mirror of https://github.com/crytic/slither
Merge pull request #117 from trailofbits/dev-reentrancy
Refactor reentrancy detector into three variantspull/125/head
Feist Josselin
6 years ago
committed by
GitHub
commit
c9d18ab4c8
@ -0,0 +1,226 @@ |
|||||||
|
"""" |
||||||
|
Re-entrancy detection |
||||||
|
|
||||||
|
Based on heuristics, it may lead to FP and FN |
||||||
|
Iterate over all the nodes of the graph until reaching a fixpoint |
||||||
|
""" |
||||||
|
|
||||||
|
from slither.core.cfg.node import NodeType |
||||||
|
from slither.core.declarations import Function, SolidityFunction |
||||||
|
from slither.core.expressions import UnaryOperation, UnaryOperationType |
||||||
|
from slither.detectors.abstract_detector import (AbstractDetector, |
||||||
|
DetectorClassification) |
||||||
|
from slither.visitors.expression.export_values import ExportValues |
||||||
|
from slither.slithir.operations import (HighLevelCall, LowLevelCall, |
||||||
|
LibraryCall, |
||||||
|
Send, Transfer) |
||||||
|
|
||||||
|
class ReentrancyBenign(AbstractDetector): |
||||||
|
ARGUMENT = 'reentrancy-benign' |
||||||
|
HELP = 'Benign reentrancy vulnerabilities' |
||||||
|
IMPACT = DetectorClassification.LOW |
||||||
|
CONFIDENCE = DetectorClassification.MEDIUM |
||||||
|
|
||||||
|
WIKI = 'https://github.com/trailofbits/slither/wiki/Vulnerabilities-Description#reentrancy-vulnerabilities' |
||||||
|
|
||||||
|
key = 'REENTRANCY-BENIGN' |
||||||
|
|
||||||
|
@staticmethod |
||||||
|
def _can_callback(node): |
||||||
|
""" |
||||||
|
Detect if the node contains a call that can |
||||||
|
be used to re-entrance |
||||||
|
|
||||||
|
Consider as valid target: |
||||||
|
- low level call |
||||||
|
- high level call |
||||||
|
|
||||||
|
Do not consider Send/Transfer as there is not enough gas |
||||||
|
""" |
||||||
|
for ir in node.irs: |
||||||
|
if isinstance(ir, LowLevelCall): |
||||||
|
return True |
||||||
|
if isinstance(ir, HighLevelCall) and not isinstance(ir, LibraryCall): |
||||||
|
return True |
||||||
|
return False |
||||||
|
|
||||||
|
@staticmethod |
||||||
|
def _can_send_eth(node): |
||||||
|
""" |
||||||
|
Detect if the node can send eth |
||||||
|
""" |
||||||
|
for ir in node.irs: |
||||||
|
if isinstance(ir, (HighLevelCall, LowLevelCall, Transfer, Send)): |
||||||
|
if ir.call_value: |
||||||
|
return True |
||||||
|
return False |
||||||
|
|
||||||
|
def _filter_if(self, node): |
||||||
|
""" |
||||||
|
Check if the node is a condtional node where |
||||||
|
there is an external call checked |
||||||
|
Heuristic: |
||||||
|
- The call is a IF node |
||||||
|
- It contains a, external call |
||||||
|
- The condition is the negation (!) |
||||||
|
|
||||||
|
This will work only on naive implementation |
||||||
|
""" |
||||||
|
return isinstance(node.expression, UnaryOperation)\ |
||||||
|
and node.expression.type == UnaryOperationType.BANG |
||||||
|
|
||||||
|
def _explore(self, node, visited, skip_father=None): |
||||||
|
""" |
||||||
|
Explore the CFG and look for re-entrancy |
||||||
|
Heuristic: There is a re-entrancy if a state variable is written |
||||||
|
after an external call |
||||||
|
|
||||||
|
node.context will contains the external calls executed |
||||||
|
It contains the calls executed in father nodes |
||||||
|
|
||||||
|
if node.context is not empty, and variables are written, a re-entrancy is possible |
||||||
|
""" |
||||||
|
if node in visited: |
||||||
|
return |
||||||
|
|
||||||
|
visited = visited + [node] |
||||||
|
|
||||||
|
# First we add the external calls executed in previous nodes |
||||||
|
# send_eth returns the list of calls sending value |
||||||
|
# calls returns the list of calls that can callback |
||||||
|
# read returns the variable read |
||||||
|
fathers_context = {'send_eth':[], 'calls':[], 'read':[]} |
||||||
|
|
||||||
|
for father in node.fathers: |
