WIKI_DESCRIPTION='Incorrect return values for `ERC20` functions. A contract compiled with Solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing.'
WIKI_EXPLOIT_SCENARIO='''
WIKI_TITLE="Incorrect erc20 interface"
WIKI_DESCRIPTION="Incorrect return values for `ERC20` functions. A contract compiled with Solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing."
WIKI_EXPLOIT_SCENARIO="""
```solidity
contractToken{
functiontransfer(addressto,uintvalue)external;
//...
}
```
`Token.transfer`doesnotreturnaboolean.Bobdeploysthetoken.Alicecreatesacontractthatinteractswithitbutassumesacorrect`ERC20`interfaceimplementation.Alice's contract is unable to interact with Bob'scontract.'''
`Token.transfer`doesnotreturnaboolean.Bobdeploysthetoken.Alicecreatesacontractthatinteractswithitbutassumesacorrect`ERC20`interfaceimplementation.Alice's contract is unable to interact with Bob'scontract."""
WIKI_RECOMMENDATION='Set the appropriate return values and types for the defined `ERC20` functions.'
WIKI_RECOMMENDATION=(
"Set the appropriate return values and types for the defined `ERC20` functions."
WIKI_DESCRIPTION='Incorrect return values for `ERC721` functions. A contract compiled with solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing.'
WIKI_EXPLOIT_SCENARIO='''
WIKI_TITLE="Incorrect erc721 interface"
WIKI_DESCRIPTION="Incorrect return values for `ERC721` functions. A contract compiled with solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing."
`Token.ownerOf`doesnotreturnanaddresslike`ERC721`expects.Bobdeploysthetoken.Alicecreatesacontractthatinteractswithitbutassumesacorrect`ERC721`interfaceimplementation.Alice's contract is unable to interact with Bob'scontract.'''
`Token.ownerOf`doesnotreturnanaddresslike`ERC721`expects.Bobdeploysthetoken.Alicecreatesacontractthatinteractswithitbutassumesacorrect`ERC721`interfaceimplementation.Alice's contract is unable to interact with Bob'scontract."""
WIKI_RECOMMENDATION='Set the appropriate return values and vtypes for the defined `ERC721` functions.'
WIKI_RECOMMENDATION=(
"Set the appropriate return values and vtypes for the defined `ERC721` functions."
WIKI_DESCRIPTION='Detects whether events defined by the `ERC20` specification that should have some parameters as `indexed` are missing the `indexed` keyword.'
WIKI_EXPLOIT_SCENARIO='''
WIKI_TITLE="Unindexed ERC20 event oarameters"
WIKI_DESCRIPTION="Detects whether events defined by the `ERC20` specification that should have some parameters as `indexed` are missing the `indexed` keyword."
Failuretoincludethesekeywordswillexcludetheparameterdatainthetransaction/block's bloom filter, so external tooling searching for these parameters may overlook them and fail to index logs from this token contract.'''
Failuretoincludethesekeywordswillexcludetheparameterdatainthetransaction/block's bloom filter, so external tooling searching for these parameters may overlook them and fail to index logs from this token contract."""
WIKI_RECOMMENDATION='Add the `indexed` keyword to event parameters that should include it, according to the `ERC20` specification.'
WIKI_RECOMMENDATION="Add the `indexed` keyword to event parameters that should include it, according to the `ERC20` specification."
STANDARD_JSON=False
@ -53,8 +53,10 @@ Failure to include these keywords will exclude the parameter data in the transac
foreventincontract.events_declared:
# If this is transfer/approval events, expect the first two parameters to be indexed.
WIKI_DESCRIPTION='Dangerous usage of `block.timestamp`. `block.timestamp` can be manipulated by miners.'
WIKI_EXPLOIT_SCENARIO='''"Bob's contract relies on `block.timestamp` for its randomness. Eve is a miner and manipulates `block.timestamp` to exploit Bob's contract.'''
WIKI_RECOMMENDATION='Avoid relying on `block.timestamp`.'
WIKI_TITLE="Block timestamp"
WIKI_DESCRIPTION=(
"Dangerous usage of `block.timestamp`. `block.timestamp` can be manipulated by miners."
)
WIKI_EXPLOIT_SCENARIO=""""Bob's contract relies on `block.timestamp` for its randomness. Eve is a miner and manipulates `block.timestamp` to exploit Bob's contract."""
