inline-assemblylisted

# Inline assembly / Yul auditor ## When this applies - Any `assembly { … }` block - Pure Yul contracts - Solady's heavy use of optimized assembly - Custom delegatecall wrappers, manual memory copy, custom signature verifiers - Gas-optimization-driven assembly substitutions of Solidity primitives ## Detection patterns ### Free-memory-pointer not updated after allocation (HIGH) ```solidity assembly { let ptr := mload(0x40) mstore(ptr, value) // ← didn't bump 0x40, next allocation corrupts } ``` After writing memory, update `mload(0x40)` to past the write. ### Memory clobbering via reused scratch space (HIGH) Yul scratch is `0x00-0x3F`. External calls / Solidity assignments may overwrite. Don't store across foreign-code boundaries. ### Return data not size-checked (HIGH) ```solidity assembly { let ok := call(gas(), target, 0, in, insz, 0, 32) returndatacopy(0, 0, 32) let r := mload(0) // ← if target returned < 32 bytes, r has trailing memory garbage } ``` Check `returndatasize()` before copying. ### Dirty high bits in narrow types (HIGH) A `uint8` read from calldata via `calldataload` has the high 248 bits unmasked. Mask with `and(..., 0xff)` before comparing. ### Returning attacker-controlled memory (HIGH) ```solidity assembly { return(0, calldatasize()) } // ← returns calldata; if function spec says bytes32, parsers blow up ``` ### Mishandling 0x40 / 0x60 (FMP and zero slot) (HIGH) Writing to `0x60` (zero slot) is a known footgun — that slo