Merge branch 'develop' into fixed_tx_count

mythril/analysis/modules/delegatecall.py

@@ -60,7 +60,7 @@ class DelegateCallModule(DetectionModule):
         issue.description = (
             "This contract forwards its call data via DELEGATECALL in its fallback function. "
             "This means that any function in the called contract can be executed. Note that the callee contract will have "
-            "access to the storage of the calling contract.\n "
+            "access to the storage of the calling contract.\n"
         )
 
         target = hex(call.to.val) if call.to.type == VarType.CONCRETE else str(call.to)
@@ -80,7 +80,7 @@ class DelegateCallModule(DetectionModule):
         )
 
         if "calldata" in str(call.to):
-            issue.description = "This contract delegates execution to a contract address obtained from calldata. "
+            issue.description = "This contract delegates execution to a contract address obtained from calldata."
 
         else:
             m = re.search(r"storage_([a-z0-9_&^]+)", str(call.to))
@@ -97,7 +97,7 @@ class DelegateCallModule(DetectionModule):
                         + str(idx)
                         + ". This storage slot can be written to by calling the function `"
                         + func
-                        + "`. "
+                        + "`."
                     )
 
                 else:
@@ -105,7 +105,7 @@ class DelegateCallModule(DetectionModule):
                         "[DELEGATECALL] No storage writes to index " + str(idx)
                     )
 
-        issue.description += "Be aware that the called contract gets unrestricted access to this contract's state."
+        issue.description += " Be aware that the called contract gets unrestricted access to this contract's state."
         return [issue]
 
 

mythril/analysis/modules/ether_thief.py

@@ -5,6 +5,7 @@ from mythril.analysis.report import Issue
 from mythril.analysis.swc_data import UNPROTECTED_ETHER_WITHDRAWAL
 from mythril.analysis.modules.base import DetectionModule
 from mythril.exceptions import UnsatError
+from z3 import BitVecVal, UGT
 import logging
 
 
@@ -12,14 +13,12 @@ DESCRIPTION = """
 
 Search for cases where Ether can be withdrawn to a user-specified address. 
 
-An issue is reported ONLY IF:
+An issue is reported if:
 
 - The transaction sender does not match contract creator;
 - The sender address can be chosen arbitrarily;
 - The receiver address is identical to the sender address;
-- The sender has not previously sent any ETH to the contract account.
-
-This is somewhat coarse and needs to be refined in the future.
+- The sender can withdraw *more* than the total amount they sent over all transactions.
 
 """
 
@@ -61,18 +60,18 @@ class EtherThief(DetectionModule):
         if constrained:
             return []
 
-        try:
+        eth_sent_total = BitVecVal(0, 256)
+
+        for tx in state.world_state.transaction_sequence[1:]:
+            eth_sent_total += tx.call_value
 
-            """
-            FIXME: Instead of solving for call_value > 0, check whether call value can be greater than
-            the total value of all transactions received by the caller
-            """
+        try:
 
             model = solver.get_model(
                 node.constraints
                 + not_creator_constraints
                 + [
-                    call_value > 0,
+                    UGT(call_value, eth_sent_total),
                     state.environment.sender == ARBITRARY_SENDER_ADDRESS,
                     target == state.environment.sender,
                 ]
@@ -83,18 +82,12 @@ class EtherThief(DetectionModule):
                 node.constraints
                 + not_creator_constraints
                 + [
-                    call_value > 0,
+                    call_value > eth_sent_total,
                     state.environment.sender == ARBITRARY_SENDER_ADDRESS,
                     target == state.environment.sender,
                 ],
             )
 
-            # For now we only report an issue if zero ETH has been sent to the contract account.
-
-            for key, value in transaction_sequence.items():
-                if int(value["call_value"], 16) > 0:
-                    return []
-
             debug = "Transaction Sequence: " + str(transaction_sequence)
 
             issue = Issue(
@@ -105,8 +98,9 @@ class EtherThief(DetectionModule):
                 title="Ether thief",
                 _type="Warning",
                 bytecode=state.environment.code.bytecode,
-                description="Users other than the contract creator can withdraw ETH from the contract account"
-                + " without previously having sent any ETH to it. This is likely to be vulnerability.",
+                description="Arbitrary senders other than the contract creator can withdraw ETH from the contract"
+                + " account without previously having sent an equivalent amount of ETH to it. This is likely to be"
+                + " a vulnerability.",
                 debug=debug,
                 gas_used=(state.mstate.min_gas_used, state.mstate.max_gas_used),
             )

mythril/analysis/modules/exceptions.py

@@ -39,7 +39,7 @@ class ReachableExceptionsModule(DetectionModule):
                         )
                         description += (
                             "Note that explicit `assert()` should only be used to check invariants. "
-                            "Use `require()` for regular input checking. "
+                            "Use `require()` for regular input checking."
                         )
 
