Finalize new descriptions

vuln_edits
Bernhard Mueller 5 years ago
parent b91911bc38
commit 01e6aaa45e
  1. 6
      mythril/analysis/module/modules/delegatecall.py
  2. 2
      mythril/analysis/module/modules/external_calls.py
  3. 19
      mythril/analysis/module/modules/state_change_external_calls.py
  4. 17
      mythril/analysis/module/modules/suicide.py
  5. 9
      mythril/analysis/module/modules/unchecked_retval.py
  6. 4
      mythril/analysis/module/modules/user_assertions.py

@ -73,9 +73,9 @@ class ArbitraryDelegateCall(DetectionModule):
description_head = "The contract delegates execution to another contract with a user-supplied address."
description_tail = (
"The smart contract delegates execution to a user-supplied address. This could allow an attacker to "
"execute arbitrary code in the context of this contract account and manipulate permanent storage of "
"the account."
"The smart contract delegates execution to a user-supplied address.This could allow an attacker to "
"execute arbitrary code in the context of this contract account and manipulate the state of the "
"contract account or execute actions on its behalf."
)
return [

@ -100,7 +100,7 @@ class ExternalCalls(DetectionModule):
swc_id=REENTRANCY,
title="External Call To User-Supplied Address",
bytecode=state.environment.code.bytecode,
severity="Medium",
severity="Low",
description_head=description_head,
description_tail=description_tail,
constraints=constraints,

@ -19,7 +19,7 @@ log = logging.getLogger(__name__)
DESCRIPTION = """
Check whether there is a state change of the contract after the execution of an external call
Check whether the account state is accesses after the execution of an external call
"""
CALL_LIST = ["CALL", "DELEGATECALL", "CALLCODE"]
@ -69,22 +69,25 @@ class StateChangeCallsAnnotation(StateAnnotation):
logging.debug(
"[EXTERNAL_CALLS] Detected state changes at addresses: {}".format(address)
)
read_or_write = "write"
read_or_write = "Write to"
if global_state.get_current_instruction()["opcode"] == "SLOAD":
read_or_write = "read"
read_or_write = "Read of"
address_type = "user defined" if self.user_defined_address else "fixed"
description_head = "Persistent state {} after call".format(read_or_write)
description_head = "{} persistent state following external call".format(
read_or_write
)
description_tail = (
"The contract account state is changed after an external call to a {} address. "
"Consider that the called contract could re-enter the function before this "
"state change takes place".format(address_type)
"The contract account state is accessed after an external call to a {} address. Note that the callee "
"could re-enter any function in this contract before the state access has occurred. Review the contract "
"logic carefully and consider performing all state operations before executing the external call, "
"especially if the callee is not trusted.".format(address_type)
)
return PotentialIssue(
contract=global_state.environment.active_account.contract_name,
function_name=global_state.environment.active_function_name,
address=address,
title="State change after external call",
title="State access after external call",
severity=severity,
description_head=description_head,
description_tail=description_tail,

@ -63,7 +63,7 @@ class AccidentallyKillable(DetectionModule):
log.debug("SUICIDE in function %s", state.environment.active_function_name)
description_head = "The contract can be killed by anyone."
description_head = "Any sender can cause the contract to self-destruct."
constraints = []
@ -80,15 +80,24 @@ class AccidentallyKillable(DetectionModule):
+ constraints
+ [to == ACTORS.attacker],
)
description_tail = (
"Anyone can kill this contract and withdraw its balance to an arbitrary "
"address."
"Any sender can trigger execution of the SELFDESTRUCT instruction to destroy this "
"contract account and withdraw its balance to an arbitrary address. Review the transaction trace "
"generated for this issue and make sure that appropriate security controls are in place to prevent "
"unrestricted access."
)
except UnsatError:
transaction_sequence = solver.get_transaction_sequence(
state, state.world_state.constraints + constraints
)
description_tail = "Arbitrary senders can kill this contract."
description_tail = (
"Any sender can trigger execution of the SELFDESTRUCT instruction to destroy this "
"contract account. Review the transaction trace generated for this issue and make sure that "
"appropriate security controls are in place to prevent unrestricted access."
)
issue = Issue(
contract=state.environment.active_account.contract_name,
function_name=state.environment.active_function_name,

@ -86,9 +86,10 @@ class UncheckedRetval(DetectionModule):
continue
description_tail = (
"External calls return a boolean value. If the callee contract halts with an exception, 'false' is "
"returned and execution continues in the caller. It is usually recommended to wrap external calls "
"into a require statement to prevent unexpected states."
"External calls return a boolean value. If the callee halts with an exception, 'false' is "
"returned and execution continues in the caller. It is often desirable to wrap external calls "
"into a require() statement so the transaction is reverted if the call fails. Make sure that "
"no unexpected behaviour occurs if the call is unsuccessful."
)
issue = Issue(
@ -96,7 +97,7 @@ class UncheckedRetval(DetectionModule):
function_name=state.environment.active_function_name,
address=retval["address"],
bytecode=state.environment.code.bytecode,
title="Unchecked Call Return Value",
title="Unchecked return value from external call.",
swc_id=UNCHECKED_RET_VAL,
severity="Low",
description_head="The return value of a message call is not checked.",

@ -69,11 +69,11 @@ class UserAssertions(DetectionModule):
description_head = "A user-provided assertion failed."
if message:
description_tail = "A user-provided assertion failed with message '{}'. Make sure the user-provided assertion is correct.".format(
description_tail = "A user-provided assertion failed with the message '{}'".format(
message
)
else:
description_tail = "A user-provided assertion failed. Make sure the user-provided assertion is correct."
description_tail = "A user-provided assertion failed."
address = state.get_current_instruction()["address"]
issue = PotentialIssue(

Loading…
Cancel
Save