'NoneType' object has no attribute 'type'

[mrice32]

We're seeing an undefined property-related crash in our testing. We began using chained calls to Open Zeppelin's SafeMath library more heavily, and we started seeing this crash. I wasn't able to figure out exactly what caused the crash other than a chain of calls along with certain overloaded functions being declared. The following is Slither's output:

ERROR:root:Error in contracts/Broken.sol
ERROR:root:Traceback (most recent call last):
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/__main__.py", line 236, in main_impl
    (results, number_contracts) = process(filename, args, detector_classes, printer_classes)
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/__main__.py", line 35, in process
    slither = Slither(filename, args.solc, args.disable_solc_warnings, args.solc_args, ast)
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/slither.py", line 41, in __init__
    self._analyze_contracts()
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/solc_parsing/slitherSolc.py", line 191, in _analyze_contracts
    self._convert_to_slithir()
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/solc_parsing/slitherSolc.py", line 317, in _convert_to_slithir
    func.convert_expression_to_slithir()
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/solc_parsing/declarations/function.py", line 842, in convert_expression_to_slithir
    node.slithir_generation()
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/core/cfg/node.py", line 368, in slithir_generation
    self._find_read_write_call()
  File "/Users/matt/anaconda3/lib/python3.7/site-packages/slither_analyzer-0.4.0-py3.7.egg/slither/core/cfg/node.py", line 401, in _find_read_write_call
    self._high_level_calls.append((ir.destination.type.type, ir.function))
AttributeError: 'NoneType' object has no attribute 'type'

This is the minified example contract that I was able to produce (I copied a portion of the SafeMath library into the contract to remove the dependency):

/*
  Test
*/
pragma solidity ^0.5.0;

/**
 * @title SafeMath
 * @dev Math operations with safety checks that revert on error
 */
library SafeMath {
    int256 constant private INT256_MIN = -2**255;

    /**
    * @dev Multiplies two unsigned integers, reverts on overflow.
    */
    function mul(uint256 a, uint256 b) internal pure returns (uint256) {
        // Gas optimization: this is cheaper than requiring 'a' not being zero, but the
        // benefit is lost if 'b' is also tested.
        // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522
        if (a == 0) {
            return 0;
        }

        uint256 c = a * b;
        require(c / a == b);

        return c;
    }

    /**
    * @dev Multiplies two signed integers, reverts on overflow.
    */
    function mul(int256 a, int256 b) internal pure returns (int256) {
        // Gas optimization: this is cheaper than requiring 'a' not being zero, but the
        // benefit is lost if 'b' is also tested.
        // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522
        if (a == 0) {
            return 0;
        }

        require(!(a == -1 && b == INT256_MIN)); // This is the only case of overflow not detected by the check below

        int256 c = a * b;
        require(c / a == b);

        return c;
    }

    /**
    * @dev Integer division of two signed integers truncating the quotient, reverts on division by zero.
    */
    function div(int256 a, int256 b) internal pure returns (int256) {
        require(b != 0); // Solidity only automatically asserts when dividing by 0
        require(!(b == -1 && a == INT256_MIN)); // This is the only case of overflow

        int256 c = a / b;

        return c;
    }

    /**
    * @dev Subtracts two signed integers, reverts on overflow.
    */
    function sub(int256 a, int256 b) internal pure returns (int256) {
        int256 c = a - b;
        require((b >= 0 && c <= a) || (b < 0 && c > a));

        return c;
    }
}


contract Computer {
    using SafeMath for int;
    function computeReturn(int in1, int in2) external pure returns (int out) {
        return in1.mul(1 ether).div(in2).sub(1 ether);
    }
}

The curious part is that if I remove the uint version of the mul() function, Slither stops crashing. Also, if I remove any of the calls in the chain (in1.mul(1 ether).div(in2).sub(1 ether);), Slither stops crashing. Please let me know if you need any other information or have trouble reproducing this on your end.

[montyly]

Hi @mrice32 , thank you for this report!

The issue is that Solidity allows implicit conversion from uint256 to int256 on signature lookup (in this case it does mul(int(1 ether))). I fixed it in the dev branch. I am going to perform more thorough tests and merge it to master soon

[mrice32]

Thank you!

[Bereket-G]

Why is this issue closed ? The error still persisted on the latest version also.

[montyly]

Hi @Bereket-G, can you give more details?

Running slither 0.8.0 on the example above does not lead to any issue on my local test.

[amber0515]

Yea, it's true, The error still persisted on 0.8.2. I cant find any clue in the error. Here is the error message:

Traceback (most recent call last):
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 743, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 84, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 69, in process_single
    return _process(slither, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 110, in _process
    detector_results = slither.run_detectors()
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in run_detectors
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in <listcomp>
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/abstract_detector.py", line 152, in detect
    for r in [output.data for output in self._detect()]:
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 89, in _detect
    values = detect_delegatecall_in_loop(c)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 13, in detect_delegatecall_in_loop
    delegatecall_in_loop(f.entry_point, 0, [], results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 38, in delegatecall_in_loop
    delegatecall_in_loop(ir.function.entry_point, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 25, in delegatecall_in_loop
    if node.type == NodeType.STARTLOOP:
AttributeError: 'NoneType' object has no attribute 'type'
None
Error in .
Traceback (most recent call last):
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 743, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 84, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 69, in process_single
    return _process(slither, detector_classes, printer_classes)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/__main__.py", line 110, in _process
    detector_results = slither.run_detectors()
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in run_detectors
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/slither.py", line 203, in <listcomp>
    results = [d.detect() for d in self._detectors]
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/abstract_detector.py", line 152, in detect
    for r in [output.data for output in self._detect()]:
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 89, in _detect
    values = detect_delegatecall_in_loop(c)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 13, in detect_delegatecall_in_loop
    delegatecall_in_loop(f.entry_point, 0, [], results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 41, in delegatecall_in_loop
    delegatecall_in_loop(son, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 38, in delegatecall_in_loop
    delegatecall_in_loop(ir.function.entry_point, in_loop_counter, visited, results)
  File "/opt/homebrew/lib/python3.9/site-packages/slither/detectors/statements/delegatecall_in_loop.py", line 25, in delegatecall_in_loop
    if node.type == NodeType.STARTLOOP:
AttributeError: 'NoneType' object has no attribute 'type'

[smonicas]

Hi @amber0515, your issue seems related to a specific detector, for a temporary fix can you try run slither with --exclude delegatecall-loop. Could you also open a new issue so we can track it better? Thank you.

[amber0515]

Hi @amber0515, your issue seems related to a specific detector, for a temporary fix can you try run slither with --exclude delegatecall-loop. Could you also open a new issue so we can track it better? Thank you.

I just know what's wrong with this error. I make the contract upgradeable by use "@openzeppelin/contracts-upgradeable": "^4.5.1". when I remove this dependecy everything works fine.

[itinance]

Is there any news about this? Slither 0.8.3 breaks with this error on all projects I could find for testing ...

[umair-mirza]

Still facing this issue. Doesn't seem to be fixed yet.

[0xalpharush]

@umair-mirza this is a general python error so it could be caused by an assortment of errors in the code. Could you share a codebase/ solidity snippet that causes the issue?

[b1acKr0se]

@itinance @umair-mirza I also used to get this problem on Slither 0.8.3 but it seems to be fixed in 0.9.0.

[umair-mirza]

@b1acKr0se you're a life saver. Thank you so much for helping out. Upgrading it worked for me.

[umair-mirza]

@0xalpharush apparently there's a bug in 0.8.3. upgrading it like @b1acKr0se suggested worked!