                         debug = "Transaction Sequence: " + str(

mythril/analysis/modules/transaction_order_dependence.py

@@ -9,10 +9,6 @@ from mythril.analysis.swc_data import TX_ORDER_DEPENDENCE
 from mythril.analysis.modules.base import DetectionModule
 from mythril.exceptions import UnsatError
 
-"""
-MODULE DESCRIPTION:
-"""
-
 
 class TxOrderDependenceModule(DetectionModule):
     def __init__(self):
@@ -61,7 +57,7 @@ class TxOrderDependenceModule(DetectionModule):
 
                 issue.description = (
                     "Possible transaction order dependence vulnerability: The value or "
-                    "direction of the call statement is determined from a tainted storage location"
+                    "direction of the call statement is determined from a tainted storage location."
                 )
                 issues.append(issue)
 

mythril/disassembler/disassembly.py

@@ -23,11 +23,12 @@ class Disassembly(object):
         self.function_name_to_address = {}
         self.address_to_function_name = {}
 
-        signatures = SignatureDb(
-            enable_online_lookup=enable_online_lookup
-        )  # control if you want to have online signature hash lookups
+        signatures = {}
         try:
-            signatures.open()  # open from default locations
+            # open from default locations
+            signatures = SignatureDb(
+                enable_online_lookup=enable_online_lookup
+            )  # control if you want to have online signature hash lookups
         except FileNotFoundError:
             logging.info(
                 "Missing function signature file. Resolving of function names from signature file disabled."
@@ -48,8 +49,6 @@ class Disassembly(object):
                 self.function_name_to_address[function_name] = jump_target
                 self.address_to_function_name[jump_target] = function_name
 
-        signatures.write()  # store resolved signatures (potentially resolved online)
-
     def get_easm(self):
         return asm.instruction_list_to_easm(self.instruction_list)
 

mythril/laser/ethereum/state/account.py

@@ -75,7 +75,7 @@ class Account:
         """
         self.nonce = 0
         self.code = code or Disassembly("")
-        self.balance = balance if balance else BitVec("balance", 256)
+        self.balance = balance if balance else BitVec("{}_balance".format(address), 256)
         self.storage = Storage(
             concrete_storage, address=address, dynamic_loader=dynamic_loader
         )

mythril/mythril.py

@@ -94,25 +94,16 @@ class Mythril(object):
 
         self.mythril_dir = self._init_mythril_dir()
 
-        self.sigs = signatures.SignatureDb(
-            enable_online_lookup=self.enable_online_lookup
-        )
+        self.sigs = {}
         try:
-            self.sigs.open()  # tries mythril_dir/signatures.json by default (provide path= arg to make this configurable)
-        except FileNotFoundError:
-            logging.info(
-                "No signature database found. Creating database if sigs are loaded in: "
-                + self.sigs.signatures_file
-                + "\n"
-                + "Consider replacing it with the pre-initialized database at https://raw.githubusercontent.com/ConsenSys/mythril/master/signatures.json"
-            )
-        except json.JSONDecodeError as jde:
-            raise CriticalError(
-                "Invalid JSON in signatures file "
-                + self.sigs.signatures_file
-                + "\n"
-                + str(jde)
+            # tries mythril_dir/signatures.json by default (provide path= arg to make this configurable)
+            self.sigs = signatures.SignatureDb(
+                enable_online_lookup=self.enable_online_lookup
             )
+        except FileNotFoundError as e:
+            logging.info(str(e))
+        except json.JSONDecodeError as e:
+            raise CriticalError(str(e))
 
         self.solc_binary = self._init_solc_binary(solv)
         self.config_path = os.path.join(self.mythril_dir, "config.ini")

mythril/support/signatures.py

@@ -7,6 +7,7 @@ import json
 import time
 import logging
 
+from collections import defaultdict
 from subprocess import Popen, PIPE
 from mythril.exceptions import CompilerError
 
@@ -52,23 +53,31 @@ except ImportError:
         msvcrt.locking(f.fileno(), msvcrt.LK_UNLCK, file_size(f))
 
