Regarding the issues during the slither detection process

[zhangzone]

When conducting detection and analysis of contracts, does Slither convert contract code into a graph structure for analysis?

[0xalpharush]

This is somewhat related to a previous question #2364 for background. Some detectors explore the control flow graph to gather information and visit all of their successors e.g.:

slither/slither/detectors/statements/calls_in_loop.py

Lines 28 to 55 in fdf54f6

	def call_in_loop(
	node: Optional[Node], in_loop_counter: int, visited: List[Node], ret: List[Node]
	) -> None:
	if node is None:
	return
	if node in visited:
	return
	# shared visited
	visited.append(node)
	if node.type == NodeType.STARTLOOP:
	in_loop_counter += 1
	elif node.type == NodeType.ENDLOOP:
	in_loop_counter -= 1
	if in_loop_counter > 0:
	for ir in node.all_slithir_operations():
	if isinstance(ir, (LowLevelCall, HighLevelCall, Send, Transfer)):
	if isinstance(ir, LibraryCall):
	continue
	ret.append(ir.node)
	if isinstance(ir, (InternalCall)):
	assert ir.function
	call_in_loop(ir.function.entry_point, in_loop_counter, visited, ret)
	for son in node.sons:
	call_in_loop(son, in_loop_counter, visited, ret)

It really depends on what you're trying to accomplish. Slither doesn't have a graph of data dependencies but you could think of each operation's result as creating an edge i.e. result = expression creates an edge (result, operation) and the taint analysis is asking "is their a path in the graph from the source to the variable in question" (a reachability query). That is, a variable's dependencies are the transitive closure of its parents.

This recording explains some of how to write an analysis/detector
https://www.youtube.com/watch?v=sC7CHMSP3Dg&t=526s