||||||
|
if self.key in father.context: |
||||||
|
fathers_context['send_eth'] += [s for s in father.context[self.key]['send_eth'] if s!=skip_father] |
||||||
|
fathers_context['calls'] += [c for c in father.context[self.key]['calls'] if c!=skip_father] |
||||||
|
fathers_context['read'] += father.context[self.key]['read'] |
||||||
|
|
||||||
|
# Exclude path that dont bring further information |
||||||
|
if node in self.visited_all_paths: |
||||||
|
if all(call in self.visited_all_paths[node]['calls'] for call in fathers_context['calls']): |
||||||
|
if all(send in self.visited_all_paths[node]['send_eth'] for send in fathers_context['send_eth']): |
||||||
|
if all(read in self.visited_all_paths[node]['read'] for read in fathers_context['read']): |
||||||
|
return |
||||||
|
else: |
||||||
|
self.visited_all_paths[node] = {'send_eth':[], 'calls':[], 'read':[]} |
||||||
|
|
||||||
|
self.visited_all_paths[node]['send_eth'] = list(set(self.visited_all_paths[node]['send_eth'] + fathers_context['send_eth'])) |
||||||
|
self.visited_all_paths[node]['calls'] = list(set(self.visited_all_paths[node]['calls'] + fathers_context['calls'])) |
||||||
|
self.visited_all_paths[node]['read'] = list(set(self.visited_all_paths[node]['read'] + fathers_context['read'])) |
||||||
|
|
||||||
|
node.context[self.key] = fathers_context |
||||||
|
|
||||||
|
contains_call = False |
||||||
|
if self._can_callback(node): |
||||||
|
node.context[self.key]['calls'] = list(set(node.context[self.key]['calls'] + [node])) |
||||||
|
contains_call = True |
||||||
|
if self._can_send_eth(node): |
||||||
|
node.context[self.key]['send_eth'] = list(set(node.context[self.key]['send_eth'] + [node])) |
||||||
|
|
||||||
|
|
||||||
|
# All the state variables written |
||||||
|
state_vars_written = node.state_variables_written |
||||||
|
# Add the state variables written in internal calls |
||||||
|
for internal_call in node.internal_calls: |
||||||
|
# Filter to Function, as internal_call can be a solidity call |
||||||
|
if isinstance(internal_call, Function): |
||||||
|
state_vars_written += internal_call.all_state_variables_written() |
||||||
|
|
||||||
|
not_read_then_written = [(v, node) for v in state_vars_written if v not in node.context[self.key]['read']] |
||||||
|
|
||||||
|
node.context[self.key]['read'] = list(set(node.context[self.key]['read'] + node.state_variables_read)) |
||||||
|
# If a state variables was read and is then written, there is a dangerous call and |
||||||
|
# ether were sent |
||||||
|
# We found a potential re-entrancy bug |
||||||
|
if (not_read_then_written and |
||||||
|
node.context[self.key]['calls']): |
||||||
|
# calls are ordered |
||||||
|
finding_key = (node.function, |
||||||
|
tuple(set(node.context[self.key]['calls'])), |
||||||
|
tuple(set(node.context[self.key]['send_eth']))) |
||||||
|
finding_vars = not_read_then_written |
||||||
|
if finding_key not in self.result: |
||||||
|
self.result[finding_key] = [] |
||||||
|
self.result[finding_key] = list(set(self.result[finding_key] + finding_vars)) |
||||||
|
|
||||||
|
sons = node.sons |
||||||
|
if contains_call and node.type in [NodeType.IF, NodeType.IFLOOP]: |
||||||
|
if self._filter_if(node): |
||||||
|
son = sons[0] |
||||||
|
self._explore(son, visited, node) |
||||||
|
sons = sons[1:] |
||||||
|
else: |
||||||
|
son = sons[1] |
||||||
|
self._explore(son, visited, node) |
||||||
|
sons = [sons[0]] |
||||||
|
|
||||||
|
|
||||||
|
for son in sons: |
||||||
|
self._explore(son, visited) |
||||||
|
|
||||||
|
def detect_reentrancy(self, contract): |
||||||
|
""" |
||||||
|
""" |
||||||
|
for function in contract.functions: |
||||||
|
if function.is_implemented: |
||||||
|
self._explore(function.entry_point, []) |
||||||
|
|
||||||
|
def detect(self): |
||||||
|
""" |
||||||
|
""" |
||||||
|
self.result = {} |
