Fixed a typo in detector where *callcode* was specified as *codecall*. Added a test to verify the fix.

pull/174/head
rajeevgopalakrishna 6 years ago
parent b3b718101d
commit 8344c4edf3
  1. 4
      slither/detectors/statements/controlled_delegatecall.py
  2. 4
      tests/controlled_delegatecall.sol

@ -24,7 +24,7 @@ contract Delegatecall{
} }
} }
``` ```
Bob calls `delegate` and delegate the execution to its malicious contract. As a result, Bob withdraws the funds of the contract and destruct it.''' Bob calls `delegate` and delegates the execution to its malicious contract. As a result, Bob withdraws the funds of the contract and destructs it.'''
WIKI_RECOMMENDATION = 'Avoid using `delegatecall`. Use only trusted destinations.' WIKI_RECOMMENDATION = 'Avoid using `delegatecall`. Use only trusted destinations.'
@ -32,7 +32,7 @@ Bob calls `delegate` and delegate the execution to its malicious contract. As a
ret = [] ret = []
for node in function.nodes: for node in function.nodes:
for ir in node.irs: for ir in node.irs:
if isinstance(ir, LowLevelCall) and ir.function_name in ['delegatecall', 'codecall']: if isinstance(ir, LowLevelCall) and ir.function_name in ['delegatecall', 'callcode']:
if is_tainted(ir.destination, function.contract): if is_tainted(ir.destination, function.contract):
ret.append(node) ret.append(node)
return ret return ret

@ -5,6 +5,10 @@ contract C{
bytes4 func_id; bytes4 func_id;
function bad_callcode_call(bytes memory data) public{
addr_bad.callcode(data);
}
function bad_delegate_call(bytes memory data) public{ function bad_delegate_call(bytes memory data) public{
addr_good.delegatecall(data); addr_good.delegatecall(data);
addr_bad.delegatecall(data); addr_bad.delegatecall(data);

Loading…
Cancel
Save