 
-class SignatureDb(object):
+class Singleton(type):
+    _instances = {}
+
+    def __call__(cls, *args, **kwargs):
+        if cls not in cls._instances:
+            cls._instances[cls] = super(Singleton, cls).__call__(*args, **kwargs)
+        return cls._instances[cls]
+
+
+class SignatureDb(object, metaclass=Singleton):
     def __init__(self, enable_online_lookup=False):
         """
         Constr
         :param enable_online_lookup: enable onlien signature hash lookup
         """
-        self.signatures = {}  # signatures in-mem cache
+        self.signatures = defaultdict(list)  # signatures in-mem cache
         self.signatures_file = None
         self.enable_online_lookup = (
             enable_online_lookup
         )  # enable online funcsig resolving
-        self.online_lookup_miss = (
-            set()
-        )  # temporarily track misses from onlinedb to avoid requesting the same non-existent sighash multiple times
-        self.online_directory_unavailable_until = (
-            0
-        )  # flag the online directory as unavailable for some time
+        # temporarily track misses from onlinedb to avoid requesting the same non-existent sighash multiple times
+        self.online_lookup_miss = set()
+        # flag the online directory as unavailable for some time
+        self.online_directory_unavailable_until = 0
+        self.open()
 
     def open(self, path=None):
         """
@@ -85,32 +94,52 @@ class SignatureDb(object):
                 mythril_dir = os.path.join(os.path.expanduser("~"), ".mythril")
             path = os.path.join(mythril_dir, "signatures.json")
 
-        self.signatures_file = (
-            path
-        )  # store early to allow error handling to access the place we tried to load the file
+        # store early to allow error handling to access the place we tried to load the file
+        self.signatures_file = path
         if not os.path.exists(path):
             logging.debug("Signatures: file not found: %s" % path)
             raise FileNotFoundError(
-                "Missing function signature file. Resolving of function names disabled."
+                (
+                    "Could not find signature file in {}. Function name resolution disabled.\n"
+                    "Consider replacing it with the pre-initialized database at "
+                    "https://raw.githubusercontent.com/ConsenSys/mythril/master/signatures.json"
+                ).format(path)
             )
 
         with open(path, "r") as f:
             lock_file(f)
             try:
                 sigs = json.load(f)
+            except json.JSONDecodeError as e:
+                # reraise with path
+                raise json.JSONDecodeError(
+                    "Invalid JSON in the signatures file {}: {}".format(path, str(e))
+                )
             finally:
                 unlock_file(f)
 
-        # normalize it to {sighash:list(signatures,...)}
+        # assert signature file format
         for sighash, funcsig in sigs.items():
-            if isinstance(funcsig, list):
-                self.signatures = sigs
-                break  # already normalized
-            self.signatures.setdefault(sighash, [])
-            self.signatures[sighash].append(funcsig)
+            if (
+                not sighash.startswith("0x")
+                or len(sighash) != 10
+                or not isinstance(funcsig, list)
+            ):
+                raise ValueError(
+                    "Malformed signature file at {}. {}: {} is not a valid entry".format(
+                        path, sighash, funcsig
+                    )
+                )
+        self.signatures = defaultdict(list, sigs)
 
         return self
 
+    def update_signatures(self, new_signatures):
+        for sighash, funcsigs in new_signatures.items():
+            # eliminate duplicates
+            updated_funcsigs = set(funcsigs + self.signatures[sighash])
+            self.signatures[sighash] = list(updated_funcsigs)
+
     def write(self, path=None, sync=True):
         """
         Write signatures database as json to file
@@ -131,10 +160,7 @@ class SignatureDb(object):
                 finally:
                     unlock_file(f)
 
-            sigs.update(
-                self.signatures
-            )  # reload file and merge cached sigs into what we load from file
-            self.signatures = sigs
+            self.update_signatures(sigs)
 
         if directory and not os.path.exists(directory):
             os.makedirs(directory)  # create folder structure if not existS
@@ -145,7 +171,7 @@ class SignatureDb(object):
         with open(path, "r+") as f:  # placing 'w+' here will result in race conditions
             lock_file(f, exclusive=True)
             try:
-                json.dump(self.signatures, f)
+                json.dump(self.signatures, f, indent=4, sort_keys=True)
             finally:
                 unlock_file(f)
 
