Merge branch 'dev' into master

scripts/ci_test_printers.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 
-### Test printer 
+### Test printer
 
 cd tests/e2e/solc_parsing/test_data/compile/ || exit
 
 # Do not test the evm printer,as it needs a refactoring
-ALL_PRINTERS="cfg,constructor-calls,contract-summary,data-dependency,echidna,function-id,function-summary,modifiers,call-graph,human-summary,inheritance,inheritance-graph,slithir,slithir-ssa,vars-and-auth,require,variable-order,declaration"
+ALL_PRINTERS="cfg,constructor-calls,contract-summary,data-dependency,echidna,function-id,function-summary,modifiers,call-graph,human-summary,inheritance,inheritance-graph,loc,slithir,slithir-ssa,vars-and-auth,require,variable-order,declaration"
 
 # Only test 0.5.17 to limit test time
 for file in *0.5.17-compact.zip; do

slither/core/cfg/scope.py

@@ -7,8 +7,10 @@ if TYPE_CHECKING:
 
 # pylint: disable=too-few-public-methods
 class Scope:
-    def __init__(self, is_checked: bool, is_yul: bool, scope: Union["Scope", "Function"]) -> None:
+    def __init__(
+        self, is_checked: bool, is_yul: bool, parent_scope: Union["Scope", "Function"]
+    ) -> None:
         self.nodes: List["Node"] = []
         self.is_checked = is_checked
         self.is_yul = is_yul
-        self.father = scope
+        self.father = parent_scope

slither/core/declarations/event.py

@@ -45,7 +45,7 @@ class Event(ContractLevel, SourceMapping):
         Returns:
             str: contract.func_name(type1,type2)
         """
-        return self.contract.name + self.full_name
+        return self.contract.name + "." + self.full_name
 
     @property
     def elems(self) -> List["EventVariable"]:

slither/detectors/variables/similar_variables.py

@@ -47,9 +47,7 @@ class SimilarVarsDetection(AbstractDetector):
         Returns:
             bool: true if names are similar
         """
-        if len(seq1) != len(seq2):
-            return False
-        val = difflib.SequenceMatcher(a=seq1.lower(), b=seq2.lower()).ratio()
+        val = difflib.SequenceMatcher(a=seq1, b=seq2).ratio()
         ret = val > 0.90
         return ret
 
@@ -67,19 +65,21 @@ class SimilarVarsDetection(AbstractDetector):
 
         all_var = list(set(all_var + contract_var))
 
-        ret = []
+        ret = set()
         # pylint: disable=consider-using-enumerate
         for i in range(len(all_var)):
             v1 = all_var[i]
             _v1_name_lower = v1.name.lower()
             for j in range(i, len(all_var)):
                 v2 = all_var[j]
-                if _v1_name_lower != v2.name.lower():
-                    if SimilarVarsDetection.similar(v1.name, v2.name):
-                        if (v2, v1) not in ret:
-                            ret.append((v1, v2))
+                if len(v1.name) != len(v2.name):
+                    continue
+                _v2_name_lower = v2.name.lower()
+                if _v1_name_lower != _v2_name_lower:
+                    if SimilarVarsDetection.similar(_v1_name_lower, _v2_name_lower):
+                        ret.add((v1, v2))
 
-        return set(ret)
+        return ret
 
     def _detect(self) -> List[Output]:
         """Detect similar variables name

slither/printers/all_printers.py

@@ -1,6 +1,7 @@
 # pylint: disable=unused-import,relative-beyond-top-level
 from .summary.function import FunctionSummary
 from .summary.contract import ContractSummary
+from .summary.loc import LocPrinter
 from .inheritance.inheritance import PrinterInheritance
 from .inheritance.inheritance_graph import PrinterInheritanceGraph
 from .call.call_graph import PrinterCallGraph

slither/printers/summary/human_summary.py

@@ -2,12 +2,12 @@
 Module printing summary of the contract
 """
 import logging
-from pathlib import Path
 from typing import Tuple, List, Dict
 
 from slither.core.declarations import SolidityFunction, Function
 from slither.core.variables.state_variable import StateVariable
 from slither.printers.abstract_printer import AbstractPrinter
+from slither.printers.summary.loc import compute_loc_metrics
 from slither.slithir.operations import (
     LowLevelCall,
     HighLevelCall,
@@ -21,7 +21,6 @@ from slither.utils.colors import green, red, yellow
 from slither.utils.myprettytable import MyPrettyTable
 from slither.utils.standard_libraries import is_standard_library
 from slither.core.cfg.node import NodeType
-from slither.utils.tests_pattern import is_test_file
 
 
 class PrinterHumanSummary(AbstractPrinter):
@@ -32,7 +31,6 @@ class PrinterHumanSummary(AbstractPrinter):
 
     @staticmethod
     def _get_summary_erc20(contract):
-
         functions_name = [f.name for f in contract.functions]
         state_variables = [v.name for v in contract.state_variables]
 
@@ -165,28 +163,7 @@ class PrinterHumanSummary(AbstractPrinter):
     def _number_functions(contract):
         return len(contract.functions)
 
-    def _lines_number(self):
-        if not self.slither.source_code:
-            return None
-        total_dep_lines = 0
-        total_lines = 0
-        total_tests_lines = 0
-
-        for filename, source_code in self.slither.source_code.items():
-            lines = len(source_code.splitlines())
-            is_dep = False
-            if self.slither.crytic_compile:
-                is_dep = self.slither.crytic_compile.is_dependency(filename)
-            if is_dep:
-                total_dep_lines += lines
-            else:
-                if is_test_file(Path(filename)):
-                    total_tests_lines += lines
-                else:
-                    total_lines += lines
-        return total_lines, total_dep_lines, total_tests_lines
-
-    def _get_number_of_assembly_lines(self):
+    def _get_number_of_assembly_lines(self) -> int:
         total_asm_lines = 0
         for contract in self.contracts:
             for function in contract.functions_declared:
@@ -202,9 +179,7 @@ class PrinterHumanSummary(AbstractPrinter):
             return "Compilation non standard\n"
         return f"Compiled with {str(self.slither.crytic_compile.type)}\n"
 
-    def _number_contracts(self):
-        if self.slither.crytic_compile is None:
-            return len(self.slither.contracts), 0, 0
+    def _number_contracts(self) -> Tuple[int, int, int]:
         contracts = self.slither.contracts
         deps = [c for c in contracts if c.is_from_dependency()]
         tests = [c for c in contracts if c.is_test]
@@ -226,7 +201,6 @@ class PrinterHumanSummary(AbstractPrinter):
         return list(set(ercs))
 
     def _get_features(self, contract):  # pylint: disable=too-many-branches
-
         has_payable = False
         can_send_eth = False
         can_selfdestruct = False
@@ -291,6 +265,36 @@ class PrinterHumanSummary(AbstractPrinter):
             "Proxy": contract.is_upgradeable_proxy,
         }
 
+    def _get_contracts(self, txt: str) -> str:
+        (
+            number_contracts,
+            number_contracts_deps,
+            number_contracts_tests,
+        ) = self._number_contracts()
+        txt += f"Total number of contracts in source files: {number_contracts}\n"
+        if number_contracts_deps > 0:
+            txt += f"Number of contracts in dependencies: {number_contracts_deps}\n"
+        if number_contracts_tests > 0:
+            txt += f"Number of contracts in tests       : {number_contracts_tests}\n"
+        return txt
+
+    def _get_number_lines(self, txt: str, results: Dict) -> Tuple[str, Dict]:
+        loc = compute_loc_metrics(self.slither)
+        txt += "Source lines of code (SLOC) in source files: "
+        txt += f"{loc.src.sloc}\n"
+        if loc.dep.sloc > 0:
+            txt += "Source lines of code (SLOC) in dependencies: "
+            txt += f"{loc.dep.sloc}\n"
+        if loc.test.sloc > 0:
+            txt += "Source lines of code (SLOC) in tests       : "
+            txt += f"{loc.test.sloc}\n"
+        results["number_lines"] = loc.src.sloc
+        results["number_lines__dependencies"] = loc.dep.sloc
+        total_asm_lines = self._get_number_of_assembly_lines()
+        txt += f"Number of  assembly lines: {total_asm_lines}\n"
+        results["number_lines_assembly"] = total_asm_lines
+        return txt, results
+
     def output(self, _filename):  # pylint: disable=too-many-locals,too-many-statements
         """
         _filename is not used
@@ -311,24 +315,8 @@ class PrinterHumanSummary(AbstractPrinter):
             "number_findings": {},
             "detectors": [],
         }
-
-        lines_number = self._lines_number()
-        if lines_number:
-            total_lines, total_dep_lines, total_tests_lines = lines_number
-            txt += f"Number of lines: {total_lines} (+ {total_dep_lines} in dependencies, + {total_tests_lines} in tests)\n"
-            results["number_lines"] = total_lines
-            results["number_lines__dependencies"] = total_dep_lines
-            total_asm_lines = self._get_number_of_assembly_lines()
-            txt += f"Number of assembly lines: {total_asm_lines}\n"
-            results["number_lines_assembly"] = total_asm_lines
-
-        (
-            number_contracts,
-            number_contracts_deps,
-            number_contracts_tests,
-        ) = self._number_contracts()
-        txt += f"Number of contracts: {number_contracts} (+ {number_contracts_deps} in dependencies, + {number_contracts_tests} tests) \n\n"
-
+        txt = self._get_contracts(txt)
+        txt, results = self._get_number_lines(txt, results)
         (
             txt_detectors,
             detectors_results,
@@ -352,7 +340,7 @@ class PrinterHumanSummary(AbstractPrinter):
         libs = self._standard_libraries()
         if libs:
             txt += f'\nUse: {", ".join(libs)}\n'
-            results["standard_libraries"] = [str(l) for l in libs]
+            results["standard_libraries"] = [str(lib) for lib in libs]
 
