Write After Write

Overview

The write-after-write detector identifies storage locations that are written to multiple times within the same function execution without an intervening read. The first write is completely overwritten by the second, making it dead code. While this always wastes gas (each SSTORE costs at minimum 100 gas), it can also indicate a logic error where the developer intended to use different storage slots or expected the first value to be read before overwriting.

Why This Is an Issue

A redundant SSTORE that is always overwritten serves no purpose and costs gas. More importantly, it often signals a copy-paste error or variable name confusion. If the developer intended to write to two different storage slots but accidentally used the same one, only the last value persists — silently discarding the first value and breaking the intended state update.

How to Resolve

// Before: Redundant write — first assignment is dead
function updateConfig(uint256 newFee, uint256 newCap) external onlyOwner {
    config.fee = newFee;
    config.fee = newCap;  // Bug: should be config.cap = newCap
}

// After: Fixed — correct storage target
function updateConfig(uint256 newFee, uint256 newCap) external onlyOwner {
    config.fee = newFee;
    config.cap = newCap;
}

Detection Methodology

1. Storage write tracking: Identifies all SSTORE operations and their target slot.
2. Dominator analysis: For each pair of SSTORE operations to the same slot, checks whether the first dominates the second with no intervening SLOAD from that slot.
3. Conditional path filtering: Excludes writes on different conditional branches (where only one executes per transaction).
4. Cross-function filtering: Only flags writes within the same function execution path.

Limitations

False positives: Intentional state initialization followed by an update in a setup pattern (e.g., setting a default then conditionally overwriting) may be flagged. False negatives: Writes to dynamically computed slots where the detector cannot prove the slots are identical may be missed.

Related Detectors

• Gas Optimization — detects gas inefficiencies broadly
• Business Logic Error — detects logic issues

References

• Solidity Docs — Gas Costs
• EIP-2200: Structured Definitions for Net Gas Metering