@@ -178,7 +204,7 @@ class SignatureDb(object):
                 )  # might return multiple sigs
                 if funcsigs:
                     # only store if we get at least one result
-                    self.signatures[sighash] = funcsigs
+                    self.update_signatures({sighash: funcsigs})
                 else:
                     # miss
                     self.online_lookup_miss.add(sighash)
@@ -213,8 +239,8 @@ class SignatureDb(object):
         :param file_path: solidity source code file path
         :return: self
         """
-        self.signatures.update(
-            SignatureDb.get_sigs_from_file(
+        self.update_signatures(
+            self.get_sigs_from_file(
                 file_path, solc_binary=solc_binary, solc_args=solc_args
             )
         )

tests/analysis/test_delegatecall.py

@@ -44,7 +44,7 @@ def test_concrete_call():
         == "This contract forwards its call data via DELEGATECALL in its fallback function."
         " This means that any function in the called contract can be executed."
         " Note that the callee contract will have access to the storage of the "
-        "calling contract.\n DELEGATECALL target: 0x1"
+        "calling contract.\nDELEGATECALL target: 0x1"
     )
 
 
@@ -76,12 +76,11 @@ def test_concrete_call_symbolic_to():
     assert issue.function == node.function_name
     assert issue.title == "Call data forwarded with delegatecall()"
     assert issue.type == "Informational"
-    assert (
-        issue.description
-        == "This contract forwards its call data via DELEGATECALL in its fallback function."
+    assert issue.description == (
+        "This contract forwards its call data via DELEGATECALL in its fallback function."
         " This means that any function in the called contract can be executed."
         " Note that the callee contract will have access to the storage of the "
-        "calling contract.\n DELEGATECALL target: calldata_3"
+        "calling contract.\nDELEGATECALL target: calldata_3"
     )
 
 
@@ -131,11 +130,10 @@ def test_symbolic_call_storage_to(mocker):
     assert issue.function == node.function_name
     assert issue.title == "Type:  to a user-supplied address"
     assert issue.type == "Informational"
-    assert (
-        issue.description
-        == "This contract delegates execution to a contract address in storage slot 1."
-        " This storage slot can be written to by calling the function `Function name`. "
-        "Be aware that the called contract gets unrestricted access to this contract's state."
+    assert issue.description == (
+        "This contract delegates execution to a contract address in storage slot 1."
+        " This storage slot can be written to by calling the function `Function name`."
+        " Be aware that the called contract gets unrestricted access to this contract's state."
     )
 
 
@@ -172,10 +170,9 @@ def test_symbolic_call_calldata_to(mocker):
     assert issue.function == node.function_name
     assert issue.title == "Type:  to a user-supplied address"
     assert issue.type == "Informational"
-    assert (
-        issue.description
-        == "This contract delegates execution to a contract address obtained from calldata. "
-        "Be aware that the called contract gets unrestricted access to this contract's state."
+    assert issue.description == (
+        "This contract delegates execution to a contract address obtained from calldata."
+        " Be aware that the called contract gets unrestricted access to this contract's state."
     )
 
 

tests/testdata/outputs_expected/calls.sol.o.json

@@ -6,7 +6,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "This contract executes a message call to to another contract. Make sure that the called contract is trusted and does not execute user-supplied code.",
-      "function": "_function_0x5a6814ec",
+      "function": "thisisfine()",
       "swc-id": "107",
       "min_gas_used": 643,
       "max_gas_used": 1254,
@@ -18,7 +18,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "The return value of an external call is not checked. Note that execution continue even if the called contract throws.",
-      "function": "_function_0x5a6814ec",
+      "function": "thisisfine()",
       "swc-id": "104",
       "min_gas_used": 1352,
       "max_gas_used": 35963,
@@ -29,8 +29,8 @@
       "address": 779,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "This contract executes a message call to an address found at storage slot 1. This storage slot can be written to by calling the function `_function_0x2776b163`. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.",
-      "function": "_function_0xd24b08cc",
+      "description": "This contract executes a message call to an address found at storage slot 1. This storage slot can be written to by calling the function `setstoredaddress(address)`. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.",
+      "function": "callstoredaddress()",
       "swc-id": "107",
       "min_gas_used": 687,
       "max_gas_used": 1298,
@@ -41,8 +41,8 @@
       "address": 779,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "Possible transaction order dependence vulnerability: The value or direction of the call statement is determined from a tainted storage location",
-      "function": "_function_0xd24b08cc",
+      "description": "Possible transaction order dependence vulnerability: The value or direction of the call statement is determined from a tainted storage location.",
+      "function": "callstoredaddress()",
       "swc-id": "114",
       "min_gas_used": 687,
       "max_gas_used": 1298,
@@ -54,7 +54,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "The return value of an external call is not checked. Note that execution continue even if the called contract throws.",
-      "function": "_function_0xd24b08cc",
+      "function": "callstoredaddress()",
       "swc-id": "104",
       "min_gas_used": 1396,
       "max_gas_used": 36007,
@@ -102,7 +102,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "This contract executes a message call to an address provided as a function argument. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.",
-      "function": "_function_0xe1d10f79",
+      "function": "calluseraddress(address)",
       "swc-id": "107",
       "min_gas_used": 335,
       "max_gas_used": 616,
@@ -114,7 +114,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "The return value of an external call is not checked. Note that execution continue even if the called contract throws.",
-      "function": "_function_0xe1d10f79",
+      "function": "calluseraddress(address)",
       "swc-id": "104",
       "min_gas_used": 1046,
       "max_gas_used": 35327,