         ercs = self._ercs()
         if ercs:
@@ -363,7 +351,6 @@ class PrinterHumanSummary(AbstractPrinter):
             ["Name", "# functions", "ERCS", "ERC20 info", "Complex code", "Features"]
         )
         for contract in self.slither.contracts_derived:
-
             if contract.is_from_dependency() or contract.is_test:
                 continue
 

slither/printers/summary/loc.py

@@ -0,0 +1,35 @@
+"""
+    Lines of Code (LOC) printer
+
+    Definitions:
+    cloc: comment lines of code containing only comments
+    sloc: source lines of code with no whitespace or comments
+    loc: all lines of code including whitespace and comments
+    src: source files (excluding tests and dependencies)
+    dep: dependency files
+    test: test files
+"""
+
+from slither.printers.abstract_printer import AbstractPrinter
+from slither.utils.loc import compute_loc_metrics
+from slither.utils.output import Output
+
+
+class LocPrinter(AbstractPrinter):
+    ARGUMENT = "loc"
+    HELP = """Count the total number lines of code (LOC), source lines of code (SLOC), \
+            and comment lines of code (CLOC) found in source files (SRC), dependencies (DEP), \
+            and test files (TEST)."""
+
+    WIKI = "https://github.com/trailofbits/slither/wiki/Printer-documentation#loc"
+
+    def output(self, _filename: str) -> Output:
+        # compute loc metrics
+        loc = compute_loc_metrics(self.slither)
+
+        table = loc.to_pretty_table()
+        txt = "Lines of Code \n" + str(table)
+        self.info(txt)
+        res = self.generate_output(txt)
+        res.add_pretty_table(table, "Code Lines")
+        return res

slither/solc_parsing/declarations/function.py

@@ -354,7 +354,7 @@ class FunctionSolc(CallerContextExpression):
     ###################################################################################
     ###################################################################################
 
-    def _parse_if(self, if_statement: Dict, node: NodeSolc) -> NodeSolc:
+    def _parse_if(self, if_statement: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
         # IfStatement = 'if' '(' Expression ')' Statement ( 'else' Statement )?
         falseStatement = None
 
@@ -362,21 +362,15 @@ class FunctionSolc(CallerContextExpression):
             condition = if_statement["condition"]
             # Note: check if the expression could be directly
             # parsed here
-            condition_node = self._new_node(
-                NodeType.IF, condition["src"], node.underlying_node.scope
-            )
+            condition_node = self._new_node(NodeType.IF, condition["src"], scope)
             condition_node.add_unparsed_expression(condition)
             link_underlying_nodes(node, condition_node)
-            true_scope = Scope(
-                node.underlying_node.scope.is_checked, False, node.underlying_node.scope
-            )
+            true_scope = Scope(scope.is_checked, False, scope)
             trueStatement = self._parse_statement(
                 if_statement["trueBody"], condition_node, true_scope
             )
             if "falseBody" in if_statement and if_statement["falseBody"]:
-                false_scope = Scope(
-                    node.underlying_node.scope.is_checked, False, node.underlying_node.scope
-                )
+                false_scope = Scope(scope.is_checked, False, scope)
                 falseStatement = self._parse_statement(
                     if_statement["falseBody"], condition_node, false_scope
                 )
@@ -385,22 +379,16 @@ class FunctionSolc(CallerContextExpression):
             condition = children[0]
             # Note: check if the expression could be directly
             # parsed here
-            condition_node = self._new_node(
-                NodeType.IF, condition["src"], node.underlying_node.scope
-            )
+            condition_node = self._new_node(NodeType.IF, condition["src"], scope)
             condition_node.add_unparsed_expression(condition)
             link_underlying_nodes(node, condition_node)
-            true_scope = Scope(
-                node.underlying_node.scope.is_checked, False, node.underlying_node.scope
-            )
+            true_scope = Scope(scope.is_checked, False, scope)
             trueStatement = self._parse_statement(children[1], condition_node, true_scope)
             if len(children) == 3:
-                false_scope = Scope(
-                    node.underlying_node.scope.is_checked, False, node.underlying_node.scope
-                )
+                false_scope = Scope(scope.is_checked, False, scope)
                 falseStatement = self._parse_statement(children[2], condition_node, false_scope)
 
-        endIf_node = self._new_node(NodeType.ENDIF, if_statement["src"], node.underlying_node.scope)
+        endIf_node = self._new_node(NodeType.ENDIF, if_statement["src"], scope)
         link_underlying_nodes(trueStatement, endIf_node)
 
         if falseStatement:
@@ -409,32 +397,26 @@ class FunctionSolc(CallerContextExpression):
             link_underlying_nodes(condition_node, endIf_node)
         return endIf_node
 
-    def _parse_while(self, whilte_statement: Dict, node: NodeSolc) -> NodeSolc:
+    def _parse_while(self, whilte_statement: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
         # WhileStatement = 'while' '(' Expression ')' Statement
 
-        node_startWhile = self._new_node(
-            NodeType.STARTLOOP, whilte_statement["src"], node.underlying_node.scope
-        )
+        node_startWhile = self._new_node(NodeType.STARTLOOP, whilte_statement["src"], scope)
 
-        body_scope = Scope(node.underlying_node.scope.is_checked, False, node.underlying_node.scope)
+        body_scope = Scope(scope.is_checked, False, scope)
         if self.is_compact_ast:
             node_condition = self._new_node(
-                NodeType.IFLOOP, whilte_statement["condition"]["src"], node.underlying_node.scope
+                NodeType.IFLOOP, whilte_statement["condition"]["src"], scope
             )
             node_condition.add_unparsed_expression(whilte_statement["condition"])
             statement = self._parse_statement(whilte_statement["body"], node_condition, body_scope)
         else:
             children = whilte_statement[self.get_children("children")]
             expression = children[0]
-            node_condition = self._new_node(
-                NodeType.IFLOOP, expression["src"], node.underlying_node.scope
-            )
+            node_condition = self._new_node(NodeType.IFLOOP, expression["src"], scope)
             node_condition.add_unparsed_expression(expression)
             statement = self._parse_statement(children[1], node_condition, body_scope)
 
-        node_endWhile = self._new_node(
-            NodeType.ENDLOOP, whilte_statement["src"], node.underlying_node.scope
-        )
+        node_endWhile = self._new_node(NodeType.ENDLOOP, whilte_statement["src"], scope)
 
         link_underlying_nodes(node, node_startWhile)
         link_underlying_nodes(node_startWhile, node_condition)
@@ -562,7 +544,7 @@ class FunctionSolc(CallerContextExpression):
 
         return pre, cond, post, body
 
-    def _parse_for(self, statement: Dict, node: NodeSolc) -> NodeSolc:
+    def _parse_for(self, statement: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
         # ForStatement = 'for' '(' (SimpleStatement)? ';' (Expression)? ';' (ExpressionStatement)? ')' Statement
 
         if self.is_compact_ast:
@@ -570,17 +552,13 @@ class FunctionSolc(CallerContextExpression):
         else:
             pre, cond, post, body = self._parse_for_legacy_ast(statement)
 
-        node_startLoop = self._new_node(
-            NodeType.STARTLOOP, statement["src"], node.underlying_node.scope
-        )
-        node_endLoop = self._new_node(
-            NodeType.ENDLOOP, statement["src"], node.underlying_node.scope
-        )
+        node_startLoop = self._new_node(NodeType.STARTLOOP, statement["src"], scope)
+        node_endLoop = self._new_node(NodeType.ENDLOOP, statement["src"], scope)
 
-        last_scope = node.underlying_node.scope
+        last_scope = scope
 
         if pre:
-            pre_scope = Scope(node.underlying_node.scope.is_checked, False, last_scope)
+            pre_scope = Scope(scope.is_checked, False, last_scope)
             last_scope = pre_scope
             node_init_expression = self._parse_statement(pre, node, pre_scope)
             link_underlying_nodes(node_init_expression, node_startLoop)
@@ -588,7 +566,7 @@ class FunctionSolc(CallerContextExpression):
             link_underlying_nodes(node, node_startLoop)
 
         if cond:
-            cond_scope = Scope(node.underlying_node.scope.is_checked, False, last_scope)
+            cond_scope = Scope(scope.is_checked, False, last_scope)
             last_scope = cond_scope
             node_condition = self._new_node(NodeType.IFLOOP, cond["src"], cond_scope)
             node_condition.add_unparsed_expression(cond)
@@ -599,7 +577,7 @@ class FunctionSolc(CallerContextExpression):
             node_condition = None
             node_beforeBody = node_startLoop
 
-        body_scope = Scope(node.underlying_node.scope.is_checked, False, last_scope)
+        body_scope = Scope(scope.is_checked, False, last_scope)
         last_scope = body_scope
         node_body = self._parse_statement(body, node_beforeBody, body_scope)
 
@@ -619,14 +597,10 @@ class FunctionSolc(CallerContextExpression):
 
         return node_endLoop
 
-    def _parse_dowhile(self, do_while_statement: Dict, node: NodeSolc) -> NodeSolc:
+    def _parse_dowhile(self, do_while_statement: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
 
