diff --git a/mythril/analysis/templates/report_as_markdown.jinja2 b/mythril/analysis/templates/report_as_markdown.jinja2 index d47138e2..4fd73f84 100644 --- a/mythril/analysis/templates/report_as_markdown.jinja2 +++ b/mythril/analysis/templates/report_as_markdown.jinja2 @@ -36,8 +36,8 @@ Caller: {% if step.origin == "0xaffeaffeaffeaffeaffeaffeaffeaffeaffeaffe" %}[CRE {% endif %} {% endfor %} {% endif %} + {% endfor %} {% else %} - The analysis was completed successfully. No issues were detected. {% endif %} diff --git a/mythril/analysis/templates/report_as_text.jinja2 b/mythril/analysis/templates/report_as_text.jinja2 index c9bc3822..dd70bb45 100644 --- a/mythril/analysis/templates/report_as_text.jinja2 +++ b/mythril/analysis/templates/report_as_text.jinja2 @@ -29,6 +29,7 @@ Caller: {% if step.origin == "0xaffeaffeaffeaffeaffeaffeaffeaffeaffeaffe" %}[CRE {% endif %} {% endfor %} {% endif %} + {% endfor %} {% else %} The analysis was completed successfully. No issues were detected. diff --git a/tests/testdata/outputs_expected/calls.sol.o.markdown b/tests/testdata/outputs_expected/calls.sol.o.markdown index 9472f159..dfcde59b 100644 --- a/tests/testdata/outputs_expected/calls.sol.o.markdown +++ b/tests/testdata/outputs_expected/calls.sol.o.markdown @@ -13,6 +13,11 @@ A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0x5a6814ec, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -26,6 +31,7 @@ The callee address of an external message call can be set by the caller. Note th The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + ## External Call To User-Supplied Address - SWC ID: 107 - Severity: Medium @@ -39,6 +45,11 @@ External calls return a boolean value. If the callee contract halts with an exce A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0xd24b08cc, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -52,6 +63,7 @@ The callee address of an external message call can be set by the caller. Note th The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + ## External Call To User-Supplied Address - SWC ID: 107 - Severity: Medium @@ -65,6 +77,11 @@ External calls return a boolean value. If the callee contract halts with an exce A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0xe11f493e, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -78,6 +95,7 @@ The callee address of an external message call can be set by the caller. Note th The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + ## State change after external call - SWC ID: 107 - Severity: Medium @@ -91,6 +109,7 @@ External calls return a boolean value. If the callee contract halts with an exce The contract account state is changed after an external call. Consider that the called contract could re-enter the function before this state change takes place. This can lead to business logic vulnerabilities. + ## External Call To User-Supplied Address - SWC ID: 107 - Severity: Medium @@ -104,6 +123,11 @@ Consider that the called contract could re-enter the function before this state A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0xe1d10f79bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -116,3 +140,4 @@ The callee address of an external message call can be set by the caller. Note th The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + diff --git a/tests/testdata/outputs_expected/calls.sol.o.text b/tests/testdata/outputs_expected/calls.sol.o.text index 6b20a8a3..f78e645c 100644 --- a/tests/testdata/outputs_expected/calls.sol.o.text +++ b/tests/testdata/outputs_expected/calls.sol.o.text @@ -8,6 +8,9 @@ Estimated Gas Usage: 643 - 1254 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0x5a6814ec, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 @@ -30,6 +33,9 @@ Estimated Gas Usage: 687 - 1298 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xd24b08cc, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 @@ -52,6 +58,9 @@ Estimated Gas Usage: 709 - 1320 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xe11f493e, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 @@ -85,6 +94,9 @@ Estimated Gas Usage: 335 - 616 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xe1d10f79bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 diff --git a/tests/testdata/outputs_expected/ether_send.sol.o.markdown b/tests/testdata/outputs_expected/ether_send.sol.o.markdown index 2e1c2a9e..fb7c7857 100644 --- a/tests/testdata/outputs_expected/ether_send.sol.o.markdown +++ b/tests/testdata/outputs_expected/ether_send.sol.o.markdown @@ -13,6 +13,11 @@ Anyone can withdraw ETH from the contract account. Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability. +### Transaction Sequence + +Caller: [ATTACKER], data: 0x6c343ffe, value: 0x0 + + ## Integer Overflow - SWC ID: 101 - Severity: High @@ -25,3 +30,8 @@ Arbitrary senders other than the contract creator can withdraw ETH from the cont The binary addition can overflow. The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion. + +### Transaction Sequence + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x1 + diff --git a/tests/testdata/outputs_expected/ether_send.sol.o.text b/tests/testdata/outputs_expected/ether_send.sol.o.text index 493978be..396d20de 100644 --- a/tests/testdata/outputs_expected/ether_send.sol.o.text +++ b/tests/testdata/outputs_expected/ether_send.sol.o.text @@ -8,6 +8,9 @@ Estimated Gas Usage: 1138 - 1749 Anyone can withdraw ETH from the contract account. Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0x6c343ffe, value: 0x0 ==== Integer Overflow ==== SWC ID: 101 @@ -19,4 +22,7 @@ Estimated Gas Usage: 6598 - 26883 The binary addition can overflow. The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x1 diff --git a/tests/testdata/outputs_expected/exceptions.sol.o.markdown b/tests/testdata/outputs_expected/exceptions.sol.o.markdown index c5da9834..0b52430a 100644 --- a/tests/testdata/outputs_expected/exceptions.sol.o.markdown +++ b/tests/testdata/outputs_expected/exceptions.sol.o.markdown @@ -13,6 +13,11 @@ A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. +### Transaction Sequence + +Caller: [SOMEGUY], data: 0x546455b50000000000000000000000000000000000000000000000000000000000000017, value: 0x0 + + ## Exception State - SWC ID: 110 - Severity: Low @@ -26,6 +31,11 @@ It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused b A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. +### Transaction Sequence + +Caller: [SOMEGUY], data: 0x92dd38ea80, value: 0x0 + + ## Exception State - SWC ID: 110 - Severity: Low @@ -39,6 +49,11 @@ It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused b A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. +### Transaction Sequence + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 + + ## Exception State - SWC ID: 110 - Severity: Low @@ -51,3 +66,8 @@ It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused b A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. + +### Transaction Sequence + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 + diff --git a/tests/testdata/outputs_expected/exceptions.sol.o.text b/tests/testdata/outputs_expected/exceptions.sol.o.text index cfee4d39..69c5679c 100644 --- a/tests/testdata/outputs_expected/exceptions.sol.o.text +++ b/tests/testdata/outputs_expected/exceptions.sol.o.text @@ -8,6 +8,9 @@ Estimated Gas Usage: 206 - 301 A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. -------------------- +Transaction Sequence: + +Caller: [SOMEGUY], data: 0x546455b50000000000000000000000000000000000000000000000000000000000000017, value: 0x0 ==== Exception State ==== SWC ID: 110 @@ -19,6 +22,9 @@ Estimated Gas Usage: 256 - 351 A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. -------------------- +Transaction Sequence: + +Caller: [SOMEGUY], data: 0x92dd38ea80, value: 0x0 ==== Exception State ==== SWC ID: 110 @@ -30,6 +36,9 @@ Estimated Gas Usage: 272 - 367 A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. -------------------- +Transaction Sequence: + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 ==== Exception State ==== SWC ID: 110 @@ -41,4 +50,7 @@ Estimated Gas Usage: 268 - 363 A reachable exception has been detected. It is possible to trigger an exception (opcode 0xfe). Exceptions can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. -------------------- +Transaction Sequence: + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 diff --git a/tests/testdata/outputs_expected/kinds_of_calls.sol.o.markdown b/tests/testdata/outputs_expected/kinds_of_calls.sol.o.markdown index e6f7f11e..84018922 100644 --- a/tests/testdata/outputs_expected/kinds_of_calls.sol.o.markdown +++ b/tests/testdata/outputs_expected/kinds_of_calls.sol.o.markdown @@ -13,6 +13,7 @@ The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + ## Use of callcode - SWC ID: 111 - Severity: Medium @@ -26,6 +27,7 @@ External calls return a boolean value. If the callee contract halts with an exce Use of callcode is deprecated. The callcode method executes code of another contract in the context of the caller account. Due to a bug in the implementation it does not persist sender and value over the call. It was therefore deprecated and may be removed