tests/testdata/outputs_expected/calls.sol.o.markdown

@@ -4,7 +4,7 @@
 - SWC ID: 107
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0x5a6814ec`
+- Function name: `thisisfine()`
 - PC address: 661
 - Estimated Gas Usage: 643 - 1254
 
@@ -16,7 +16,7 @@ This contract executes a message call to to another contract. Make sure that the
 - SWC ID: 104
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0x5a6814ec`
+- Function name: `thisisfine()`
 - PC address: 666
 - Estimated Gas Usage: 1352 - 35963
 
@@ -28,31 +28,31 @@ The return value of an external call is not checked. Note that execution continu
 - SWC ID: 107
 - Type: Warning
 - Contract: Unknown
-- Function name: `_function_0xd24b08cc`
+- Function name: `callstoredaddress()`
 - PC address: 779
 - Estimated Gas Usage: 687 - 1298
 
 ### Description
 
-This contract executes a message call to an address found at storage slot 1. This storage slot can be written to by calling the function `_function_0x2776b163`. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.
+This contract executes a message call to an address found at storage slot 1. This storage slot can be written to by calling the function `setstoredaddress(address)`. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.
 
 ## Transaction order dependence
 - SWC ID: 114
 - Type: Warning
 - Contract: Unknown
-- Function name: `_function_0xd24b08cc`
+- Function name: `callstoredaddress()`
 - PC address: 779
 - Estimated Gas Usage: 687 - 1298
 
 ### Description
 
-Possible transaction order dependence vulnerability: The value or direction of the call statement is determined from a tainted storage location
+Possible transaction order dependence vulnerability: The value or direction of the call statement is determined from a tainted storage location.
 
 ## Unchecked CALL return value
 - SWC ID: 104
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0xd24b08cc`
+- Function name: `callstoredaddress()`
 - PC address: 784
 - Estimated Gas Usage: 1396 - 36007
 
@@ -100,7 +100,7 @@ The return value of an external call is not checked. Note that execution continu
 - SWC ID: 107
 - Type: Warning
 - Contract: Unknown
-- Function name: `_function_0xe1d10f79`
+- Function name: `calluseraddress(address)`
 - PC address: 912
 - Estimated Gas Usage: 335 - 616
 
@@ -112,7 +112,7 @@ This contract executes a message call to an address provided as a function argum
 - SWC ID: 104
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0xe1d10f79`
+- Function name: `calluseraddress(address)`
 - PC address: 918
 - Estimated Gas Usage: 1046 - 35327
 

tests/testdata/outputs_expected/calls.sol.o.text

@@ -2,7 +2,7 @@
 SWC ID: 107
 Type: Informational
 Contract: Unknown
-Function name: _function_0x5a6814ec
+Function name: thisisfine()
 PC address: 661
 Estimated Gas Usage: 643 - 1254
 This contract executes a message call to to another contract. Make sure that the called contract is trusted and does not execute user-supplied code.
@@ -12,7 +12,7 @@ This contract executes a message call to to another contract. Make sure that the
 SWC ID: 104
 Type: Informational
 Contract: Unknown
-Function name: _function_0x5a6814ec
+Function name: thisisfine()
 PC address: 666
 Estimated Gas Usage: 1352 - 35963
 The return value of an external call is not checked. Note that execution continue even if the called contract throws.
@@ -22,27 +22,27 @@ The return value of an external call is not checked. Note that execution continu
 SWC ID: 107
 Type: Warning
 Contract: Unknown
-Function name: _function_0xd24b08cc
+Function name: callstoredaddress()
 PC address: 779
 Estimated Gas Usage: 687 - 1298
-This contract executes a message call to an address found at storage slot 1. This storage slot can be written to by calling the function `_function_0x2776b163`. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.
+This contract executes a message call to an address found at storage slot 1. This storage slot can be written to by calling the function `setstoredaddress(address)`. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.
 --------------------
 