-        node_startDoWhile = self._new_node(
-            NodeType.STARTLOOP, do_while_statement["src"], node.underlying_node.scope
-        )
-        condition_scope = Scope(
-            node.underlying_node.scope.is_checked, False, node.underlying_node.scope
-        )
+        node_startDoWhile = self._new_node(NodeType.STARTLOOP, do_while_statement["src"], scope)
+        condition_scope = Scope(scope.is_checked, False, scope)
 
         if self.is_compact_ast:
             node_condition = self._new_node(
@@ -644,7 +618,7 @@ class FunctionSolc(CallerContextExpression):
             node_condition.add_unparsed_expression(expression)
             statement = self._parse_statement(children[1], node_condition, condition_scope)
 
-        body_scope = Scope(node.underlying_node.scope.is_checked, False, condition_scope)
+        body_scope = Scope(scope.is_checked, False, condition_scope)
         node_endDoWhile = self._new_node(NodeType.ENDLOOP, do_while_statement["src"], body_scope)
 
         link_underlying_nodes(node, node_startDoWhile)
@@ -724,14 +698,12 @@ class FunctionSolc(CallerContextExpression):
 
         return ret
 
-    def _parse_try_catch(self, statement: Dict, node: NodeSolc) -> NodeSolc:
+    def _parse_try_catch(self, statement: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
         externalCall = statement.get("externalCall", None)
 
         if externalCall is None:
             raise ParsingError(f"Try/Catch not correctly parsed by Slither {statement}")
-        catch_scope = Scope(
-            node.underlying_node.scope.is_checked, False, node.underlying_node.scope
-        )
+        catch_scope = Scope(scope.is_checked, False, scope)
         new_node = self._new_node(NodeType.TRY, statement["src"], catch_scope)
         clauses = statement.get("clauses", [])
         # the first clause is the try scope
@@ -748,18 +720,20 @@ class FunctionSolc(CallerContextExpression):
             # we set the parameters (e.g. data in this case. catch(string memory data) ...)
             # to be initialized so they are not reported by the uninitialized-local-variables detector
             if index >= 1:
-                self._parse_catch(clause, node, True)
+                self._parse_catch(clause, node, catch_scope, True)
             else:
                 # the parameters for the try scope were already added in _construct_try_expression
-                self._parse_catch(clause, node, False)
+                self._parse_catch(clause, node, catch_scope, False)
         return node
 
-    def _parse_catch(self, statement: Dict, node: NodeSolc, add_param: bool) -> NodeSolc:
+    def _parse_catch(
+        self, statement: Dict, node: NodeSolc, scope: Scope, add_param: bool
+    ) -> NodeSolc:
         block = statement.get("block", None)
 
         if block is None:
             raise ParsingError(f"Catch not correctly parsed by Slither {statement}")
-        try_scope = Scope(node.underlying_node.scope.is_checked, False, node.underlying_node.scope)
+        try_scope = Scope(scope.is_checked, False, scope)
 
         try_node = self._new_node(NodeType.CATCH, statement["src"], try_scope)
         link_underlying_nodes(node, try_node)
@@ -777,7 +751,7 @@ class FunctionSolc(CallerContextExpression):
 
         return self._parse_statement(block, try_node, try_scope)
 
-    def _parse_variable_definition(self, statement: Dict, node: NodeSolc) -> NodeSolc:
+    def _parse_variable_definition(self, statement: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
         try:
             local_var = LocalVariable()
             local_var.set_function(self._function)
@@ -787,9 +761,7 @@ class FunctionSolc(CallerContextExpression):
             self._add_local_variable(local_var_parser)
             # local_var.analyze(self)
 
-            new_node = self._new_node(
-                NodeType.VARIABLE, statement["src"], node.underlying_node.scope
-            )
+            new_node = self._new_node(NodeType.VARIABLE, statement["src"], scope)
             new_node.underlying_node.add_variable_declaration(local_var)
             link_underlying_nodes(node, new_node)
             return new_node
@@ -819,7 +791,7 @@ class FunctionSolc(CallerContextExpression):
                             "declarations": [variable],
                             "initialValue": init,
                         }
-                        new_node = self._parse_variable_definition(new_statement, new_node)
+                        new_node = self._parse_variable_definition(new_statement, new_node, scope)
 
                 else:
                     # If we have
@@ -841,7 +813,7 @@ class FunctionSolc(CallerContextExpression):
                             variables.append(variable)
 
                             new_node = self._parse_variable_definition_init_tuple(
-                                new_statement, i, new_node
+                                new_statement, i, new_node, scope
                             )
                         i = i + 1
 
@@ -873,9 +845,7 @@ class FunctionSolc(CallerContextExpression):
                         "typeDescriptions": {"typeString": "tuple()"},
                     }
                     node = new_node
-                    new_node = self._new_node(
-                        NodeType.EXPRESSION, statement["src"], node.underlying_node.scope
-                    )
+                    new_node = self._new_node(NodeType.EXPRESSION, statement["src"], scope)
                     new_node.add_unparsed_expression(expression)
                     link_underlying_nodes(node, new_node)
 
@@ -906,7 +876,7 @@ class FunctionSolc(CallerContextExpression):
                             self.get_children("children"): [variable, init],
                         }
 
-                        new_node = self._parse_variable_definition(new_statement, new_node)
+                        new_node = self._parse_variable_definition(new_statement, new_node, scope)
                 else:
                     # If we have
                     # var (a, b) = f()
@@ -925,7 +895,7 @@ class FunctionSolc(CallerContextExpression):
                         variables.append(variable)
 
                         new_node = self._parse_variable_definition_init_tuple(
-                            new_statement, i, new_node
+                            new_statement, i, new_node, scope
                         )
                         i = i + 1
                     var_identifiers = []
@@ -955,16 +925,14 @@ class FunctionSolc(CallerContextExpression):
                         ],
                     }
                     node = new_node
-                    new_node = self._new_node(
-                        NodeType.EXPRESSION, statement["src"], node.underlying_node.scope
-                    )
+                    new_node = self._new_node(NodeType.EXPRESSION, statement["src"], scope)
                     new_node.add_unparsed_expression(expression)
                     link_underlying_nodes(node, new_node)
 
             return new_node
 
     def _parse_variable_definition_init_tuple(
-        self, statement: Dict, index: int, node: NodeSolc
+        self, statement: Dict, index: int, node: NodeSolc, scope
     ) -> NodeSolc:
         local_var = LocalVariableInitFromTuple()
         local_var.set_function(self._function)
@@ -974,7 +942,7 @@ class FunctionSolc(CallerContextExpression):
 
         self._add_local_variable(local_var_parser)
 
-        new_node = self._new_node(NodeType.VARIABLE, statement["src"], node.underlying_node.scope)
+        new_node = self._new_node(NodeType.VARIABLE, statement["src"], scope)
         new_node.underlying_node.add_variable_declaration(local_var)
         link_underlying_nodes(node, new_node)
         return new_node
@@ -995,15 +963,15 @@ class FunctionSolc(CallerContextExpression):
         name = statement[self.get_key()]
         # SimpleStatement = VariableDefinition | ExpressionStatement
         if name == "IfStatement":
-            node = self._parse_if(statement, node)
+            node = self._parse_if(statement, node, scope)
         elif name == "WhileStatement":
-            node = self._parse_while(statement, node)
+            node = self._parse_while(statement, node, scope)
         elif name == "ForStatement":
-            node = self._parse_for(statement, node)
+            node = self._parse_for(statement, node, scope)
         elif name == "Block":
-            node = self._parse_block(statement, node)
+            node = self._parse_block(statement, node, scope)
         elif name == "UncheckedBlock":
-            node = self._parse_unchecked_block(statement, node)
+            node = self._parse_unchecked_block(statement, node, scope)
         elif name == "InlineAssembly":
             # Added with solc 0.6 - the yul code is an AST
             if "AST" in statement and not self.compilation_unit.core.skip_assembly:
@@ -1025,7 +993,7 @@ class FunctionSolc(CallerContextExpression):
                 link_underlying_nodes(node, asm_node)
                 node = asm_node
         elif name == "DoWhileStatement":
-            node = self._parse_dowhile(statement, node)
+            node = self._parse_dowhile(statement, node, scope)
         # For Continue / Break / Return / Throw
         # The is fixed later
         elif name == "Continue":
@@ -1066,7 +1034,7 @@ class FunctionSolc(CallerContextExpression):
             link_underlying_nodes(node, new_node)
             node = new_node
         elif name in ["VariableDefinitionStatement", "VariableDeclarationStatement"]:
-            node = self._parse_variable_definition(statement, node)
+            node = self._parse_variable_definition(statement, node, scope)
         elif name == "ExpressionStatement":
             # assert len(statement[self.get_children('expression')]) == 1
             # assert not 'attributes' in statement
@@ -1080,7 +1048,7 @@ class FunctionSolc(CallerContextExpression):
             link_underlying_nodes(node, new_node)
             node = new_node
         elif name == "TryStatement":
-            node = self._parse_try_catch(statement, node)
+            node = self._parse_try_catch(statement, node, scope)
         # elif name == 'TryCatchClause':
         #     self._parse_catch(statement, node)
         elif name == "RevertStatement":
@@ -1097,7 +1065,7 @@ class FunctionSolc(CallerContextExpression):
 
         return node
 
-    def _parse_block(self, block: Dict, node: NodeSolc, check_arithmetic: bool = False) -> NodeSolc:
+    def _parse_block(self, block: Dict, node: NodeSolc, scope: Scope) -> NodeSolc:
         """
         Return:
             Node
@@ -1109,13 +1077,12 @@ class FunctionSolc(CallerContextExpression):
         else:
             statements = block[self.get_children("children")]
 