||||||
|
|
||||||
|
# if a node was already visited by another path |
||||||
|
# we will only explore it if the traversal brings |
||||||
|
# new variables written |
||||||
|
# This speedup the exploration through a light fixpoint |
||||||
|
# Its particular useful on 'complex' functions with several loops and conditions |
||||||
|
self.visited_all_paths = {} |
||||||
|
|
||||||
|
for c in self.contracts: |
||||||
|
self.detect_reentrancy(c) |
||||||
|
|
||||||
|
results = [] |
||||||
|
|
||||||
|
result_sorted = sorted(list(self.result.items()), key=lambda x:x[0][0].name) |
||||||
|
for (func, calls, send_eth), varsWritten in result_sorted: |
||||||
|
calls = list(set(calls)) |
||||||
|
send_eth = list(set(send_eth)) |
||||||
|
info = 'Reentrancy in {}.{} ({}):\n' |
||||||
|
info = info.format(func.contract.name, func.name, func.source_mapping_str) |
||||||
|
info += '\tExternal calls:\n' |
||||||
|
for call_info in calls: |
||||||
|
info += '\t- {} ({})\n'.format(call_info.expression, call_info.source_mapping_str) |
||||||
|
if calls != send_eth: |
||||||
|
info += '\tExternal calls sending eth:\n' |
||||||
|
for call_info in send_eth: |
||||||
|
info += '\t- {} ({})\n'.format(call_info.expression, call_info.source_mapping_str) |
||||||
|
info += '\tState variables written after the call(s):\n' |
||||||
|
for (v, node) in varsWritten: |
||||||
|
info += '\t- {} ({})\n'.format(v, node.source_mapping_str) |
||||||
|
self.log(info) |
||||||
|
|
||||||
|
sending_eth_json = [] |
||||||
|
if calls != send_eth: |
||||||
|
sending_eth_json = [{'type' : 'external_calls_sending_eth', |
||||||
|
'expression': str(call_info.expression), |
||||||
|
'source_mapping': call_info.source_mapping} |
||||||
|
for call_info in send_eth] |
||||||
|
|
||||||
|
json = self.generate_json_result(info) |
||||||
|
self.add_function_to_json(func, json) |
||||||
|
json['elements'] += [{'type': 'external_calls', |
||||||
|
'expression': str(call_info.expression), |
||||||
|
'source_mapping': call_info.source_mapping} |
||||||
|
for call_info in calls] |
||||||
|
json['elements'] += sending_eth_json |
||||||
|
json['elements'] += [{'type':'variables_written', |
||||||
|
'name': v.name, |
||||||
|
'expression': str(node.expression), |
||||||
|
'source_mapping': node.source_mapping} |
||||||
|
for (v, node) in varsWritten] |
||||||
|
results.append(json) |
||||||
|
|
||||||
|
return results |
||||||
@ -0,0 +1,216 @@ |
|||||||
|
"""" |
||||||
|
Re-entrancy detection |
||||||
|
|
||||||
|
Based on heuristics, it may lead to FP and FN |
||||||
|
Iterate over all the nodes of the graph until reaching a fixpoint |
||||||
|
""" |
||||||
|
|
||||||
|
from slither.core.cfg.node import NodeType |
||||||
|
from slither.core.declarations import Function, SolidityFunction |
||||||
|
from slither.core.expressions import UnaryOperation, UnaryOperationType |
||||||
|
from slither.detectors.abstract_detector import (AbstractDetector, |
||||||
|
DetectorClassification) |
||||||
|
from slither.visitors.expression.export_values import ExportValues |
||||||
|
from slither.slithir.operations import (HighLevelCall, LowLevelCall, |
||||||
|
LibraryCall, |
||||||
|
Send, Transfer) |
||||||
|
|
||||||
|
class ReentrancyReadBeforeWritten(AbstractDetector): |
||||||
|
ARGUMENT = 'reentrancy-no-eth' |
||||||
|
HELP = 'Reentrancy vulnerabilities (no theft of ethers)' |
||||||
|
IMPACT = DetectorClassification.MEDIUM |
||||||
|
CONFIDENCE = DetectorClassification.MEDIUM |
||||||
|
|
||||||
|
WIKI = 'https://github.com/trailofbits/slither/wiki/Vulnerabilities-Description#reentrancy-vulnerabilities' |
||||||
|
|
||||||
|
key = 'REENTRANCY-NO-ETHER' |
||||||
|
|
||||||
|
@staticmethod |
||||||
|
def _can_callback(node): |
||||||
|
""" |
||||||
|
Detect if the node contains a call that can |
||||||
|
be used to re-entrance |
||||||
|
|
||||||
|