 ==== Transaction order dependence ====
 SWC ID: 114
 Type: Warning
 Contract: Unknown
-Function name: _function_0xd24b08cc
+Function name: callstoredaddress()
 PC address: 779
 Estimated Gas Usage: 687 - 1298
-Possible transaction order dependence vulnerability: The value or direction of the call statement is determined from a tainted storage location
+Possible transaction order dependence vulnerability: The value or direction of the call statement is determined from a tainted storage location.
 --------------------
 
 ==== Unchecked CALL return value ====
 SWC ID: 104
 Type: Informational
 Contract: Unknown
-Function name: _function_0xd24b08cc
+Function name: callstoredaddress()
 PC address: 784
 Estimated Gas Usage: 1396 - 36007
 The return value of an external call is not checked. Note that execution continue even if the called contract throws.
@@ -82,7 +82,7 @@ The return value of an external call is not checked. Note that execution continu
 SWC ID: 107
 Type: Warning
 Contract: Unknown
-Function name: _function_0xe1d10f79
+Function name: calluseraddress(address)
 PC address: 912
 Estimated Gas Usage: 335 - 616
 This contract executes a message call to an address provided as a function argument. Generally, it is not recommended to call user-supplied addresses using Solidity's call() construct. Note that attackers might leverage reentrancy attacks to exploit race conditions or manipulate this contract's state.
@@ -92,7 +92,7 @@ This contract executes a message call to an address provided as a function argum
 SWC ID: 104
 Type: Informational
 Contract: Unknown
-Function name: _function_0xe1d10f79
+Function name: calluseraddress(address)
 PC address: 918
 Estimated Gas Usage: 1046 - 35327
 The return value of an external call is not checked. Note that execution continue even if the called contract throws.

tests/testdata/outputs_expected/ether_send.sol.o.json

@@ -5,11 +5,11 @@
       "address": 722,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "Users other than the contract creator can withdraw ETH from the contract account without previously having sent any ETH to it. This is likely to be vulnerability.",
+      "description": "Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.",
       "function": "withdrawfunds()",
-      "swc-id": "105",
-      "min_gas_used": 1138,
       "max_gas_used": 1749,
+      "min_gas_used": 1138,
+      "swc-id": "105",
       "title": "Ether thief",
       "type": "Warning"
     },
@@ -19,9 +19,9 @@
       "debug": "<DEBUG-DATA>",
       "description": "This binary add operation can result in integer overflow.\n",
       "function": "invest()",
-      "swc-id": "101",
-      "min_gas_used": 1571,
       "max_gas_used": 1856,
+      "min_gas_used": 1571,
+      "swc-id": "101",
       "title": "Integer Overflow",
       "type": "Warning"
     }

tests/testdata/outputs_expected/ether_send.sol.o.markdown

@@ -10,7 +10,7 @@
 
 ### Description
 
-Users other than the contract creator can withdraw ETH from the contract account without previously having sent any ETH to it. This is likely to be vulnerability.
+Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
 
 ## Integer Overflow
 - SWC ID: 101

tests/testdata/outputs_expected/ether_send.sol.o.text

@@ -5,7 +5,7 @@ Contract: Unknown
 Function name: withdrawfunds()
 PC address: 722
 Estimated Gas Usage: 1138 - 1749
-Users other than the contract creator can withdraw ETH from the contract account without previously having sent any ETH to it. This is likely to be vulnerability.
+Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
 --------------------
 
 ==== Integer Overflow ====

tests/testdata/outputs_expected/exceptions.sol.o.json

@@ -5,8 +5,8 @@
       "address": 446,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. ",
-      "function": "_function_0x546455b5",
+      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.",
+      "function": "assert3(uint256)",
       "swc-id": "110",
       "min_gas_used": 206,
       "max_gas_used": 301,
@@ -17,8 +17,8 @@
       "address": 484,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. ",
-      "function": "_function_0x92dd38ea",
+      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.",
+      "function": "arrayaccess(uint256)",
       "swc-id": "110",
       "min_gas_used": 256,
       "max_gas_used": 351,
@@ -29,8 +29,8 @@
       "address": 506,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. ",
-      "function": "_function_0xa08299f1",
+      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.",
+      "function": "divisionby0(uint256)",
       "swc-id": "110",
       "min_gas_used": 272,
       "max_gas_used": 367,
@@ -41,8 +41,8 @@
       "address": 531,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. ",
-      "function": "_function_0xb34c3610",
+      "description": "A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.",
+      "function": "assert1()",
       "swc-id": "110",
       "min_gas_used": 268,
       "max_gas_used": 363,

tests/testdata/outputs_expected/exceptions.sol.o.markdown

@@ -4,7 +4,7 @@
 - SWC ID: 110
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0x546455b5`
+- Function name: `assert3(uint256)`
 - PC address: 446
 - Estimated Gas Usage: 206 - 301
 