-        check_arithmetic = check_arithmetic | node.underlying_node.scope.is_checked
-        new_scope = Scope(check_arithmetic, False, node.underlying_node.scope)
+        new_scope = Scope(scope.is_checked, False, scope)
         for statement in statements:
             node = self._parse_statement(statement, node, new_scope)
         return node
 
-    def _parse_unchecked_block(self, block: Dict, node: NodeSolc):
+    def _parse_unchecked_block(self, block: Dict, node: NodeSolc, scope):
         """
         Return:
             Node
@@ -1127,7 +1094,8 @@ class FunctionSolc(CallerContextExpression):
         else:
             statements = block[self.get_children("children")]
 
-        new_scope = Scope(False, False, node.underlying_node.scope)
+        new_scope = Scope(False, False, scope)
+
         for statement in statements:
             node = self._parse_statement(statement, node, new_scope)
         return node
@@ -1148,8 +1116,7 @@ class FunctionSolc(CallerContextExpression):
             self._function.is_empty = True
         else:
             self._function.is_empty = False
-            check_arithmetic = self.compilation_unit.solc_version >= "0.8.0"
-            self._parse_block(cfg, node, check_arithmetic=check_arithmetic)
+            self._parse_block(cfg, node, self.underlying_function)
             self._remove_incorrect_edges()
             self._remove_alone_endif()
 

slither/utils/loc.py

@@ -0,0 +1,105 @@
+from dataclasses import dataclass
+from pathlib import Path
+from typing import List, Tuple
+
+from slither import Slither
+from slither.utils.myprettytable import MyPrettyTable
+from slither.utils.tests_pattern import is_test_file
+
+
+@dataclass
+class LoCInfo:
+    loc: int = 0
+    sloc: int = 0
+    cloc: int = 0
+
+    def total(self) -> int:
+        return self.loc + self.sloc + self.cloc
+
+
+@dataclass
+class LoC:
+    src: LoCInfo = LoCInfo()
+    dep: LoCInfo = LoCInfo()
+    test: LoCInfo = LoCInfo()
+
+    def to_pretty_table(self) -> MyPrettyTable:
+        table = MyPrettyTable(["", "src", "dep", "test"])
+
+        table.add_row(["loc", str(self.src.loc), str(self.dep.loc), str(self.test.loc)])
+        table.add_row(["sloc", str(self.src.sloc), str(self.dep.sloc), str(self.test.sloc)])
+        table.add_row(["cloc", str(self.src.cloc), str(self.dep.cloc), str(self.test.cloc)])
+        table.add_row(
+            ["Total", str(self.src.total()), str(self.dep.total()), str(self.test.total())]
+        )
+        return table
+
+
+def count_lines(contract_lines: List[str]) -> Tuple[int, int, int]:
+    """Function to count and classify the lines of code in a contract.
+    Args:
+        contract_lines: list(str) representing the lines of a contract.
+    Returns:
+        tuple(int, int, int) representing (cloc, sloc, loc)
+    """
+    multiline_comment = False
+    cloc = 0
+    sloc = 0
+    loc = 0
+
+    for line in contract_lines:
+        loc += 1
+        stripped_line = line.strip()
+        if not multiline_comment:
+            if stripped_line.startswith("//"):
+                cloc += 1
+            elif "/*" in stripped_line:
+                # Account for case where /* is followed by */ on the same line.
+                # If it is, then multiline_comment does not need to be set to True
+                start_idx = stripped_line.find("/*")
+                end_idx = stripped_line.find("*/", start_idx + 2)
+                if end_idx == -1:
+                    multiline_comment = True
+                cloc += 1
+            elif stripped_line:
+                sloc += 1
+        else:
+            cloc += 1
+            if "*/" in stripped_line:
+                multiline_comment = False
+
+    return cloc, sloc, loc
+
+
+def _update_lines(loc_info: LoCInfo, lines: list) -> None:
+    """An internal function used to update (mutate in place) the loc_info.
+
+    Args:
+        loc_info: LoCInfo to be updated
+        lines: list(str) representing the lines of a contract.
+    """
+    cloc, sloc, loc = count_lines(lines)
+    loc_info.loc += loc
+    loc_info.cloc += cloc
+    loc_info.sloc += sloc
+
+
+def compute_loc_metrics(slither: Slither) -> LoC:
+    """Used to compute the lines of code metrics for a Slither object.
+
+    Args:
+        slither: A Slither object
+    Returns:
+        A LoC object
+    """
+
+    loc = LoC()
+
+    for filename, source_code in slither.source_code.items():
+        current_lines = source_code.splitlines()
+        is_dep = False
+        if slither.crytic_compile:
+            is_dep = slither.crytic_compile.is_dependency(filename)
+        loc_type = loc.dep if is_dep else loc.test if is_test_file(Path(filename)) else loc.src
+        _update_lines(loc_type, current_lines)
+    return loc

slither/utils/upgradeability.py

@@ -19,10 +19,12 @@ from slither.core.variables.local_variable_init_from_tuple import LocalVariableI
 from slither.core.variables.state_variable import StateVariable
 from slither.analyses.data_dependency.data_dependency import get_dependencies
 from slither.core.variables.variable import Variable
-from slither.core.expressions.literal import Literal
-from slither.core.expressions.identifier import Identifier
-from slither.core.expressions.call_expression import CallExpression
-from slither.core.expressions.assignment_operation import AssignmentOperation
+from slither.core.expressions import (
+    Literal,
+    Identifier,
+    CallExpression,
+    AssignmentOperation,
+)
 from slither.core.cfg.node import Node, NodeType
 from slither.slithir.operations import (
     Operation,
@@ -61,11 +63,42 @@ from slither.slithir.variables import (
 from slither.tools.read_storage.read_storage import SlotInfo, SlitherReadStorage
 
 
+class TaintedExternalContract:
+    def __init__(self, contract: "Contract") -> None:
+        self._contract: Contract = contract
+        self._tainted_functions: List[Function] = []
+        self._tainted_variables: List[Variable] = []
+
+    @property
+    def contract(self) -> Contract:
+        return self._contract
+
+    @property
+    def tainted_functions(self) -> List[Function]:
+        return self._tainted_functions
+
+    def add_tainted_function(self, f: Function):
+        self._tainted_functions.append(f)
+
+    @property
+    def tainted_variables(self) -> List[Variable]:
+        return self._tainted_variables
+
+    def add_tainted_variable(self, v: Variable):
+        self._tainted_variables.append(v)
+
+
 # pylint: disable=too-many-locals
 def compare(
-    v1: Contract, v2: Contract
+    v1: Contract, v2: Contract, include_external: bool = False
 ) -> Tuple[
-    List[Variable], List[Variable], List[Variable], List[Function], List[Function], List[Function]
+    List[Variable],
+    List[Variable],
+    List[Variable],
+    List[Function],
+    List[Function],
+    List[Function],
+    List[TaintedExternalContract],
 ]:
     """
     Compares two versions of a contract. Most useful for upgradeable (logic) contracts,
@@ -74,6 +107,7 @@ def compare(
     Args:
         v1: Original version of (upgradeable) contract
         v2: Updated version of (upgradeable) contract
+        include_external: Optional flag to enable cross-contract external taint analysis
 
     Returns:
         missing-vars-in-v2: list[Variable],
@@ -82,6 +116,7 @@ def compare(
         new-functions: list[Function],
         modified-functions: list[Function],
         tainted-functions: list[Function]
+        tainted-contracts: list[TaintedExternalContract]
     """
 
     order_vars1 = [
@@ -113,17 +148,13 @@ def compare(
         if sig not in func_sigs1:
             new_modified_functions.append(function)
             new_functions.append(function)
-            new_modified_function_vars += (
-                function.state_variables_read + function.state_variables_written
-            )
+            new_modified_function_vars += function.all_state_variables_written()
         elif not function.is_constructor_variables and is_function_modified(
             orig_function, function
         ):
             new_modified_functions.append(function)
             modified_functions.append(function)
-            new_modified_function_vars += (
-                function.state_variables_read + function.state_variables_written
-            )
+            new_modified_function_vars += function.all_state_variables_written()
 
     # Find all unmodified functions that call a modified function or read/write the
     # same state variable(s) as a new/modified function, i.e., tainted functions
@@ -140,25 +171,28 @@ def compare(
         tainted_vars = [
             var
             for var in set(new_modified_function_vars)
-            if var in function.variables_read_or_written
+            if var in function.all_state_variables_read() + function.all_state_variables_written()
             and not var.is_constant
             and not var.is_immutable
         ]
         if len(modified_calls) > 0 or len(tainted_vars) > 0:
             tainted_functions.append(function)
 
-    # Find all new or tainted variables, i.e., variables that are read or written by a new/modified/tainted function
+    # Find all new or tainted variables, i.e., variables that are written by a new/modified/tainted function
     for var in order_vars2:
-        read_by = v2.get_functions_reading_from_variable(var)
         written_by = v2.get_functions_writing_to_variable(var)
-        if v1.get_state_variable_from_name(var.name) is None:
+        if next((v for v in v1.state_variables_ordered if v.name == var.name), None) is None:
             new_variables.append(var)
-        elif any(
-            func in read_by or func in written_by
-            for func in new_modified_functions + tainted_functions
-        ):
+        elif any(func in written_by for func in new_modified_functions + tainted_functions):
             tainted_variables.append(var)
 