in the future. Use the delegatecall method instead. + ## Delegatecall Proxy To User-Supplied Address - SWC ID: 112 - Severity: Medium @@ -39,6 +41,11 @@ The callcode method executes code of another contract in the context of the call The contract delegates execution to another contract with a user-supplied address. The smart contract delegates execution to a user-supplied address. Note that callers can execute arbitrary contracts and that the callee contract can access the storage of the calling contract. +### Transaction Sequence + +Caller: [ATTACKER], data: 0x9b58bc26bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -52,6 +59,7 @@ The smart contract delegates execution to a user-supplied address. Note that cal The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + ## External Call To User-Supplied Address - SWC ID: 107 - Severity: Medium @@ -65,6 +73,11 @@ External calls return a boolean value. If the callee contract halts with an exce A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0xeea4c864bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -77,3 +90,4 @@ The callee address of an external message call can be set by the caller. Note th The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + diff --git a/tests/testdata/outputs_expected/kinds_of_calls.sol.o.text b/tests/testdata/outputs_expected/kinds_of_calls.sol.o.text index 1bb3abad..54668dab 100644 --- a/tests/testdata/outputs_expected/kinds_of_calls.sol.o.text +++ b/tests/testdata/outputs_expected/kinds_of_calls.sol.o.text @@ -30,6 +30,9 @@ Estimated Gas Usage: 1176 - 35928 The contract delegates execution to another contract with a user-supplied address. The smart contract delegates execution to a user-supplied address. Note that callers can execute arbitrary contracts and that the callee contract can access the storage of the calling contract. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0x9b58bc26bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 @@ -52,6 +55,9 @@ Estimated Gas Usage: 477 - 1229 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xeea4c864bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 diff --git a/tests/testdata/outputs_expected/metacoin.sol.o.markdown b/tests/testdata/outputs_expected/metacoin.sol.o.markdown index 321484fd..51d7ec54 100644 --- a/tests/testdata/outputs_expected/metacoin.sol.o.markdown +++ b/tests/testdata/outputs_expected/metacoin.sol.o.markdown @@ -1,3 +1,2 @@ # Analysis results for None - The analysis was completed successfully. No issues were detected. diff --git a/tests/testdata/outputs_expected/multi_contracts.sol.o.markdown b/tests/testdata/outputs_expected/multi_contracts.sol.o.markdown index a7eac008..a3be3902 100644 --- a/tests/testdata/outputs_expected/multi_contracts.sol.o.markdown +++ b/tests/testdata/outputs_expected/multi_contracts.sol.o.markdown @@ -12,3 +12,8 @@ Anyone can withdraw ETH from the contract account. Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability. + +### Transaction Sequence + +Caller: [ATTACKER], data: 0x8a4068dd, value: 0x0 + diff --git a/tests/testdata/outputs_expected/multi_contracts.sol.o.text b/tests/testdata/outputs_expected/multi_contracts.sol.o.text index a8388020..afad9838 100644 --- a/tests/testdata/outputs_expected/multi_contracts.sol.o.text +++ b/tests/testdata/outputs_expected/multi_contracts.sol.o.text @@ -8,4 +8,7 @@ Estimated Gas Usage: 186 - 467 Anyone can withdraw ETH from the contract account. Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0x8a4068dd, value: 0x0 diff --git a/tests/testdata/outputs_expected/nonascii.sol.o.markdown b/tests/testdata/outputs_expected/nonascii.sol.o.markdown index 321484fd..51d7ec54 100644 --- a/tests/testdata/outputs_expected/nonascii.sol.o.markdown +++ b/tests/testdata/outputs_expected/nonascii.sol.o.markdown @@ -1,3 +1,2 @@ # Analysis results for None - The analysis was completed successfully. No issues were detected. diff --git a/tests/testdata/outputs_expected/origin.sol.o.markdown b/tests/testdata/outputs_expected/origin.sol.o.markdown index 1f5f83ac..3afd57b5 100644 --- a/tests/testdata/outputs_expected/origin.sol.o.markdown +++ b/tests/testdata/outputs_expected/origin.sol.o.markdown @@ -13,3 +13,4 @@ Use of tx.origin is deprecated. The smart contract retrieves the transaction origin (tx.origin) using msg.origin. Use of msg.origin is deprecated and the instruction may be removed in the future. Use msg.sender instead. See also: https://solidity.readthedocs.io/en/develop/security-considerations.html#tx-origin + diff --git a/tests/testdata/outputs_expected/overflow.sol.o.json