@@ -16,7 +16,7 @@ A reachable exception (opcode 0xfe) has been detected. This can be caused by typ
 - SWC ID: 110
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0x92dd38ea`
+- Function name: `arrayaccess(uint256)`
 - PC address: 484
 - Estimated Gas Usage: 256 - 351
 
@@ -28,7 +28,7 @@ A reachable exception (opcode 0xfe) has been detected. This can be caused by typ
 - SWC ID: 110
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0xa08299f1`
+- Function name: `divisionby0(uint256)`
 - PC address: 506
 - Estimated Gas Usage: 272 - 367
 
@@ -40,7 +40,7 @@ A reachable exception (opcode 0xfe) has been detected. This can be caused by typ
 - SWC ID: 110
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0xb34c3610`
+- Function name: `assert1()`
 - PC address: 531
 - Estimated Gas Usage: 268 - 363
 

tests/testdata/outputs_expected/exceptions.sol.o.text

@@ -2,39 +2,39 @@
 SWC ID: 110
 Type: Informational
 Contract: Unknown
-Function name: _function_0x546455b5
+Function name: assert3(uint256)
 PC address: 446
 Estimated Gas Usage: 206 - 301
-A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. 
+A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
 --------------------
 
 ==== Exception state ====
 SWC ID: 110
 Type: Informational
 Contract: Unknown
-Function name: _function_0x92dd38ea
+Function name: arrayaccess(uint256)
 PC address: 484
 Estimated Gas Usage: 256 - 351
-A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. 
+A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
 --------------------
 
 ==== Exception state ====
 SWC ID: 110
 Type: Informational
 Contract: Unknown
-Function name: _function_0xa08299f1
+Function name: divisionby0(uint256)
 PC address: 506
 Estimated Gas Usage: 272 - 367
-A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. 
+A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
 --------------------
 
 ==== Exception state ====
 SWC ID: 110
 Type: Informational
 Contract: Unknown
-Function name: _function_0xb34c3610
+Function name: assert1()
 PC address: 531
 Estimated Gas Usage: 268 - 363
-A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking. 
+A reachable exception (opcode 0xfe) has been detected. This can be caused by type errors, division by zero, out-of-bounds array access, or assert violations. Note that explicit `assert()` should only be used to check invariants. Use `require()` for regular input checking.
 --------------------
 

tests/testdata/outputs_expected/multi_contracts.sol.o.json

@@ -5,11 +5,11 @@
       "address": 142,
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
-      "description": "Users other than the contract creator can withdraw ETH from the contract account without previously having sent any ETH to it. This is likely to be vulnerability.",
-      "function": "_function_0x8a4068dd",
-      "swc-id": "105",
-      "min_gas_used": 186,
+      "description": "Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.",
+      "function": "transfer()",
       "max_gas_used": 467,
+      "min_gas_used": 186,
+      "swc-id": "105",
       "title": "Ether thief",
       "type": "Warning"
     }

tests/testdata/outputs_expected/multi_contracts.sol.o.markdown

@@ -4,10 +4,10 @@
 - SWC ID: 105
 - Type: Warning
 - Contract: Unknown
-- Function name: `_function_0x8a4068dd`
+- Function name: `transfer()`
 - PC address: 142
 - Estimated Gas Usage: 186 - 467
 
 ### Description
 
-Users other than the contract creator can withdraw ETH from the contract account without previously having sent any ETH to it. This is likely to be vulnerability.
+Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.