+    tainted_contracts = []
+    if include_external:
+        # Find all external contracts and functions called by new/modified/tainted functions
+        tainted_contracts = tainted_external_contracts(
+            new_functions + modified_functions + tainted_functions
+        )
+
     return (
         missing_vars_in_v2,
         new_variables,
@@ -166,9 +200,137 @@ def compare(
         new_functions,
         modified_functions,
         tainted_functions,
+        tainted_contracts,
     )
 
 
+def tainted_external_contracts(funcs: List[Function]) -> List[TaintedExternalContract]:
+    """
+    Takes a list of functions from one contract, finds any calls in these to functions in external contracts,
+    and determines which variables and functions in the external contracts are tainted by these external calls.
+    Args:
+        funcs: a list of Function objects to search for external calls.
+
+    Returns:
+        TaintedExternalContract() (
+            contract: Contract,
+            tainted_functions: List[TaintedFunction],
+            tainted_variables: List[TaintedVariable]
+        )
+    """
+    tainted_contracts: dict[str, TaintedExternalContract] = {}
+    tainted_list: list[TaintedExternalContract] = []
+
+    for func in funcs:
+        for contract, target in func.all_high_level_calls():
+            if contract.is_library:
+                # Not interested in library calls
+                continue
+            if contract.name not in tainted_contracts:
+                # A contract may be tainted by multiple function calls - only make one TaintedExternalContract object
+                tainted_contracts[contract.name] = TaintedExternalContract(contract)
+            if (
+                isinstance(target, Function)
+                and target not in funcs
+                and target not in (f for f in tainted_contracts[contract.name].tainted_functions)
+                and not (target.is_constructor or target.is_fallback or target.is_receive)
+            ):
+                # Found a high-level call to a new tainted function
+                tainted_contracts[contract.name].add_tainted_function(target)
+                for var in target.all_state_variables_written():
+                    # Consider as tainted all variables written by the tainted function
+                    if var not in (v for v in tainted_contracts[contract.name].tainted_variables):
+                        tainted_contracts[contract.name].add_tainted_variable(var)
+            elif (
+                isinstance(target, StateVariable)
+                and target not in (v for v in tainted_contracts[contract.name].tainted_variables)
+                and not (target.is_constant or target.is_immutable)
+            ):
+                # Found a new high-level call to a public state variable getter
+                tainted_contracts[contract.name].add_tainted_variable(target)
+    for c in tainted_contracts.values():
+        tainted_list.append(c)
+        contract = c.contract
+        variables = c.tainted_variables
+        for var in variables:
+            # For each tainted variable, consider as tainted any function that reads or writes to it
+            read_write = set(
+                contract.get_functions_reading_from_variable(var)
+                + contract.get_functions_writing_to_variable(var)
+            )
+            for f in read_write:
+                if f not in tainted_contracts[contract.name].tainted_functions and not (
+                    f.is_constructor or f.is_fallback or f.is_receive
+                ):
+                    c.add_tainted_function(f)
+    return tainted_list
+
+
+def tainted_inheriting_contracts(
+    tainted_contracts: List[TaintedExternalContract], contracts: List[Contract] = None
+) -> List[TaintedExternalContract]:
+    """
+    Takes a list of TaintedExternalContract obtained from tainted_external_contracts, and finds any contracts which
+    inherit a tainted contract, as well as any functions that call tainted functions or read tainted variables in
+    the inherited contract.
+    Args:
+        tainted_contracts: the list obtained from `tainted_external_contracts` or `compare`.
+        contracts: (optional) the list of contracts to check for inheritance. If not provided, defaults to
+                    `contract.compilation_unit.contracts` for each contract in tainted_contracts.
+
+    Returns:
+        An updated list of TaintedExternalContract, including all from the input list.
+    """
+    for tainted in tainted_contracts:
+        contract = tainted.contract
+        check_contracts = contracts
+        if contracts is None:
+            check_contracts = contract.compilation_unit.contracts
+        # We are only interested in checking contracts that inherit a tainted contract
+        check_contracts = [
+            c
+            for c in check_contracts
+            if c.name not in [t.contract.name for t in tainted_contracts]
+            and contract.name in [i.name for i in c.inheritance]
+        ]
+        for c in check_contracts:
+            new_taint = TaintedExternalContract(c)
+            for f in c.functions_declared:
+                # Search for functions that call an inherited tainted function or access an inherited tainted variable
+                internal_calls = [c for c in f.all_internal_calls() if isinstance(c, Function)]
+                if any(
+                    call.canonical_name == t.canonical_name
+                    for t in tainted.tainted_functions
+                    for call in internal_calls
+                ) or any(
+                    var.canonical_name == t.canonical_name
+                    for t in tainted.tainted_variables
+                    for var in f.all_state_variables_read() + f.all_state_variables_written()
+                ):
+                    new_taint.add_tainted_function(f)
+            for f in new_taint.tainted_functions:
+                # For each newly found tainted function, consider as tainted any variable it writes to
+                for var in f.all_state_variables_written():
+                    if var not in (
+                        v for v in tainted.tainted_variables + new_taint.tainted_variables
+                    ):
+                        new_taint.add_tainted_variable(var)
+            for var in new_taint.tainted_variables:
+                # For each newly found tainted variable, consider as tainted any function that reads or writes to it
+                read_write = set(
+                    contract.get_functions_reading_from_variable(var)
+                    + contract.get_functions_writing_to_variable(var)
+                )
+                for f in read_write:
+                    if f not in (
+                        t for t in tainted.tainted_functions + new_taint.tainted_functions
+                    ) and not (f.is_constructor or f.is_fallback or f.is_receive):
+                        new_taint.add_tainted_function(f)
+            if len(new_taint.tainted_functions) > 0:
+                tainted_contracts.append(new_taint)
+    return tainted_contracts
+
+
 def get_missing_vars(v1: Contract, v2: Contract) -> List[StateVariable]:
     """
     Gets all non-constant/immutable StateVariables that appear in v1 but not v2
@@ -220,6 +382,8 @@ def is_function_modified(f1: Function, f2: Function) -> bool:
         visited.extend([node_f1, node_f2])
         queue_f1.extend(son for son in node_f1.sons if son not in visited)
         queue_f2.extend(son for son in node_f2.sons if son not in visited)
+        if len(node_f1.irs) != len(node_f2.irs):
+            return True
         for i, ir in enumerate(node_f1.irs):
             if encode_ir_for_compare(ir) != encode_ir_for_compare(node_f2.irs[i]):
                 return True
@@ -273,13 +437,13 @@ def encode_ir_for_compare(ir: Operation) -> str:
     if isinstance(ir, Assignment):
         return f"({encode_var_for_compare(ir.lvalue)}):=({encode_var_for_compare(ir.rvalue)})"
     if isinstance(ir, Index):
-        return f"index({ntype(ir.index_type)})"
+        return f"index({ntype(ir.variable_right.type)})"
     if isinstance(ir, Member):
         return "member"  # .format(ntype(ir._type))
     if isinstance(ir, Length):
         return "length"
     if isinstance(ir, Binary):
-        return f"binary({str(ir.variable_left)}{str(ir.type)}{str(ir.variable_right)})"
+        return f"binary({encode_var_for_compare(ir.variable_left)}{ir.type}{encode_var_for_compare(ir.variable_right)})"
     if isinstance(ir, Unary):
         return f"unary({str(ir.type)})"
     if isinstance(ir, Condition):
@@ -330,7 +494,7 @@ def encode_var_for_compare(var: Variable) -> str:
 
     # variables
     if isinstance(var, Constant):
-        return f"constant({ntype(var.type)})"
+        return f"constant({ntype(var.type)},{var.value})"
     if isinstance(var, SolidityVariableComposed):
         return f"solidity_variable_composed({var.name})"
     if isinstance(var, SolidityVariable):
@@ -340,9 +504,16 @@ def encode_var_for_compare(var: Variable) -> str:
     if isinstance(var, ReferenceVariable):
         return f"reference({ntype(var.type)})"
     if isinstance(var, LocalVariable):
-        return f"local_solc_variable({var.location})"
+        return f"local_solc_variable({ntype(var.type)},{var.location})"
     if isinstance(var, StateVariable):
-        return f"state_solc_variable({ntype(var.type)})"
+        if not (var.is_constant or var.is_immutable):
+            try:
+                slot, _ = var.contract.compilation_unit.storage_layout_of(var.contract, var)
+            except KeyError:
+                slot = var.name
+        else:
+            slot = var.name
+        return f"state_solc_variable({ntype(var.type)},{slot})"
     if isinstance(var, LocalVariableInitFromTuple):
         return "local_variable_init_tuple"
     if isinstance(var, TupleVariable):
@@ -398,6 +569,7 @@ def get_proxy_implementation_var(proxy: Contract) -> Optional[Variable]:
         try:
             delegate = next(var for var in dependencies if isinstance(var, StateVariable))
         except StopIteration:
+            # TODO: Handle cases where get_dependencies doesn't return any state variables.
             return delegate
     return delegate
 

tests/e2e/detectors/snapshots/detectors__detector_BuiltinSymbolShadowing_0_4_25_shadowing_builtin_symbols_sol__0.txt

@@ -12,12 +12,12 @@ FurtherExtendedContract.this (tests/e2e/detectors/test_data/shadowing-builtin/0.
 