Consider as valid target: |
||||||
|
- low level call |
||||||
|
- high level call |
||||||
|
|
||||||
|
Do not consider Send/Transfer as there is not enough gas |
||||||
|
""" |
||||||
|
for ir in node.irs: |
||||||
|
if isinstance(ir, LowLevelCall): |
||||||
|
return True |
||||||
|
if isinstance(ir, HighLevelCall) and not isinstance(ir, LibraryCall): |
||||||
|
return True |
||||||
|
return False |
||||||
|
|
||||||
|
@staticmethod |
||||||
|
def _can_send_eth(node): |
||||||
|
""" |
||||||
|
Detect if the node can send eth |
||||||
|
""" |
||||||
|
for ir in node.irs: |
||||||
|
if isinstance(ir, (HighLevelCall, LowLevelCall, Transfer, Send)): |
||||||
|
if ir.call_value: |
||||||
|
return True |
||||||
|
return False |
||||||
|
|
||||||
|
def _filter_if(self, node): |
||||||
|
""" |
||||||
|
Check if the node is a condtional node where |
||||||
|
there is an external call checked |
||||||
|
Heuristic: |
||||||
|
- The call is a IF node |
||||||
|
- It contains a, external call |
||||||
|
- The condition is the negation (!) |
||||||
|
|
||||||
|
This will work only on naive implementation |
||||||
|
""" |
||||||
|
return isinstance(node.expression, UnaryOperation)\ |
||||||
|
and node.expression.type == UnaryOperationType.BANG |
||||||
|
|
||||||
|
def _explore(self, node, visited, skip_father=None): |
||||||
|
""" |
||||||
|
Explore the CFG and look for re-entrancy |
||||||
|
Heuristic: There is a re-entrancy if a state variable is written |
||||||
|
after an external call |
||||||
|
|
||||||
|
node.context will contains the external calls executed |
||||||
|
It contains the calls executed in father nodes |
||||||
|
|
||||||
|
if node.context is not empty, and variables are written, a re-entrancy is possible |
||||||
|
""" |
||||||
|
if node in visited: |
||||||
|
return |
||||||
|
|
||||||
|
visited = visited + [node] |
||||||
|
|
||||||
|
# First we add the external calls executed in previous nodes |
||||||
|
# send_eth returns the list of calls sending value |
||||||
|
# calls returns the list of calls that can callback |
||||||
|
# read returns the variable read |
||||||
|
fathers_context = {'send_eth':[], 'calls':[], 'read':[]} |
||||||
|
|
||||||
|
for father in node.fathers: |
||||||
|
if self.key in father.context: |
||||||
|
fathers_context['send_eth'] += [s for s in father.context[self.key]['send_eth'] if s!=skip_father] |
||||||
|
fathers_context['calls'] += [c for c in father.context[self.key]['calls'] if c!=skip_father] |
||||||
|
fathers_context['read'] += father.context[self.key]['read'] |
||||||
|
|
||||||
|
# Exclude path that dont bring further information |
||||||
|
if node in self.visited_all_paths: |
||||||
|
if all(call in self.visited_all_paths[node]['calls'] for call in fathers_context['calls']): |
||||||
|
if all(send in self.visited_all_paths[node]['send_eth'] for send in fathers_context['send_eth']): |
||||||
|
if all(read in self.visited_all_paths[node]['read'] for read in fathers_context['read']): |
||||||
|
return |
||||||
|
else: |
||||||
|
self.visited_all_paths[node] = {'send_eth':[], 'calls':[], 'read':[]} |
||||||
|
|
||||||
|
self.visited_all_paths[node]['send_eth'] = list(set(self.visited_all_paths[node]['send_eth'] + fathers_context['send_eth'])) |
||||||
|
self.visited_all_paths[node]['calls'] = list(set(self.visited_all_paths[node]['calls'] + fathers_context['calls'])) |
||||||
|
self.visited_all_paths[node]['read'] = list(set(self.visited_all_paths[node]['read'] + fathers_context['read'])) |
||||||
|
|
||||||
|
node.context[self.key] = fathers_context |
||||||
|
|
||||||
|
contains_call = False |
||||||
|
if self._can_callback(node): |
||||||
|
node.context[self.key]['calls'] = list(set(node.context[self.key]['calls'] + [node])) |
||||||
|
contains_call = True |
||||||
|
if self._can_send_eth(node): |
||||||
|