tests/testdata/outputs_expected/multi_contracts.sol.o.text

@@ -2,9 +2,9 @@
 SWC ID: 105
 Type: Warning
 Contract: Unknown
-Function name: _function_0x8a4068dd
+Function name: transfer()
 PC address: 142
 Estimated Gas Usage: 186 - 467
-Users other than the contract creator can withdraw ETH from the contract account without previously having sent any ETH to it. This is likely to be vulnerability.
+Arbitrary senders other than the contract creator can withdraw ETH from the contract account without previously having sent an equivalent amount of ETH to it. This is likely to be a vulnerability.
 --------------------
 

tests/testdata/outputs_expected/returnvalue.sol.o.json

@@ -6,7 +6,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "This contract executes a message call to to another contract. Make sure that the called contract is trusted and does not execute user-supplied code.",
-      "function": "_function_0x633ab5e0",
+      "function": "callchecked()",
       "swc-id": "107",
       "min_gas_used": 599,
       "max_gas_used": 1210,
@@ -18,7 +18,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "This contract executes a message call to to another contract. Make sure that the called contract is trusted and does not execute user-supplied code.",
-      "function": "_function_0xe3bea282",
+      "function": "callnotchecked()",
       "swc-id": "107",
       "min_gas_used": 621,
       "max_gas_used": 1232,
@@ -30,7 +30,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "The return value of an external call is not checked. Note that execution continue even if the called contract throws.",
-      "function": "_function_0xe3bea282",
+      "function": "callnotchecked()",
       "swc-id": "104",
       "min_gas_used": 1330,
       "max_gas_used": 35941,

tests/testdata/outputs_expected/returnvalue.sol.o.markdown

@@ -4,7 +4,7 @@
 - SWC ID: 107
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0x633ab5e0`
+- Function name: `callchecked()`
 - PC address: 196
 - Estimated Gas Usage: 599 - 1210
 
@@ -16,7 +16,7 @@ This contract executes a message call to to another contract. Make sure that the
 - SWC ID: 107
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0xe3bea282`
+- Function name: `callnotchecked()`
 - PC address: 285
 - Estimated Gas Usage: 621 - 1232
 
@@ -28,7 +28,7 @@ This contract executes a message call to to another contract. Make sure that the
 - SWC ID: 104
 - Type: Informational
 - Contract: Unknown
-- Function name: `_function_0xe3bea282`
+- Function name: `callnotchecked()`
 - PC address: 290
 - Estimated Gas Usage: 1330 - 35941
 

tests/testdata/outputs_expected/returnvalue.sol.o.text

@@ -2,7 +2,7 @@
 SWC ID: 107
 Type: Informational
 Contract: Unknown
-Function name: _function_0x633ab5e0
+Function name: callchecked()
 PC address: 196
 Estimated Gas Usage: 599 - 1210
 This contract executes a message call to to another contract. Make sure that the called contract is trusted and does not execute user-supplied code.
@@ -12,7 +12,7 @@ This contract executes a message call to to another contract. Make sure that the
 SWC ID: 107
 Type: Informational
 Contract: Unknown
-Function name: _function_0xe3bea282
+Function name: callnotchecked()
 PC address: 285
 Estimated Gas Usage: 621 - 1232
 This contract executes a message call to to another contract. Make sure that the called contract is trusted and does not execute user-supplied code.
@@ -22,7 +22,7 @@ This contract executes a message call to to another contract. Make sure that the
 SWC ID: 104
 Type: Informational
 Contract: Unknown
-Function name: _function_0xe3bea282
+Function name: callnotchecked()
 PC address: 290
 Estimated Gas Usage: 1330 - 35941
 The return value of an external call is not checked. Note that execution continue even if the called contract throws.

tests/testdata/outputs_expected/suicide.sol.o.json

@@ -6,7 +6,7 @@
       "contract": "Unknown",
       "debug": "<DEBUG-DATA>",
       "description": "A reachable SUICIDE instruction was detected. The remaining Ether is sent to an address provided as a function argument.\n",
-      "function": "_function_0xcbf0b0c0",
+      "function": "kill(address)",
       "swc-id": "106",
       "min_gas_used": 168,
       "max_gas_used": 263,

tests/testdata/outputs_expected/suicide.sol.o.markdown

@@ -4,7 +4,7 @@
 - SWC ID: 106
 - Type: Warning
 - Contract: Unknown
-- Function name: `_function_0xcbf0b0c0`
+- Function name: `kill(address)`
 - PC address: 146
 - Estimated Gas Usage: 168 - 263
 

tests/testdata/outputs_expected/suicide.sol.o.text

@@ -2,7 +2,7 @@
 SWC ID: 106
 Type: Warning
 Contract: Unknown
-Function name: _function_0xcbf0b0c0
+Function name: kill(address)
 PC address: 146
 Estimated Gas Usage: 168 - 263
 A reachable SUICIDE instruction was detected. The remaining Ether is sent to an address provided as a function argument.