b/tests/testdata/outputs_expected/overflow.sol.o.json index 16a2253b..1fac0d57 100644 --- a/tests/testdata/outputs_expected/overflow.sol.o.json +++ b/tests/testdata/outputs_expected/overflow.sol.o.json @@ -42,4 +42,4 @@ } ], "success": true -} +} \ No newline at end of file diff --git a/tests/testdata/outputs_expected/overflow.sol.o.jsonv2 b/tests/testdata/outputs_expected/overflow.sol.o.jsonv2 index 53028f4a..d81b5c57 100644 --- a/tests/testdata/outputs_expected/overflow.sol.o.jsonv2 +++ b/tests/testdata/outputs_expected/overflow.sol.o.jsonv2 @@ -63,4 +63,4 @@ ], "sourceType": "raw-bytecode" } -] +] \ No newline at end of file diff --git a/tests/testdata/outputs_expected/overflow.sol.o.markdown b/tests/testdata/outputs_expected/overflow.sol.o.markdown index 82642a1e..845c97e7 100644 --- a/tests/testdata/outputs_expected/overflow.sol.o.markdown +++ b/tests/testdata/outputs_expected/overflow.sol.o.markdown @@ -13,6 +13,11 @@ The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. +### Transaction Sequence + +Caller: [SOMEGUY], data: 0xa3210e87000000000000000000000000000000000000000000000000000000000000000080, value: 0x0 + + ## Integer Underflow - SWC ID: 101 - Severity: High @@ -26,6 +31,11 @@ The operands of the subtraction operation are not sufficiently constrained. The The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. +### Transaction Sequence + +Caller: [SOMEGUY], data: 0xa3210e87000000000000000000000000000000000000000000000000000000000000000080, value: 0x0 + + ## Integer Overflow - SWC ID: 101 - Severity: High @@ -38,3 +48,8 @@ The operands of the subtraction operation are not sufficiently constrained. The The binary addition can overflow. The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion. + +### Transaction Sequence + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 + diff --git a/tests/testdata/outputs_expected/overflow.sol.o.text b/tests/testdata/outputs_expected/overflow.sol.o.text index e70dda5b..7fd1f2cf 100644 --- a/tests/testdata/outputs_expected/overflow.sol.o.text +++ b/tests/testdata/outputs_expected/overflow.sol.o.text @@ -8,6 +8,9 @@ Estimated Gas Usage: 17019 - 78155 The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [SOMEGUY], data: 0xa3210e87000000000000000000000000000000000000000000000000000000000000000080, value: 0x0 ==== Integer Underflow ==== SWC ID: 101 @@ -19,6 +22,9 @@ Estimated Gas Usage: 17019 - 78155 The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [SOMEGUY], data: 0xa3210e87000000000000000000000000000000000000000000000000000000000000000080, value: 0x0 ==== Integer Overflow ==== SWC ID: 101 @@ -30,4 +36,7 @@ Estimated Gas Usage: 17019 - 78155 The binary addition can overflow. The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 diff --git a/tests/testdata/outputs_expected/returnvalue.sol.o.markdown b/tests/testdata/outputs_expected/returnvalue.sol.o.markdown index 5309f405..6ef8b983 100644 --- a/tests/testdata/outputs_expected/returnvalue.sol.o.markdown +++ b/tests/testdata/outputs_expected/returnvalue.sol.o.markdown @@ -13,6 +13,11 @@ A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0x633ab5e0, value: 0x0 + + ## External Call To User-Supplied Address - SWC ID: 107 - Severity: Medium @@ -26,6 +31,11 @@ The callee address of an external message call can be set by the caller. Note th A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. +### Transaction Sequence + +Caller: [ATTACKER], data: 0xe3bea282, value: 0x0 + + ## Unchecked Call Return Value - SWC ID: 104 - Severity: Low @@ -38,3 +48,4 @@ The callee address of an external message call can be set by the caller. Note th The return value of a message call is not checked. External calls return a boolean value. If the callee contract halts with an exception, 'false' is returned and execution continues in the caller. It is usually recommended to wrap external calls into a require statement to prevent unexpected states. + diff --git a/tests/testdata/outputs_expected/returnvalue.sol.o.text b/tests/testdata/outputs_expected/returnvalue.sol.o.text index baff23ea..3836ea12 100644 --- a/tests/testdata/outputs_expected/returnvalue.sol.o.text +++ b/tests/testdata/outputs_expected/returnvalue.sol.o.text @@ -8,6 +8,9 @@ Estimated Gas Usage: 599 - 1210 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0x633ab5e0, value: 0x0 ==== External Call To User-Supplied Address ==== SWC ID: 107 @@ -19,6 +22,9 @@ Estimated Gas Usage: 621 - 1232 A call to a user-supplied address is executed. The callee address of an external message call can be set by the caller. Note that the callee can contain arbitrary code and may re-enter any function in this contract. Review the business logic carefully to prevent averse effects on the contract state. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xe3bea282, value: 0x0 ==== Unchecked Call Return Value ==== SWC ID: 104 diff --git a/tests/testdata/outputs_expected/suicide.sol.o.markdown b/tests/testdata/outputs_expected/suicide.sol.o.markdown index f31b9f3f..286f3573 100644 --- a/tests/testdata/outputs_expected/suicide.sol.o.markdown +++ b/tests/testdata/outputs_expected/suicide.sol.o.markdown @@ -12,3 +12,8 @@ The contract can be killed by anyone. Anyone can kill this contract and withdraw its balance to an arbitrary address. + +### Transaction Sequence + +Caller: [ATTACKER], data: 0xcbf0b0c0bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 + diff --git a/tests/testdata/outputs_expected/suicide.sol.o.text b/tests/testdata/outputs_expected/suicide.sol.o.text index 45dd0295..abd80dd6 100644 --- a/tests/testdata/outputs_expected/suicide.sol.o.text +++ b/tests/testdata/outputs_expected/suicide.sol.o.text @@ -8,4 +8,7 @@ Estimated Gas Usage: 168 - 263 The contract can be killed by anyone. Anyone can kill this contract and withdraw its balance to an arbitrary address. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xcbf0b0c0bebebebebebebebebebebebedeadbeefdeadbeefdeadbeefdeadbeefdeadbeef, value: 0x0 diff --git a/tests/testdata/outputs_expected/underflow.sol.o.json b/tests/testdata/outputs_expected/underflow.sol.o.json index 416d1176..979465f3 100644 --- a/tests/testdata/outputs_expected/underflow.sol.o.json +++ b/tests/testdata/outputs_expected/underflow.sol.o.json @@ -42,4 +42,4 @@ } ], "success": true -} +} \ No newline at end of file diff --git a/tests/testdata/outputs_expected/underflow.sol.o.jsonv2 b/tests/testdata/outputs_expected/underflow.sol.o.jsonv2 index c99aae49..c8b6835e 100644 --- a/tests/testdata/outputs_expected/underflow.sol.o.jsonv2 +++ b/tests/testdata/outputs_expected/underflow.sol.o.jsonv2 @@ -63,4 +63,4 @@ ], "sourceType": "raw-bytecode" } -] +] \ No newline at end of file diff --git a/tests/testdata/outputs_expected/underflow.sol.o.markdown b/tests/testdata/outputs_expected/underflow.sol.o.markdown index acc444d4..23719def 100644 --- a/tests/testdata/outputs_expected/underflow.sol.o.markdown +++ b/tests/testdata/outputs_expected/underflow.sol.o.markdown @@ -13,6 +13,11 @@ The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. +### Transaction Sequence + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 + + ## Integer Underflow - SWC ID: 101 - Severity: High @@ -26,6 +31,11 @@ The operands of the subtraction operation are not sufficiently constrained. The The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. +### Transaction Sequence + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 + + ## Integer Overflow - SWC ID: 101 - Severity: High @@ -38,3 +48,8 @@ The operands of the subtraction operation are not sufficiently constrained. The The binary addition can overflow. The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion. + +### Transaction Sequence + +Caller: [ATTACKER], data: 0xa3210e87000000000000000000000000000000000000000000000000000000000000000020, value: 0x0 + diff --git a/tests/testdata/outputs_expected/underflow.sol.o.text b/tests/testdata/outputs_expected/underflow.sol.o.text index 498ff588..fea13f7c 100644 --- a/tests/testdata/outputs_expected/underflow.sol.o.text +++ b/tests/testdata/outputs_expected/underflow.sol.o.text @@ -8,6 +8,9 @@ Estimated Gas Usage: 11915 - 52861 The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 ==== Integer Underflow ==== SWC ID: 101 @@ -19,6 +22,9 @@ Estimated Gas Usage: 11915 - 52861 The binary subtraction can underflow. The operands of the subtraction operation are not sufficiently constrained. The subtraction could therefore result in an integer underflow. Prevent the underflow by checking inputs or ensure sure that the underflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [CREATOR], data: [CONTRACT CREATION], value: 0x0 ==== Integer Overflow ==== SWC ID: 101 @@ -30,4 +36,7 @@ Estimated Gas Usage: 11915 - 52861 The binary addition can overflow. The operands of the addition operation are not sufficiently constrained. The addition could therefore result in an integer overflow. Prevent the overflow by checking inputs or ensure sure that the overflow is caught by an assertion. -------------------- +Transaction Sequence: + +Caller: [ATTACKER], data: 0xa3210e87000000000000000000000000000000000000000000000000000000000000000020, value: 0x0