 BaseContract.now (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#5) (state variable) shadows built-in symbol"
 
-BaseContractrevert(bool) (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#7) (event) shadows built-in symbol"
-
 ExtendedContract.assert(bool).msg (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#14) (local variable) shadows built-in symbol"
 
 ExtendedContract.assert(bool) (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#13-15) (function) shadows built-in symbol"
 
+BaseContract.revert(bool) (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#7) (event) shadows built-in symbol"
+
 FurtherExtendedContract.require().sha3 (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#26) (local variable) shadows built-in symbol"
 
 FurtherExtendedContract.blockhash (tests/e2e/detectors/test_data/shadowing-builtin/0.4.25/shadowing_builtin_symbols.sol#19) (state variable) shadows built-in symbol"

tests/e2e/detectors/snapshots/detectors__detector_BuiltinSymbolShadowing_0_5_16_shadowing_builtin_symbols_sol__0.txt

@@ -10,12 +10,12 @@ FurtherExtendedContract.this (tests/e2e/detectors/test_data/shadowing-builtin/0.
 
 BaseContract.now (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#5) (state variable) shadows built-in symbol"
 
-BaseContractrevert(bool) (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#7) (event) shadows built-in symbol"
-
 ExtendedContract.assert(bool).msg (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#14) (local variable) shadows built-in symbol"
 
 ExtendedContract.assert(bool) (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#13-15) (function) shadows built-in symbol"
 
+BaseContract.revert(bool) (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#7) (event) shadows built-in symbol"
+
 FurtherExtendedContract.require().sha3 (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#26) (local variable) shadows built-in symbol"
 
 FurtherExtendedContract.blockhash (tests/e2e/detectors/test_data/shadowing-builtin/0.5.16/shadowing_builtin_symbols.sol#19) (state variable) shadows built-in symbol"

tests/e2e/detectors/snapshots/detectors__detector_LocalShadowing_0_4_25_shadowing_local_variable_sol__0.txt

@@ -10,7 +10,7 @@ FurtherExtendedContract.shadowingParent(uint256).y (tests/e2e/detectors/test_dat
 	- BaseContract.y (tests/e2e/detectors/test_data/shadowing-local/0.4.25/shadowing_local_variable.sol#5) (state variable)
 
 FurtherExtendedContract.shadowingParent(uint256).v (tests/e2e/detectors/test_data/shadowing-local/0.4.25/shadowing_local_variable.sol#25) shadows:
-	- ExtendedContractv() (tests/e2e/detectors/test_data/shadowing-local/0.4.25/shadowing_local_variable.sol#13) (event)
+	- ExtendedContract.v() (tests/e2e/detectors/test_data/shadowing-local/0.4.25/shadowing_local_variable.sol#13) (event)
 
 FurtherExtendedContract.shadowingParent(uint256).w (tests/e2e/detectors/test_data/shadowing-local/0.4.25/shadowing_local_variable.sol#25) shadows:
 	- FurtherExtendedContract.w() (tests/e2e/detectors/test_data/shadowing-local/0.4.25/shadowing_local_variable.sol#20-23) (modifier)

tests/e2e/detectors/snapshots/detectors__detector_LocalShadowing_0_5_16_shadowing_local_variable_sol__0.txt

@@ -10,7 +10,7 @@ FurtherExtendedContract.shadowingParent(uint256).y (tests/e2e/detectors/test_dat
 	- BaseContract.y (tests/e2e/detectors/test_data/shadowing-local/0.5.16/shadowing_local_variable.sol#5) (state variable)
 
 FurtherExtendedContract.shadowingParent(uint256).v (tests/e2e/detectors/test_data/shadowing-local/0.5.16/shadowing_local_variable.sol#25) shadows:
-	- ExtendedContractv() (tests/e2e/detectors/test_data/shadowing-local/0.5.16/shadowing_local_variable.sol#13) (event)
+	- ExtendedContract.v() (tests/e2e/detectors/test_data/shadowing-local/0.5.16/shadowing_local_variable.sol#13) (event)
 
 FurtherExtendedContract.shadowingParent(uint256).w (tests/e2e/detectors/test_data/shadowing-local/0.5.16/shadowing_local_variable.sol#25) shadows:
 	- FurtherExtendedContract.w() (tests/e2e/detectors/test_data/shadowing-local/0.5.16/shadowing_local_variable.sol#20-23) (modifier)

tests/e2e/detectors/snapshots/detectors__detector_LocalShadowing_0_6_11_shadowing_local_variable_sol__0.txt

@@ -5,7 +5,7 @@ FurtherExtendedContract.shadowingParent(uint256).y (tests/e2e/detectors/test_dat
 	- BaseContract.y (tests/e2e/detectors/test_data/shadowing-local/0.6.11/shadowing_local_variable.sol#5) (state variable)
 
 FurtherExtendedContract.shadowingParent(uint256).v (tests/e2e/detectors/test_data/shadowing-local/0.6.11/shadowing_local_variable.sol#25) shadows:
-	- ExtendedContractv() (tests/e2e/detectors/test_data/shadowing-local/0.6.11/shadowing_local_variable.sol#13) (event)
+	- ExtendedContract.v() (tests/e2e/detectors/test_data/shadowing-local/0.6.11/shadowing_local_variable.sol#13) (event)
 
 FurtherExtendedContract.shadowingParent(uint256).w (tests/e2e/detectors/test_data/shadowing-local/0.6.11/shadowing_local_variable.sol#25) shadows:
 	- FurtherExtendedContract.w() (tests/e2e/detectors/test_data/shadowing-local/0.6.11/shadowing_local_variable.sol#20-23) (modifier)

tests/e2e/detectors/snapshots/detectors__detector_LocalShadowing_0_7_6_shadowing_local_variable_sol__0.txt

@@ -5,7 +5,7 @@ FurtherExtendedContract.shadowingParent(uint256).y (tests/e2e/detectors/test_dat
 	- BaseContract.y (tests/e2e/detectors/test_data/shadowing-local/0.7.6/shadowing_local_variable.sol#5) (state variable)
 
 FurtherExtendedContract.shadowingParent(uint256).v (tests/e2e/detectors/test_data/shadowing-local/0.7.6/shadowing_local_variable.sol#25) shadows:
-	- ExtendedContractv() (tests/e2e/detectors/test_data/shadowing-local/0.7.6/shadowing_local_variable.sol#13) (event)
+	- ExtendedContract.v() (tests/e2e/detectors/test_data/shadowing-local/0.7.6/shadowing_local_variable.sol#13) (event)
 
 FurtherExtendedContract.shadowingParent(uint256).w (tests/e2e/detectors/test_data/shadowing-local/0.7.6/shadowing_local_variable.sol#25) shadows:
 	- FurtherExtendedContract.w() (tests/e2e/detectors/test_data/shadowing-local/0.7.6/shadowing_local_variable.sol#20-23) (modifier)

tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_4_25_naming_convention_sol__0.txt

@@ -18,10 +18,10 @@ Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-co
 
 Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#56) is not in mixedCase
 
-Event namingevent_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#23) is not in CapWords
-
 Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#68) is single letter l, O, or I, which should not be used
 
+Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#23) is not in CapWords
+
 Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#41-43) is not in mixedCase
 
 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.4.25/naming_convention.sol#30-33) is not in mixedCase

tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_5_16_naming_convention_sol__0.txt

@@ -18,10 +18,10 @@ Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-co
 
 Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#56) is not in mixedCase
 
-Event namingevent_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#23) is not in CapWords
-
 Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#68) is single letter l, O, or I, which should not be used
 
+Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#23) is not in CapWords
+
 Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#41-43) is not in mixedCase
 
 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.5.16/naming_convention.sol#30-33) is not in mixedCase

tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_6_11_naming_convention_sol__0.txt

@@ -18,10 +18,10 @@ Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-co
 
 Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#56) is not in mixedCase
 
-Event namingevent_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#23) is not in CapWords
-
 Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#68) is single letter l, O, or I, which should not be used
 
+Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#23) is not in CapWords
+
 Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#41-43) is not in mixedCase
 
 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.6.11/naming_convention.sol#30-33) is not in mixedCase

tests/e2e/detectors/snapshots/detectors__detector_NamingConvention_0_7_6_naming_convention_sol__0.txt

@@ -18,10 +18,10 @@ Parameter T.test(uint256,uint256)._used (tests/e2e/detectors/test_data/naming-co
 
 Variable T._myPublicVar (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#56) is not in mixedCase
 
-Event namingevent_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#23) is not in CapWords
-
 Variable T.O (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#68) is single letter l, O, or I, which should not be used
 
+Event naming.event_(uint256) (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#23) is not in CapWords
+
 Modifier naming.CantDo() (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#41-43) is not in mixedCase
 
 Function naming.GetOne() (tests/e2e/detectors/test_data/naming-convention/0.7.6/naming_convention.sol#30-33) is not in mixedCase

tests/e2e/detectors/snapshots/detectors__detector_UnindexedERC20EventParameters_0_4_25_erc20_indexed_sol__0.txt

@@ -1,8 +1,8 @@
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#19)does not index parameter to
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#20)does not index parameter owner
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#20)does not index parameter owner
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#19)does not index parameter from
 
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#19)does not index parameter from
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#20)does not index parameter spender
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#20)does not index parameter spender
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.4.25/erc20_indexed.sol#19)does not index parameter to
 

tests/e2e/detectors/snapshots/detectors__detector_UnindexedERC20EventParameters_0_5_16_erc20_indexed_sol__0.txt

