feat(script): add warning for address(this) usage #10295

gap-editor · 2025-04-12T10:45:01Z

Motivation

Users can accidentally use address(this) within forge script contracts, often intending to refer to the script contract itself for operations like transferring ownership or sending tokens during deployment. However, the address(this) in a script context refers to a temporary, locally deployed contract instance used for the simulation. This address does not exist on the target network and relying on it leads to deployment errors or incorrect state on-chain.

This PR introduces a warning mechanism to alert users when address(this) is used during a forge script execution, helping prevent these common mistakes.

Solution

Introduced ScriptAddressWarnInspector:
- Defined a new revm::Inspector implementation named ScriptAddressWarnInspector within crates/evm/evm/src/inspectors/stack.rs.
- This inspector implements the step method, which checks if the currently executing EVM opcode is ADDRESS (0x30).
- If the ADDRESS opcode is detected, it prints a warning message to stderr: "forge script warning: Usage of \address(this)` detected. Script contracts are ephemeral and their addresses should not be relied upon."`
Integrated into InspectorStack:
- Added an optional address_warn_inspector field to the InspectorStackInner struct.
- Added a corresponding address_warn boolean flag and a builder method .address_warn_inspector(bool) to InspectorStackBuilder.
- Updated the InspectorStackBuilder::build method to instantiate ScriptAddressWarnInspector if the address_warn flag is true.
- Modified the Inspector implementation for InspectorStackRefMut to invoke the step method of the address_warn_inspector if it's present.
Enabled for forge script:
- In crates/script/src/lib.rs, within the _get_runner function (which configures the Executor for scripts), modified the ExecutorBuilder chain to call .address_warn_inspector(true). This ensures the warning inspector is always active during forge script runs.

This approach leverages the existing revm inspector system to passively detect the opcode usage without significantly impacting performance and provides a clear warning directly to the user during script execution.

PR Checklist

Added Tests
Added Documentation
No Breaking changes

mattsse

very supportive, some questions.

wdyt @klkvr @grandizzy

mattsse · 2025-04-12T10:48:00Z

crates/script/src/lib.rs

+/// An inspector that warns if the `ADDRESS` (0x30) opcode is used during script execution.
+#[derive(Debug, Clone, Default)]
+pub struct ScriptAddressWarnInspector;


we have this twice now

mattsse · 2025-04-12T10:50:00Z

crates/script/src/lib.rs

+            eprintln!("forge script warning: Usage of `address(this)` detected. Script contracts are ephemeral and their addresses should not be relied upon.");
+        }


Perhaps we also want a level style setting like "warn", "disallow" which could result in a revert?

yeah imo this should revert by default

mattsse · 2025-04-12T10:50:31Z

crates/evm/evm/src/inspectors/stack.rs

+        if self.in_inner_context {
+            return;
+        }


not obvious why we need this now

yeah this seems wrong

klkvr · 2025-04-12T10:57:03Z

crates/evm/evm/src/inspectors/stack.rs

-                &mut self.fuzzer,
-                &mut self.tracer,
-                &mut self.coverage,


why do we need to change this? I would prefer to not change order here without a strong reason

klkvr · 2025-04-12T10:57:43Z

crates/evm/evm/src/inspectors/stack.rs

+        if self.in_inner_context {
+            return;
+        }


yeah this seems wrong

klkvr · 2025-04-12T10:58:44Z

crates/script/src/lib.rs

@@ -629,6 +636,7 @@ impl ScriptConfig {
        if let Some((known_contracts, script_wallets, target)) = cheats_data {
            builder = builder.inspectors(|stack| {
                stack
+                    .address_warn_inspector(true)


doesn't feel right to have this as a entire separate inspector in the stack given that it pretty much does one simple check

should we move it to Cheatcodes @grandizzy ?

I was thinking that would make sense to be in a sepparate one but more generic ScriptExecutionInspector where we could add more (maybe customizable checks like whitelist/blacklist addresses to call?) if needed?

klkvr · 2025-04-12T11:00:02Z

crates/script/src/lib.rs

+    fn step(&mut self, interp: &mut Interpreter, _data: &mut EvmState<'_>) -> InstructionResult {
+        let opcode = interp.current_opcode();
+        if opcode == opcode::ADDRESS {
+            // Using eprintln directly might be too noisy or not the standard way Foundry handles warnings.
+            // Consider integrating with a logger or a dedicated warning mechanism if available.
+            // For now, printing to stderr demonstrates the concept.
+            eprintln!("forge script warning: Usage of `address(this)` detected. Script contracts are ephemeral and their addresses should not be relied upon.");
+        }


I believe right now this will emit warnings for any ADDRESS usage in both tests and scripts

We want to only emit the warning if it's called in the context of script contract

guess an ScriptExecutionInspector attached to script execution would handle this?

grandizzy

can you pls add a test too?

gap-editor added 2 commits April 12, 2025 12:42

Update stack.rs

8d1ac5b

Update lib.rs

57dafc9

gap-editor requested review from DaniPopes, klkvr, mattsse, grandizzy, yash-atreya and zerosnacks as code owners April 12, 2025 10:45

github-project-automation bot added this to Foundry Apr 12, 2025

mattsse requested changes Apr 12, 2025

View reviewed changes

klkvr requested changes Apr 12, 2025

View reviewed changes

grandizzy reviewed Apr 12, 2025

View reviewed changes

gap-editor marked this pull request as draft April 12, 2025 11:13

gap-editor added 3 commits April 12, 2025 13:38

Update lib.rs

37fe4ca

Update stack.rs

3998e16

Create ScriptAddressWarn.t.sol

2bec847

gap-editor requested review from klkvr and mattsse April 12, 2025 11:42

gap-editor marked this pull request as ready for review April 13, 2025 11:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(script): add warning for address(this) usage #10295

feat(script): add warning for address(this) usage #10295

gap-editor commented Apr 12, 2025

mattsse left a comment

mattsse Apr 12, 2025

mattsse Apr 12, 2025

klkvr Apr 12, 2025

mattsse Apr 12, 2025

klkvr Apr 12, 2025

klkvr Apr 12, 2025

klkvr Apr 12, 2025

klkvr Apr 12, 2025

grandizzy Apr 12, 2025 •

edited

Loading

klkvr Apr 12, 2025

grandizzy Apr 12, 2025

grandizzy left a comment

		eprintln!("forge script warning: Usage of `address(this)` detected. Script contracts are ephemeral and their addresses should not be relied upon.");
		}

feat(script): add warning for address(this) usage #10295

Are you sure you want to change the base?

feat(script): add warning for address(this) usage #10295

Conversation

gap-editor commented Apr 12, 2025

Motivation

Solution

PR Checklist

mattsse left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

grandizzy Apr 12, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

grandizzy left a comment

Choose a reason for hiding this comment

grandizzy Apr 12, 2025 •

edited

Loading