WIKI_RECOMMENDATION="Avoid relying on `block.timestamp`."
def_detect(self):
"""
@ -74,9 +77,9 @@ class Timestamp(AbstractDetector):
WIKI_DESCRIPTION='The use of low-level calls is error-prone. Low-level calls do not check for [code existence](https://solidity.readthedocs.io/en/v0.4.25/control-structures.html#error-handling-assert-require-revert-and-exceptions) or call success.'
WIKI_RECOMMENDATION='Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence.'
WIKI_TITLE="Low-level calls"
WIKI_DESCRIPTION="The use of low-level calls is error-prone. Low-level calls do not check for [code existence](https://solidity.readthedocs.io/en/v0.4.25/control-structures.html#error-handling-assert-require-revert-and-exceptions) or call success."
WIKI_RECOMMENDATION="Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence."
@staticmethod
def_contains_low_level_calls(node):
@ -35,8 +35,7 @@ class LowLevelCalls(AbstractDetector):
@ -36,9 +38,9 @@ Only report reentrancy that acts as a double call (see `reentrancy-eth`, `reentr
}
```
`callme`containsareentrancy.Thereentrancyisbenignbecauseit's exploitation would have the same effect as two consecutive calls.'''
`callme`containsareentrancy.Thereentrancyisbenignbecauseit's exploitation would have the same effect as two consecutive calls."""
WIKI_RECOMMENDATION='Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION="Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy)."
STANDARD_JSON=False
@ -55,19 +57,25 @@ Only report reentrancy that acts as a double call (see `reentrancy-eth`, `reentr
WIKI_RECOMMENDATION='Apply the [`check-effects-interactions pattern`](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION="Apply the [`check-effects-interactions pattern`](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy)."
STANDARD_JSON=False
@ -59,18 +61,23 @@ Bob uses the re-entrancy bug to call `withdrawBalance` two times, and withdraw m
WIKI_RECOMMENDATION='Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION="Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy)."
STANDARD_JSON=False
@ -53,14 +55,19 @@ If `d.()` re-enters, the `Counter` events will be shown in an incorrect order, w
WIKI_RECOMMENDATION='Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION="Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy)."
@staticmethod
defcan_callback(ir):
@ -64,19 +66,25 @@ Only report reentrancy that is based on `transfer` or `send`.'''
@ -37,8 +38,8 @@ Do not report reentrancies that involve Ether (see `reentrancy-eth`).'''
not_called=False;
}
```
'''
WIKI_RECOMMENDATION='Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
"""
WIKI_RECOMMENDATION="Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy)."
STANDARD_JSON=False
@ -55,18 +56,23 @@ Do not report reentrancies that involve Ether (see `reentrancy-eth`).'''
WIKI_RECOMMENDATION='Favor [pull over push](https://github.com/ethereum/wiki/wiki/Safety#favor-pull-over-push-for-external-calls) strategy for external calls.'
WIKI_RECOMMENDATION="Favor [pull over push](https://github.com/ethereum/wiki/wiki/Safety#favor-pull-over-push-for-external-calls) strategy for external calls."
@staticmethod
defcall_in_loop(node,in_loop,visited,ret):
@ -57,10 +54,7 @@ If one of the destinations has a fallback function that reverts, `bad` will alwa
WIKI_DESCRIPTION='''Solidity only supports integers, so division will often truncate; performing a multiply before a divison can sometimes avoid loss of precision.'''
WIKI_DESCRIPTION='''Solidity integer division might truncate. As a result, performing multiplication before divison might reduce precision.'''
WIKI_EXPLOIT_SCENARIO='''
WIKI_TITLE="Divide before multiply"
WIKI_DESCRIPTION="""Solidity only supports integers, so division will often truncate; performing a multiply before a divison can sometimes avoid loss of precision."""
WIKI_DESCRIPTION="""Solidity integer division might truncate. As a result, performing multiplication before divison might reduce precision."""
Ingeneral,it's usually a good idea to re-arrange arithmetic to perform multiplication before division, unless the limit of a smaller type makes this dangerous.'''
Ingeneral,it's usually a good idea to re-arrange arithmetic to perform multiplication before division, unless the limit of a smaller type makes this dangerous."""
WIKI_RECOMMENDATION='''Consider ordering multiplication before division.'''
WIKI_RECOMMENDATION="""Consider ordering multiplication before division."""