node.context[self.key]['send_eth'] = list(set(node.context[self.key]['send_eth'] + [node])) |
||||||
|
|
||||||
|
|
||||||
|
# All the state variables written |
||||||
|
state_vars_written = node.state_variables_written |
||||||
|
# Add the state variables written in internal calls |
||||||
|
for internal_call in node.internal_calls: |
||||||
|
# Filter to Function, as internal_call can be a solidity call |
||||||
|
if isinstance(internal_call, Function): |
||||||
|
state_vars_written += internal_call.all_state_variables_written() |
||||||
|
|
||||||
|
read_then_written = [(v, node) for v in state_vars_written if v in node.context[self.key]['read']] |
||||||
|
|
||||||
|
node.context[self.key]['read'] = list(set(node.context[self.key]['read'] + node.state_variables_read)) |
||||||
|
# If a state variables was read and is then written, there is a dangerous call and |
||||||
|
# ether were sent |
||||||
|
# We found a potential re-entrancy bug |
||||||
|
if (read_then_written and |
||||||
|
node.context[self.key]['calls'] and |
||||||
|
not node.context[self.key]['send_eth']): |
||||||
|
# calls are ordered |
||||||
|
finding_key = (node.function, |
||||||
|
tuple(set(node.context[self.key]['calls']))) |
||||||
|
finding_vars = read_then_written |
||||||
|
if finding_key not in self.result: |
||||||
|
self.result[finding_key] = [] |
||||||
|
self.result[finding_key] = list(set(self.result[finding_key] + finding_vars)) |
||||||
|
|
||||||
|
sons = node.sons |
||||||
|
if contains_call and node.type in [NodeType.IF, NodeType.IFLOOP]: |
||||||
|
if self._filter_if(node): |
||||||
|
son = sons[0] |
||||||
|
self._explore(son, visited, node) |
||||||
|
sons = sons[1:] |
||||||
|
else: |
||||||
|
son = sons[1] |
||||||
|
self._explore(son, visited, node) |
||||||
|
sons = [sons[0]] |
||||||
|
|
||||||
|
|
||||||
|
for son in sons: |
||||||
|
self._explore(son, visited) |
||||||
|
|
||||||
|
def detect_reentrancy(self, contract): |
||||||
|
""" |
||||||
|
""" |
||||||
|
for function in contract.functions: |
||||||
|
if function.is_implemented: |
||||||
|
self._explore(function.entry_point, []) |
||||||
|
|
||||||
|
def detect(self): |
||||||
|
""" |
||||||
|
""" |
||||||
|
self.result = {} |
||||||
|
|
||||||
|
# if a node was already visited by another path |
||||||
|
# we will only explore it if the traversal brings |
||||||
|
# new variables written |
||||||
|
# This speedup the exploration through a light fixpoint |
||||||
|
# Its particular useful on 'complex' functions with several loops and conditions |
||||||
|
self.visited_all_paths = {} |
||||||
|
|
||||||
|
for c in self.contracts: |
||||||
|
self.detect_reentrancy(c) |
||||||
|
|
||||||
|
results = [] |
||||||
|
|
||||||
|
result_sorted = sorted(list(self.result.items()), key=lambda x:x[0][0].name) |
||||||
|
for (func, calls), varsWritten in result_sorted: |
||||||
|
calls = list(set(calls)) |
||||||
|
info = 'Reentrancy in {}.{} ({}):\n' |
||||||
|
info = info.format(func.contract.name, func.name, func.source_mapping_str) |
||||||
|
info += '\tExternal calls:\n' |
||||||
|
for call_info in calls: |
||||||
|
info += '\t- {} ({})\n'.format(call_info.expression, call_info.source_mapping_str) |
||||||
|
info += '\tState variables written after the call(s):\n' |
||||||
|
for (v, node) in varsWritten: |
||||||
|
info += '\t- {} ({})\n'.format(v, node.source_mapping_str) |
||||||
|
self.log(info) |
||||||
|
|
||||||
|
sending_eth_json = [] |
||||||
|
|
||||||
|
json = self.generate_json_result(info) |
||||||
|
self.add_function_to_json(func, json) |
||||||
|
json['elements'] += [{'type': 'external_calls', |
||||||
|
'expression': str(call_info.expression), |
||||||
|
'source_mapping': call_info.source_mapping} |
||||||
|
for call_info in calls] |
||||||
|
json['elements'] += sending_eth_json |
||||||
|
json['elements'] += [{'type':'variables_written', |
||||||
|
'name': v.name, |
||||||
|
'expression': str(node.expression), |
||||||
|
'source_mapping': node.source_mapping} |
||||||
|
for (v, node) in varsWritten] |
||||||
|
results.append(json) |
||||||
|
|
||||||
|
return results |
||||||
@ -0,0 +1 @@ |
|||||||
|
[{"check": "reentrancy-eth", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance (tests/reentrancy-0.5.1.sol#14-22):\n\tExternal calls:\n\t- (ret,mem) = msg.sender.call.value(userBalance[msg.sender])() (tests/reentrancy-0.5.1.sol#17)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy-0.5.1.sol#21)\n", "elements": [{"type": "function", "name": "withdrawBalance", "source_mapping": {"start": 298, "length": 357, "filename": "tests/reentrancy-0.5.1.sol", "lines": [14, 15, 16, 17, 18, 19, 20, 21, 22]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 25, "length": 1807, "filename": "tests/reentrancy-0.5.1.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54]}}}, {"type": "external_calls", "expression": "(ret,mem) = msg.sender.call.value(userBalance[msg.sender])()", "source_mapping": {"start": 477, "length": 81, "filename": "tests/reentrancy-0.5.1.sol", "lines": [17]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = 0", "source_mapping": {"start": 621, "length": 27, "filename": "tests/reentrancy-0.5.1.sol", "lines": [21]}}]}, {"check": "reentrancy-eth", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance_fixed_3 (tests/reentrancy-0.5.1.sol#44-53):\n\tExternal calls:\n\t- (ret,mem) = msg.sender.call.value(amount)() (tests/reentrancy-0.5.1.sol#49)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy-0.5.1.sol#51)\n", "elements": [{"type": "function", "name": "withdrawBalance_fixed_3", "source_mapping": {"start": 1434, "length": 393, "filename": "tests/reentrancy-0.5.1.sol", "lines": [44, 45, 46, 47, 48, 49, 50, 51, 52, 53]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 25, "length": 1807, "filename": "tests/reentrancy-0.5.1.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54]}}}, {"type": "external_calls", "expression": "(ret,mem) = msg.sender.call.value(amount)()", "source_mapping": {"start": 1679, "length": 64, "filename": "tests/reentrancy-0.5.1.sol", "lines": [49]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = amount", "source_mapping": {"start": 1778, "length": 32, "filename": "tests/reentrancy-0.5.1.sol", "lines": [51]}}]}] |
||||||
@ -1 +0,0 @@ |
|||||||
[{"check": "reentrancy", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance (tests/reentrancy-0.5.1.sol#14-22):\n\tExternal calls:\n\t- (ret,mem) = msg.sender.call.value(userBalance[msg.sender])() (tests/reentrancy-0.5.1.sol#17)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy-0.5.1.sol#21)\n", "elements": [{"type": "function", "name": "withdrawBalance", "source_mapping": {"start": 298, "length": 357, "filename": "tests/reentrancy-0.5.1.sol", "lines": [14, 15, 16, 17, 18, 19, 20, 21, 22]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 25, "length": 1807, "filename": "tests/reentrancy-0.5.1.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54]}}}, {"type": "external_calls", "expression": "(ret,mem) = msg.sender.call.value(userBalance[msg.sender])()", "source_mapping": {"start": 477, "length": 81, "filename": "tests/reentrancy-0.5.1.sol", "lines": [17]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = 0", "source_mapping": {"start": 621, "length": 27, "filename": "tests/reentrancy-0.5.1.sol", "lines": [21]}}]}, {"check": "reentrancy", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance_fixed_3 (tests/reentrancy-0.5.1.sol#44-53):\n\tExternal calls:\n\t- (ret,mem) = msg.sender.call.value(amount)() (tests/reentrancy-0.5.1.sol#49)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy-0.5.1.sol#51)\n", "elements": [{"type": "function", "name": "withdrawBalance_fixed_3", "source_mapping": {"start": 1434, "length": 393, "filename": "tests/reentrancy-0.5.1.sol", "lines": [44, 45, 46, 47, 48, 49, 50, 51, 52, 53]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 25, "length": 1807, "filename": "tests/reentrancy-0.5.1.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54]}}}, {"type": "external_calls", "expression": "(ret,mem) = msg.sender.call.value(amount)()", "source_mapping": {"start": 1679, "length": 64, "filename": "tests/reentrancy-0.5.1.sol", "lines": [49]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = amount", "source_mapping": {"start": 1778, "length": 32, "filename": "tests/reentrancy-0.5.1.sol", "lines": [51]}}]}] |
|
||||||
@ -0,0 +1 @@ |
|||||||
|
[{"check": "reentrancy-eth", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance (tests/reentrancy.sol#14-21):\n\tExternal calls:\n\t- ! (msg.sender.call.value(userBalance[msg.sender])()) (tests/reentrancy.sol#17-19)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy.sol#20)\n", "elements": [{"type": "function", "name": "withdrawBalance", "source_mapping": {"start": 299, "length": 314, "filename": "tests/reentrancy.sol", "lines": [14, 15, 16, 17, 18, 19, 20, 21]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 26, "length": 2334, "filename": "tests/reentrancy.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72]}}}, {"type": "external_calls", "expression": "! (msg.sender.call.value(userBalance[msg.sender])())", "source_mapping": {"start": 478, "length": 92, "filename": "tests/reentrancy.sol", "lines": [17, 18, 19]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = 0", "source_mapping": {"start": 579, "length": 27, "filename": "tests/reentrancy.sol", "lines": [20]}}]}, {"check": "reentrancy-eth", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance_nested (tests/reentrancy.sol#64-70):\n\tExternal calls:\n\t- msg.sender.call.value(amount / 2)() (tests/reentrancy.sol#67)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy.sol#68)\n", "elements": [{"type": "function", "name": "withdrawBalance_nested", "source_mapping": {"start": 2108, "length": 246, "filename": "tests/reentrancy.sol", "lines": [64, 65, 66, 67, 68, 69, 70]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 26, "length": 2334, "filename": "tests/reentrancy.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72]}}}, {"type": "external_calls", "expression": "msg.sender.call.value(amount / 2)()", "source_mapping": {"start": 2263, "length": 33, "filename": "tests/reentrancy.sol", "lines": [67]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = 0", "source_mapping": {"start": 2310, "length": 27, "filename": "tests/reentrancy.sol", "lines": [68]}}]}] |
||||||
@ -1 +0,0 @@ |
|||||||
[{"check": "reentrancy", "impact": "High", "confidence": "Medium", "description": "Reentrancy in Reentrancy.withdrawBalance (tests/reentrancy.sol#14-21):\n\tExternal calls:\n\t- ! (msg.sender.call.value(userBalance[msg.sender])()) (tests/reentrancy.sol#17-19)\n\tState variables written after the call(s):\n\t- userBalance (tests/reentrancy.sol#20)\n", "elements": [{"type": "function", "name": "withdrawBalance", "source_mapping": {"start": 299, "length": 314, "filename": "tests/reentrancy.sol", "lines": [14, 15, 16, 17, 18, 19, 20, 21]}, "contract": {"type": "contract", "name": "Reentrancy", "source_mapping": {"start": 26, "length": 1678, "filename": "tests/reentrancy.sol", "lines": [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51]}}}, {"type": "external_calls", "expression": "! (msg.sender.call.value(userBalance[msg.sender])())", "source_mapping": {"start": 478, "length": 92, "filename": "tests/reentrancy.sol", "lines": [17, 18, 19]}}, {"type": "variables_written", "name": "userBalance", "expression": "userBalance[msg.sender] = 0", "source_mapping": {"start": 579, "length": 27, "filename": "tests/reentrancy.sol", "lines": [20]}}]}] |
|
||||||
Loading…
Reference in new issue