@@ -1,8 +1,8 @@
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#19)does not index parameter to
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#20)does not index parameter owner
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#20)does not index parameter owner
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#19)does not index parameter from
 
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#19)does not index parameter from
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#20)does not index parameter spender
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#20)does not index parameter spender
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.5.16/erc20_indexed.sol#19)does not index parameter to
 

tests/e2e/detectors/snapshots/detectors__detector_UnindexedERC20EventParameters_0_6_11_erc20_indexed_sol__0.txt

@@ -1,8 +1,8 @@
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#19)does not index parameter to
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#20)does not index parameter owner
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#20)does not index parameter owner
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#19)does not index parameter from
 
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#19)does not index parameter from
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#20)does not index parameter spender
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#20)does not index parameter spender
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.6.11/erc20_indexed.sol#19)does not index parameter to
 

tests/e2e/detectors/snapshots/detectors__detector_UnindexedERC20EventParameters_0_7_6_erc20_indexed_sol__0.txt

@@ -1,8 +1,8 @@
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#19)does not index parameter to
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#20)does not index parameter owner
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#20)does not index parameter owner
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#19)does not index parameter from
 
-ERC20 event IERC20BadTransfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#19)does not index parameter from
+ERC20 event IERC20Bad.Approval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#20)does not index parameter spender
 
-ERC20 event IERC20BadApproval(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#20)does not index parameter spender
+ERC20 event IERC20Bad.Transfer(address,address,uint256) (tests/e2e/detectors/test_data/erc20-indexed/0.7.6/erc20_indexed.sol#19)does not index parameter to
 

tests/unit/core/test_arithmetic.py

@@ -2,7 +2,8 @@ from pathlib import Path
 
 from slither import Slither
 from slither.utils.arithmetic import unchecked_arithemtic_usage
-
+from slither.slithir.operations import Binary, Unary, Assignment
+from slither.slithir.variables.temporary import TemporaryVariable
 
 TEST_DATA_DIR = Path(__file__).resolve().parent / "test_data" / "arithmetic_usage"
 
@@ -14,3 +15,21 @@ def test_arithmetic_usage(solc_binary_path) -> None:
     assert {
         f.source_mapping.content_hash for f in unchecked_arithemtic_usage(slither.contracts[0])
     } == {"2b4bc73cf59d486dd9043e840b5028b679354dd9", "e4ecd4d0fda7e762d29aceb8425f2c5d4d0bf962"}
+
+
+def test_scope_is_checked(solc_binary_path) -> None:
+    solc_path = solc_binary_path("0.8.15")
+    slither = Slither(Path(TEST_DATA_DIR, "unchecked_scope.sol").as_posix(), solc=solc_path)
+    func = slither.get_contract_from_name("TestScope")[0].get_function_from_full_name(
+        "scope(uint256)"
+    )
+    bin_op_is_checked = {}
+    for node in func.nodes:
+        for op in node.irs:
+            if isinstance(op, (Binary, Unary)):
+                bin_op_is_checked[op.lvalue] = op.node.scope.is_checked
+            if isinstance(op, Assignment) and isinstance(op.rvalue, TemporaryVariable):
+                if op.lvalue.name.startswith("checked"):
+                    assert bin_op_is_checked[op.rvalue] is True
+                else:
+                    assert bin_op_is_checked[op.rvalue] is False

tests/unit/core/test_data/arithmetic_usage/unchecked_scope.sol

@@ -0,0 +1,17 @@
+contract TestScope {
+    function scope(uint256 x) public {
+        uint checked1 = x - x; 
+        unchecked {
+            uint unchecked1 = x - x;
+            if (true) {
+                uint unchecked2 = x - x;
+
+            }
+            for (uint i = 0; i < 10; i++) {
+                uint unchecked3 = x - x;
+
+            }
+        }
+        uint checked2 = x - x; 
+    }
+}

tests/unit/utils/test_data/upgradeability_util/src/ContractV2.sol

@@ -1,6 +1,7 @@
 pragma solidity ^0.8.2;
 
 import "./ProxyStorage.sol";
+import "./ERC20.sol";
 
 contract ContractV2 is ProxyStorage {
     uint private stateA = 0;
@@ -38,4 +39,8 @@ contract ContractV2 is ProxyStorage {
     function checkB() internal returns (bool) {
         return stateB == 32;
     }
+
+    function erc20Transfer(address erc20, address to, uint256 amount) public returns (bool) {
+        return ERC20(erc20).transfer(to, amount);
+    }
 }

