Inline assembly

Severity: Info ID: inline-assembly

Flags every assembly { ... } block. Inline assembly bypasses many of Solidity's safety features (type checks, overflow checks, memory layout invariants) and is a common source of high-impact bugs, so each occurrence should be reviewed deliberately.

What it does

Reports every inline assembly statement, including blocks declared with the "evmasm" dialect and/or the ("memory-safe") flag. Blocks declared as memory-safe — either via the modern ("memory-safe") flag or the legacy /// @solidity memory-safe-assembly NatSpec marker — are still reported, but with a softer message acknowledging the developer attestation: review focuses on business logic and side effects rather than memory layout.

Why is this bad?

Assembly skips Solidity's compile-time checks and many of its runtime guarantees. Mistakes inside an assembly block can corrupt memory, break the free memory pointer, leak storage, escalate privileges via delegatecall, or destroy the contract via selfdestruct. Even when required for gas or features unavailable in high-level Solidity, assembly should be small, documented, and reviewed.

When inline assembly is reasonable

Some idioms are widely used and generally safe:

• Reading transaction/chain context: chainid(), gas(), returndatasize().
• Probing code: codesize(), extcodesize(addr), extcodehash(addr).
• Reading the free memory pointer: mload(0x40).
• Cheap hashing of a known memory layout, when paired with ("memory-safe").

If you must use assembly:

1. Keep the block minimal and well-commented.
2. Add the ("memory-safe") flag when the block does not violate Solidity's memory model, so the optimizer (and reviewers) can rely on it. The legacy /// @solidity memory-safe-assembly NatSpec marker on the line directly above the block is also recognized for compatibility with older codebases.
3. Suppress the lint locally to mark the block as audited:
   solidityCopy

   // forge-lint: disable-next-line(inline-assembly)
   assembly ("memory-safe") { /* reviewed: ... */ }
   

Example

Bad

function rawCall(address target, bytes calldata data) external returns (bytes memory) {
    assembly {
        let ok := call(gas(), target, 0, add(data.offset, 0), data.length, 0, 0)
        // ...
    }
}

Good

function rawCall(address target, bytes calldata data) external returns (bytes memory result) {
    bool ok;
    (ok, result) = target.call(data);
    require(ok, "call failed");
}