0 ep0chzer0 requested a review from smonicas as a code owner January 23, 2026 18:53
@ep0chzer0 ep0chzer0 force-pushed the fix/incorrect-equality-magic-numbers branch from 1024666 to 2421551 Compare January 28, 2026 08:01
Comparisons against boundary values like 0 and type(T).max should not
be flagged as dangerous strict equalities because these values cannot
be manipulated by an attacker:

- balance == 0: cannot reach 0 by adding value
- balance == type(uint256).max: cannot reach max by normal operations
- block.timestamp == 0: safe initialization check

Added is_comparing_against_safe_constant() method that excludes:
- Literal 0
- type(T).max values for all integer types

Fixes crytic#2759
Remove TestSolidityKeyword findings that compare against 0,
which are now correctly excluded by the boundary constant fix.
@ep0chzer0 ep0chzer0 force-pushed the fix/incorrect-equality-magic-numbers branch from 2421551 to f85c0fd Compare February 23, 2026 17:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[False-Positive]: incorrect-equality

1 participant