tests/unit/utils/test_data/upgradeability_util/src/ERC20.sol

@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v4.8.0) (token/ERC20/ERC20.sol)
+
+pragma solidity ^0.8.0;
+
+/**
+ * @dev Implementation of the {IERC20} interface.
+ *
+ * This implementation is agnostic to the way tokens are created. This means
+ * that a supply mechanism has to be added in a derived contract using {_mint}.
+ * For a generic mechanism see {ERC20PresetMinterPauser}.
+ *
+ * TIP: For a detailed writeup see our guide
+ * https://forum.openzeppelin.com/t/how-to-implement-erc20-supply-mechanisms/226[How
+ * to implement supply mechanisms].
+ *
+ * We have followed general OpenZeppelin Contracts guidelines: functions revert
+ * instead returning `false` on failure. This behavior is nonetheless
+ * conventional and does not conflict with the expectations of ERC20
+ * applications.
+ *
+ * Additionally, an {Approval} event is emitted on calls to {transferFrom}.
+ * This allows applications to reconstruct the allowance for all accounts just
+ * by listening to said events. Other implementations of the EIP may not emit
+ * these events, as it isn't required by the specification.
+ *
+ * Finally, the non-standard {decreaseAllowance} and {increaseAllowance}
+ * functions have been added to mitigate the well-known issues around setting
+ * allowances. See {IERC20-approve}.
+ */
+contract ERC20 {
+    mapping(address => uint256) private _balances;
+
+    mapping(address => mapping(address => uint256)) private _allowances;
+
+    uint256 private _totalSupply;
+
+    string private _name;
+    string private _symbol;
+
+    /**
+     * @dev Sets the values for {name} and {symbol}.
+     *
+     * The default value of {decimals} is 18. To select a different value for
+     * {decimals} you should overload it.
+     *
+     * All two of these values are immutable: they can only be set once during
+     * construction.
+     */
+    constructor(string memory name_, string memory symbol_) {
+        _name = name_;
+        _symbol = symbol_;
+    }
+
+    /**
+     * @dev Returns the name of the token.
+     */
+    function name() public view virtual returns (string memory) {
+        return _name;
+    }
+
+    /**
+     * @dev Returns the symbol of the token, usually a shorter version of the
+     * name.
+     */
+    function symbol() public view virtual returns (string memory) {
+        return _symbol;
+    }
+
+    /**
+     * @dev Returns the number of decimals used to get its user representation.
+     * For example, if `decimals` equals `2`, a balance of `505` tokens should
+     * be displayed to a user as `5.05` (`505 / 10 ** 2`).
+     *
+     * Tokens usually opt for a value of 18, imitating the relationship between
+     * Ether and Wei. This is the value {ERC20} uses, unless this function is
+     * overridden;
+     *
+     * NOTE: This information is only used for _display_ purposes: it in
+     * no way affects any of the arithmetic of the contract, including
+     * {IERC20-balanceOf} and {IERC20-transfer}.
+     */
+    function decimals() public view virtual returns (uint8) {
+        return 18;
+    }
+
+    /**
+     * @dev See {IERC20-totalSupply}.
+     */
+    function totalSupply() public view virtual returns (uint256) {
+        return _totalSupply;
+    }
+
+    /**
+     * @dev See {IERC20-balanceOf}.
+     */
+    function balanceOf(address account) public view virtual returns (uint256) {
+        return _balances[account];
+    }
+
+    /**
+     * @dev See {IERC20-transfer}.
+     *
+     * Requirements:
+     *
+     * - `to` cannot be the zero address.
+     * - the caller must have a balance of at least `amount`.
+     */
+    function transfer(address to, uint256 amount) public virtual returns (bool) {
+        address owner = msg.sender;
+        _transfer(owner, to, amount);
+        return true;
+    }
+
+    /**
+     * @dev See {IERC20-allowance}.
+     */
+    function allowance(address owner, address spender) public view virtual returns (uint256) {
+        return _allowances[owner][spender];
+    }
+
+    /**
+     * @dev See {IERC20-approve}.
+     *
+     * NOTE: If `amount` is the maximum `uint256`, the allowance is not updated on
+     * `transferFrom`. This is semantically equivalent to an infinite approval.
+     *
+     * Requirements:
+     *
+     * - `spender` cannot be the zero address.
+     */
+    function approve(address spender, uint256 amount) public virtual returns (bool) {
+        address owner = msg.sender;
+        _approve(owner, spender, amount);
+        return true;
+    }
+
+    /**
+     * @dev See {IERC20-transferFrom}.
+     *
+     * Emits an {Approval} event indicating the updated allowance. This is not
+     * required by the EIP. See the note at the beginning of {ERC20}.
+     *
+     * NOTE: Does not update the allowance if the current allowance
+     * is the maximum `uint256`.
+     *
+     * Requirements:
+     *
+     * - `from` and `to` cannot be the zero address.
+     * - `from` must have a balance of at least `amount`.
+     * - the caller must have allowance for ``from``'s tokens of at least
+     * `amount`.
+     */
+    function transferFrom(
+        address from,
+        address to,
+        uint256 amount
+    ) public virtual returns (bool) {
+        address spender = msg.sender;
+        _spendAllowance(from, spender, amount);
+        _transfer(from, to, amount);
+        return true;
+    }
+
+    /**
+     * @dev Atomically increases the allowance granted to `spender` by the caller.
+     *
+     * This is an alternative to {approve} that can be used as a mitigation for
+     * problems described in {IERC20-approve}.
+     *
+     * Emits an {Approval} event indicating the updated allowance.
+     *
+     * Requirements:
+     *
+     * - `spender` cannot be the zero address.
+     */
+    function increaseAllowance(address spender, uint256 addedValue) public virtual returns (bool) {
+        address owner = msg.sender;
+        _approve(owner, spender, allowance(owner, spender) + addedValue);
+        return true;
+    }
+
+    /**
+     * @dev Atomically decreases the allowance granted to `spender` by the caller.
+     *
+     * This is an alternative to {approve} that can be used as a mitigation for
+     * problems described in {IERC20-approve}.
+     *
+     * Emits an {Approval} event indicating the updated allowance.
+     *
+     * Requirements:
+     *
+     * - `spender` cannot be the zero address.
+     * - `spender` must have allowance for the caller of at least
+     * `subtractedValue`.
+     */
+    function decreaseAllowance(address spender, uint256 subtractedValue) public virtual returns (bool) {
+        address owner = msg.sender;
+        uint256 currentAllowance = allowance(owner, spender);
+        require(currentAllowance >= subtractedValue, "ERC20: decreased allowance below zero");
+        unchecked {
+            _approve(owner, spender, currentAllowance - subtractedValue);
+        }
+
+        return true;
+    }
+
+    /**
+     * @dev Moves `amount` of tokens from `from` to `to`.
+     *
+     * This internal function is equivalent to {transfer}, and can be used to
+     * e.g. implement automatic token fees, slashing mechanisms, etc.
+     *
+     * Emits a {Transfer} event.
+     *
+     * Requirements:
+     *
+     * - `from` cannot be the zero address.
+     * - `to` cannot be the zero address.
+     * - `from` must have a balance of at least `amount`.
+     */
+    function _transfer(
+        address from,
+        address to,
+        uint256 amount
+    ) internal virtual {
+        require(from != address(0), "ERC20: transfer from the zero address");
+        require(to != address(0), "ERC20: transfer to the zero address");
+
+        _beforeTokenTransfer(from, to, amount);
+
+        uint256 fromBalance = _balances[from];
+        require(fromBalance >= amount, "ERC20: transfer amount exceeds balance");
+        unchecked {
+            _balances[from] = fromBalance - amount;
+            // Overflow not possible: the sum of all balances is capped by totalSupply, and the sum is preserved by
+            // decrementing then incrementing.
+            _balances[to] += amount;
+        }
+        _afterTokenTransfer(from, to, amount);
+    }
+
+    /** @dev Creates `amount` tokens and assigns them to `account`, increasing
+     * the total supply.
+     *
+     * Emits a {Transfer} event with `from` set to the zero address.
+     *
+     * Requirements:
+     *
+     * - `account` cannot be the zero address.
+     */
+    function _mint(address account, uint256 amount) internal virtual {
+        require(account != address(0), "ERC20: mint to the zero address");
+
+        _beforeTokenTransfer(address(0), account, amount);
+
+        _totalSupply += amount;
+        unchecked {
+            // Overflow not possible: balance + amount is at most totalSupply + amount, which is checked above.
+            _balances[account] += amount;
+        }
+        _afterTokenTransfer(address(0), account, amount);
+    }
+
+    /**
+     * @dev Destroys `amount` tokens from `account`, reducing the
+     * total supply.
+     *
+     * Emits a {Transfer} event with `to` set to the zero address.
+     *
+     * Requirements:
+     *
+     * - `account` cannot be the zero address.
+     * - `account` must have at least `amount` tokens.
+     */
+    function _burn(address account, uint256 amount) internal virtual {
+        require(account != address(0), "ERC20: burn from the zero address");
+
+        _beforeTokenTransfer(account, address(0), amount);
+
+        uint256 accountBalance = _balances[account];
+        require(accountBalance >= amount, "ERC20: burn amount exceeds balance");
+        unchecked {
+            _balances[account] = accountBalance - amount;
+            // Overflow not possible: amount <= accountBalance <= totalSupply.
+            _totalSupply -= amount;
+        }
+        _afterTokenTransfer(account, address(0), amount);
+    }
+
+    /**
+     * @dev Sets `amount` as the allowance of `spender` over the `owner` s tokens.
+     *
+     * This internal function is equivalent to `approve`, and can be used to
+     * e.g. set automatic allowances for certain subsystems, etc.
+     *
+     * Emits an {Approval} event.
+     *
+     * Requirements:
+     *
+     * - `owner` cannot be the zero address.
+     * - `spender` cannot be the zero address.
+     */
+    function _approve(
+        address owner,
+        address spender,
+        uint256 amount
+    ) internal virtual {
+        require(owner != address(0), "ERC20: approve from the zero address");
+        require(spender != address(0), "ERC20: approve to the zero address");
+
+        _allowances[owner][spender] = amount;
+    }
+
+    /**
+     * @dev Updates `owner` s allowance for `spender` based on spent `amount`.
+     *
+     * Does not update the allowance amount in case of infinite allowance.
+     * Revert if not enough allowance is available.
+     *
+     * Might emit an {Approval} event.
+     */
+    function _spendAllowance(
+        address owner,
+        address spender,
+        uint256 amount
+    ) internal virtual {
+        uint256 currentAllowance = allowance(owner, spender);
+        if (currentAllowance != type(uint256).max) {
+            require(currentAllowance >= amount, "ERC20: insufficient allowance");
+            unchecked {
+                _approve(owner, spender, currentAllowance - amount);
+            }
+        }
+    }
+
+    /**
+     * @dev Hook that is called before any transfer of tokens. This includes
+     * minting and burning.
+     *
+     * Calling conditions:
+     *
+     * - when `from` and `to` are both non-zero, `amount` of ``from``'s tokens
+     * will be transferred to `to`.
+     * - when `from` is zero, `amount` tokens will be minted for `to`.
+     * - when `to` is zero, `amount` of ``from``'s tokens will be burned.
+     * - `from` and `to` are never both zero.
+     *
+     * To learn more about hooks, head to xref:ROOT:extending-contracts.adoc#using-hooks[Using Hooks].
+     */
+    function _beforeTokenTransfer(
+        address from,
+        address to,
+        uint256 amount
+    ) internal virtual {}
+
+    /**
+     * @dev Hook that is called after any transfer of tokens. This includes
+     * minting and burning.
+     *
+     * Calling conditions:
+     *
+     * - when `from` and `to` are both non-zero, `amount` of ``from``'s tokens
+     * has been transferred to `to`.
+     * - when `from` is zero, `amount` tokens have been minted for `to`.
+     * - when `to` is zero, `amount` of ``from``'s tokens have been burned.
+     * - `from` and `to` are never both zero.
+     *
+     * To learn more about hooks, head to xref:ROOT:extending-contracts.adoc#using-hooks[Using Hooks].
+     */
+    function _afterTokenTransfer(
+        address from,
+        address to,
+        uint256 amount
+    ) internal virtual {}
+}

tests/unit/utils/test_upgradeability_util.py

@@ -20,19 +20,41 @@ def test_upgrades_compare(solc_binary_path) -> None:
     sl = Slither(os.path.join(TEST_DATA_DIR, "TestUpgrades-0.8.2.sol"), solc=solc_path)
     v1 = sl.get_contract_from_name("ContractV1")[0]
     v2 = sl.get_contract_from_name("ContractV2")[0]
-    missing_vars, new_vars, tainted_vars, new_funcs, modified_funcs, tainted_funcs = compare(v1, v2)
+    (
+        missing_vars,
+        new_vars,
+        tainted_vars,
+        new_funcs,
+        modified_funcs,
+        tainted_funcs,
+        tainted_contracts,
+    ) = compare(v1, v2, include_external=True)
     assert len(missing_vars) == 0
     assert new_vars == [v2.get_state_variable_from_name("stateC")]
     assert tainted_vars == [
-        v2.get_state_variable_from_name("stateB"),
         v2.get_state_variable_from_name("bug"),
     ]
-    assert new_funcs == [v2.get_function_from_signature("i()")]
+    assert new_funcs == [
+        v2.get_function_from_signature("i()"),
+        v2.get_function_from_signature("erc20Transfer(address,address,uint256)"),
+    ]
     assert modified_funcs == [v2.get_function_from_signature("checkB()")]
     assert tainted_funcs == [
-        v2.get_function_from_signature("g(uint256)"),
         v2.get_function_from_signature("h()"),
     ]
+    erc20 = sl.get_contract_from_name("ERC20")[0]
+    assert len(tainted_contracts) == 1
+    assert tainted_contracts[0].contract == erc20
+    assert set(tainted_contracts[0].tainted_functions) == {
+        erc20.get_function_from_signature("transfer(address,uint256)"),
+        erc20.get_function_from_signature("_transfer(address,address,uint256)"),
+        erc20.get_function_from_signature("_burn(address,uint256)"),
+        erc20.get_function_from_signature("balanceOf(address)"),
+        erc20.get_function_from_signature("_mint(address,uint256)"),
+    }
+    assert tainted_contracts[0].tainted_variables == [
+        erc20.get_state_variable_from_name("_balances")
+    ]
 
 
 def test_upgrades_implementation_var(solc_binary_path) -> None: