The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
### Transaction Sequence
Caller: [ATTACKER], data: 0x5a6814ec, value: 0x0
## Unchecked Call Return Value
- SWC ID: 104
- Severity: Low
@ -26,6 +31,7 @@ The callee address of an external message call can be set by the caller. Note th
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
## External Call To User-Supplied Address
- SWC ID: 107
- Severity: Medium
@ -39,6 +45,11 @@ External calls return a boolean value. If the callee contract halts with an exce
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
### Transaction Sequence
Caller: [ATTACKER], data: 0xd24b08cc, value: 0x0
## Unchecked Call Return Value
- SWC ID: 104
- Severity: Low
@ -52,6 +63,7 @@ The callee address of an external message call can be set by the caller. Note th
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
## External Call To User-Supplied Address
- SWC ID: 107
- Severity: Medium
@ -65,6 +77,11 @@ External calls return a boolean value. If the callee contract halts with an exce
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
### Transaction Sequence
Caller: [ATTACKER], data: 0xe11f493e, value: 0x0
## Unchecked Call Return Value
- SWC ID: 104
- Severity: Low
@ -78,6 +95,7 @@ The callee address of an external message call can be set by the caller. Note th
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
## State change after external call
- SWC ID: 107
- Severity: Medium
@ -91,6 +109,7 @@ External calls return a boolean value. If the callee contract halts with an exce
The contract account state is changed after an external call.
Consider that the called contract could re-enter the function before this state change takes place. This can lead to business logic vulnerabilities.
## External Call To User-Supplied Address
- SWC ID: 107
- Severity: Medium
@ -104,6 +123,11 @@ Consider that the called contract could re-enter the function before this state
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
@ -116,3 +140,4 @@ The callee address of an external message call can be set by the caller. Note th
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
--------------------
Transaction Sequence:
Caller: [ATTACKER], data: 0x5a6814ec, value: 0x0
==== Unchecked Call Return Value ====
SWC ID: 104
@ -30,6 +33,9 @@ Estimated Gas Usage: 687 - 1298
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
--------------------
Transaction Sequence:
Caller: [ATTACKER], data: 0xd24b08cc, value: 0x0
==== Unchecked Call Return Value ====
SWC ID: 104
@ -52,6 +58,9 @@ Estimated Gas Usage: 709 - 1320
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
--------------------
Transaction Sequence:
Caller: [ATTACKER], data: 0xe11f493e, value: 0x0
==== Unchecked Call Return Value ====
SWC ID: 104
@ -85,6 +94,9 @@ Estimated Gas Usage: 335 - 616
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
Anyone can withdraw ETH from the contract account.
Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
### Transaction Sequence
Caller: [ATTACKER], data: 0x6c343ffe, value: 0x0
## Integer Overflow
- SWC ID: 101
- Severity: High
@ -25,3 +30,8 @@ Arbitrary senders other than the contract creator can withdraw ETH from the cont
The binary addition can overflow.
The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion.
Anyone can withdraw ETH from the contract account.
Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
--------------------
Transaction Sequence:
Caller: [ATTACKER], data: 0x6c343ffe, value: 0x0
==== Integer Overflow ====
SWC ID: 101
@ -19,4 +22,7 @@ Estimated Gas Usage: 6598 - 26883
The binary addition can overflow.
The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
@ -26,6 +31,11 @@ It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused b
A reachable exception has been detected.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
### Transaction Sequence
Caller: [SOMEGUY], data: 0x92dd38ea80, value: 0x0
## Exception State
- SWC ID: 110
- Severity: Low
@ -39,6 +49,11 @@ It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused b
A reachable exception has been detected.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
@ -51,3 +66,8 @@ It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused b
A reachable exception has been detected.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
--------------------
Transaction Sequence:
Caller: [SOMEGUY], data: 0x92dd38ea80, value: 0x0
==== Exception State ====
SWC ID: 110
@ -30,6 +36,9 @@ Estimated Gas Usage: 272 - 367
A reachable exception has been detected.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
## Use of callcode
- SWC ID: 111
- Severity: Medium
@ -26,6 +27,7 @@ External calls return a boolean value. If the callee contract halts with an exce
Use of callcode is deprecated.
The callcode method executes code of another contract in the context of the caller account. Due to a bug in the implementation it does not persist sender and value over the call. It was therefore deprecated and may be removed in the future. Use the delegatecall method instead.
## Delegatecall Proxy To User-Supplied Address
- SWC ID: 112
- Severity: Medium
@ -39,6 +41,11 @@ The callcode method executes code of another contract in the context of the call
The contract delegates execution to another contract with a user-supplied address.
The smart contract delegates execution to a user-supplied address. Note that callers can execute arbitrary contracts and that the callee contract can access the storage of the calling contract.
@ -52,6 +59,7 @@ The smart contract delegates execution to a user-supplied address. Note that cal
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
## External Call To User-Supplied Address
- SWC ID: 107
- Severity: Medium
@ -65,6 +73,11 @@ External calls return a boolean value. If the callee contract halts with an exce
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
@ -77,3 +90,4 @@ The callee address of an external message call can be set by the caller. Note th
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
@ -30,6 +30,9 @@ Estimated Gas Usage: 1176 - 35928
The contract delegates execution to another contract with a user-supplied address.
The smart contract delegates execution to a user-supplied address. Note that callers can execute arbitrary contracts and that the callee contract can access the storage of the calling contract.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
Anyone can withdraw ETH from the contract account.
Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
Anyone can withdraw ETH from the contract account.
Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
The smart contract retrieves the transaction origin (tx.origin) using msg.origin. Use of msg.origin is deprecated and the instruction may be removed in the future. Use msg.sender instead.
See also: https://solidity.readthedocs.io/en/develop/security-considerations.html#tx-origin
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -26,6 +31,11 @@ The operands of the subtraction operation are not sufficiently constrained. The
The binary subtraction can underflow.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -38,3 +48,8 @@ The operands of the subtraction operation are not sufficiently constrained. The
The binary addition can overflow.
The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -19,6 +22,9 @@ Estimated Gas Usage: 17019 - 78155
The binary subtraction can underflow.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -30,4 +36,7 @@ Estimated Gas Usage: 17019 - 78155
The binary addition can overflow.
The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
### Transaction Sequence
Caller: [ATTACKER], data: 0x633ab5e0, value: 0x0
## External Call To User-Supplied Address
- SWC ID: 107
- Severity: Medium
@ -26,6 +31,11 @@ The callee address of an external message call can be set by the caller. Note th
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
### Transaction Sequence
Caller: [ATTACKER], data: 0xe3bea282, value: 0x0
## Unchecked Call Return Value
- SWC ID: 104
- Severity: Low
@ -38,3 +48,4 @@ The callee address of an external message call can be set by the caller. Note th
The return value of a message call is not checked.
External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
--------------------
Transaction Sequence:
Caller: [ATTACKER], data: 0x633ab5e0, value: 0x0
==== External Call To User-Supplied Address ====
SWC ID: 107
@ -19,6 +22,9 @@ Estimated Gas Usage: 621 - 1232
A call to a user-supplied address is executed.
The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -26,6 +31,11 @@ The operands of the subtraction operation are not sufficiently constrained. The
The binary subtraction can underflow.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -38,3 +48,8 @@ The operands of the subtraction operation are not sufficiently constrained. The
The binary addition can overflow.
The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -19,6 +22,9 @@ Estimated Gas Usage: 11915 - 52861
The binary subtraction can underflow.
The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion.
@ -30,4 +36,7 @@ Estimated Gas Usage: 11915 - 52861
The binary addition can overflow.
The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion.