Repository: crytic/slither

Issue:
[Bug-Candidate]: slither-read-storage: storage array slots miscalculated in slot layout for shadowed vars
### Describe the issue:

Weird edge case, though this happens with `uint256[50] __gap` quite often.

If there are instances of shadowed vars, slither-read-storage fails to differentiate them in the storage layout.
Only the first instance of the var is printed, and it uses the last instance's slot for the length holder.

### Code example to reproduce the issue:

```js
pragma solidity ^0.8.4;

contract BaseContract{
    uint256 one;
    uint256[50] private __gap;
    uint256 two;
}

contract DerivedContract is BaseContract{
    uint256 three;
    uint256[50] private __gap;
    uint256 four;
}
```

### Version:

0.8.3

### Relevant log output:

```shell
INFO:Slither-read-storage:
Contract 'DerivedContract'
BaseContract.one with type uint256 is located at slot: 0

INFO:Slither-read-storage:
Name: one
Type: uint256
Slot: 0

INFO:Slither-read-storage:
Contract 'DerivedContract'
DerivedContract.__gap with type uint256[50] is located at slot: 53 <-- ** Should be 1 **

INFO:Slither-read-storage:
Name: __gap
Type: uint256[50]
Slot: 53

INFO:Slither-read-storage:
Contract 'DerivedContract'
DerivedContract.__gap with type uint256[50] is located at slot: 53

INFO:Slither-read-storage:
Key: 0
Name: __gap
Type: uint256
Slot: 53

--- snip ---

INFO:Slither-read-storage:
Contract 'DerivedContract'
DerivedContract.__gap with type uint256[50] is located at slot: 53

INFO:Slither-read-storage:
Key: 19
Name: __gap
Type: uint256
Slot: 72

INFO:Slither-read-storage:
Contract 'DerivedContract'
BaseContract.two with type uint256 is located at slot: 51

INFO:Slither-read-storage:
Name: two
Type: uint256
Slot: 51

INFO:Slither-read-storage:
Contract 'DerivedContract'
DerivedContract.three with type uint256 is located at slot: 52

INFO:Slither-read-storage:
Name: three
Type: uint256
Slot: 52

** DerivedContract.__gap should be here with slot 53 ** 

INFO:Slither-read-storage:
Contract 'DerivedContract'
DerivedContract.four with type uint256 is located at slot: 103

INFO:Slither-read-storage:
Name: four
Type: uint256
Slot: 103
```



Discussion:
Good find. We should be using `contract.state_variables_ordered` here: https://github.com/crytic/slither/blob/db703d82f4876e30f1ca10fb78d85b4dd4c31ec1/slither/tools/read_storage/read_storage.py#L238
Need to document the difference here: 
https://github.com/crytic/slither/blob/db703d82f4876e30f1ca10fb78d85b4dd4c31ec1/slither/core/declarations/contract.py#L291-L311

Resolving patch:
diff --git a/slither/tools/read_storage/read_storage.py b/slither/tools/read_storage/read_storage.py
--- a/slither/tools/read_storage/read_storage.py
+++ b/slither/tools/read_storage/read_storage.py
@@ -253,7 +253,7 @@ def get_all_storage_variables(self, func: Callable = None) -> None:
                     func,
                     [
                         (contract, var)
-                        for var in contract.variables
+                        for var in contract.state_variables_ordered
                         if not var.is_constant and not var.is_immutable
                     ],
                 )


Test patch: