Copy editing on all public detectors

pull/572/head
Josselin 4 years ago
parent f90eb65104
commit cd592e2923
  1. 6
      slither/detectors/attributes/const_functions_asm.py
  2. 8
      slither/detectors/attributes/const_functions_state.py
  3. 2
      slither/detectors/attributes/constant_pragma.py
  4. 4
      slither/detectors/attributes/incorrect_solc.py
  5. 6
      slither/detectors/attributes/locked_ether.py
  6. 6
      slither/detectors/erc/incorrect_erc20_interface.py
  7. 6
      slither/detectors/erc/incorrect_erc721_interface.py
  8. 9
      slither/detectors/erc/unindexed_event_parameters.py
  9. 8
      slither/detectors/functions/arbitrary_send.py
  10. 6
      slither/detectors/functions/external_function.py
  11. 10
      slither/detectors/naming_convention/naming_convention.py
  12. 2
      slither/detectors/operations/low_level_calls.py
  13. 4
      slither/detectors/operations/unchecked_low_level_return_values.py
  14. 8
      slither/detectors/operations/unchecked_send_return_value.py
  15. 2
      slither/detectors/operations/unused_return_values.py
  16. 6
      slither/detectors/operations/void_constructor.py
  17. 4
      slither/detectors/reentrancy/reentrancy_benign.py
  18. 8
      slither/detectors/reentrancy/reentrancy_eth.py
  19. 8
      slither/detectors/reentrancy/reentrancy_events.py
  20. 8
      slither/detectors/reentrancy/reentrancy_no_gas.py
  21. 6
      slither/detectors/reentrancy/reentrancy_read_before_write.py
  22. 4
      slither/detectors/shadowing/builtin_symbols.py
  23. 6
      slither/detectors/shadowing/local.py
  24. 8
      slither/detectors/slither/name_reused.py
  25. 4
      slither/detectors/source/rtlo.py
  26. 2
      slither/detectors/statements/assembly.py
  27. 6
      slither/detectors/statements/boolean_constant_equality.py
  28. 3
      slither/detectors/statements/boolean_constant_misuse.py
  29. 4
      slither/detectors/statements/calls_in_loop.py
  30. 4
      slither/detectors/statements/controlled_delegatecall.py
  31. 4
      slither/detectors/statements/deprecated_calls.py
  32. 6
      slither/detectors/statements/divide_before_multiply.py
  33. 5
      slither/detectors/statements/incorrect_strict_equality.py
  34. 4
      slither/detectors/statements/too_many_digits.py
  35. 2
      slither/detectors/statements/tx_origin.py
  36. 6
      slither/detectors/statements/type_based_tautology.py
  37. 4
      slither/detectors/variables/possible_const_state_variables.py
  38. 2
      slither/detectors/variables/uninitialized_local_variables.py
  39. 2
      slither/detectors/variables/uninitialized_state_variables.py
  40. 6
      slither/detectors/variables/uninitialized_storage_variables.py
  41. 2
      slither/detectors/variables/unused_state_variables.py
  42. 2
      tests/expected_json/external_function.external-function.txt
  43. 2
      tests/expected_json/naming_convention.naming-convention.txt

@ -22,7 +22,7 @@ class ConstantFunctionsAsm(AbstractDetector):
WIKI_DESCRIPTION = '''
Functions declared as `constant`/`pure`/`view` using assembly code.
`constant`/`pure`/`view` was not enforced prior Solidity 0.5.
`constant`/`pure`/`view` was not enforced prior to Solidity 0.5.
Starting from Solidity 0.5, a call to a `constant`/`pure`/`view` function uses the `STATICCALL` opcode, which reverts in case of state modification.
As a result, a call to an [incorrectly labeled function may trap a contract compiled with Solidity 0.5](https://solidity.readthedocs.io/en/develop/050-breaking-changes.html#interoperability-with-older-contracts).'''
@ -37,10 +37,10 @@ contract Constant{
}
}
```
`Constant` was deployed with Solidity 0.4.25. Bob writes a smart contract interacting with `Constant` in Solidity 0.5.0.
`Constant` was deployed with Solidity 0.4.25. Bob writes a smart contract that interacts with `Constant` in Solidity 0.5.0.
All the calls to `get` revert, breaking Bob's smart contract execution.'''
WIKI_RECOMMENDATION = 'Ensure that the attributes of contracts compiled prior to Solidity 0.5.0 are correct.'
WIKI_RECOMMENDATION = 'Ensure the attributes of contracts compiled prior to Solidity 0.5.0 are correct.'
def _detect(self):
""" Detect the constant function using assembly code

@ -20,9 +20,9 @@ class ConstantFunctionsState(AbstractDetector):
WIKI_TITLE = 'Constant functions changing the state'
WIKI_DESCRIPTION = '''
Functions declared as `constant`/`pure`/`view` changing the state.
Functions declared as `constant`/`pure`/`view` change the state.
`constant`/`pure`/`view` was not enforced prior Solidity 0.5.
`constant`/`pure`/`view` was not enforced prior to Solidity 0.5.
Starting from Solidity 0.5, a call to a `constant`/`pure`/`view` function uses the `STATICCALL` opcode, which reverts in case of state modification.
As a result, a call to an [incorrectly labeled function may trap a contract compiled with Solidity 0.5](https://solidity.readthedocs.io/en/develop/050-breaking-changes.html#interoperability-with-older-contracts).'''
@ -37,10 +37,10 @@ contract Constant{
}
}
```
`Constant` was deployed with Solidity 0.4.25. Bob writes a smart contract interacting with `Constant` in Solidity 0.5.0.
`Constant` was deployed with Solidity 0.4.25. Bob writes a smart contract that interacts with `Constant` in Solidity 0.5.0.
All the calls to `get` revert, breaking Bob's smart contract execution.'''
WIKI_RECOMMENDATION = 'Ensure that the attributes of contracts compiled prior to Solidity 0.5.0 are correct.'
WIKI_RECOMMENDATION = 'Ensure that attributes of contracts compiled prior to Solidity 0.5.0 are correct.'
def _detect(self):
""" Detect the constant function changing the state

@ -20,7 +20,7 @@ class ConstantPragma(AbstractDetector):
WIKI_TITLE = 'Different pragma directives are used'
WIKI_DESCRIPTION = 'Detect if different Solidity versions are used.'
WIKI_DESCRIPTION = 'Detect whether different Solidity versions are used.'
WIKI_RECOMMENDATION = 'Use one Solidity version.'
def _detect(self):

@ -30,8 +30,8 @@ class IncorrectSolc(AbstractDetector):
WIKI_TITLE = 'Incorrect versions of Solidity'
WIKI_DESCRIPTION = '''
Solc frequently releases new compiler versions. Using an old version prevents access to new Solidity security checks.
We recommend avoiding complex pragma statement.'''
`solc` frequently releases new compiler versions. Using an old version prevents access to new Solidity security checks.
We also recommend avoiding complex `pragma` statement.'''
WIKI_RECOMMENDATION = '''
Use Solidity 0.4.25 or 0.5.11. Consider using the latest version of Solidity for testing the compilation, and a trusted version for deploying.'''

@ -20,8 +20,8 @@ class LockedEther(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#contracts-that-lock-ether'
WIKI_TITLE = 'Contracts that lock ether'
WIKI_DESCRIPTION = 'Contract with a `payable` function, but without a withdraw capacity.'
WIKI_TITLE = 'Contracts that lock Ether'
WIKI_DESCRIPTION = 'Contract with a `payable` function, but without a withdrawal capacity.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
pragma solidity 0.4.24;
@ -30,7 +30,7 @@ contract Locked{
}
}
```
Every ether sent to `Locked` will be lost.'''
Every Ether sent to `Locked` will be lost.'''
WIKI_RECOMMENDATION = 'Remove the payable attribute or add a withdraw function.'

@ -18,7 +18,7 @@ class IncorrectERC20InterfaceDetection(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-erc20-interface'
WIKI_TITLE = 'Incorrect erc20 interface'
WIKI_DESCRIPTION = 'Incorrect return values for ERC20 functions. A contract compiled with solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing.'
WIKI_DESCRIPTION = 'Incorrect return values for `ERC20` functions. A contract compiled with Solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract Token{
@ -26,9 +26,9 @@ contract Token{
//...
}
```
`Token.transfer` does not return a boolean. Bob deploys the token. Alice creates a contract that interacts with it but assumes a correct ERC20 interface implementation. Alice's contract is unable to interact with Bob's contract.'''
`Token.transfer` does not return a boolean. Bob deploys the token. Alice creates a contract that interacts with it but assumes a correct `ERC20` interface implementation. Alice's contract is unable to interact with Bob's contract.'''
WIKI_RECOMMENDATION = 'Set the appropriate return values and value-types for the defined ERC20 functions.'
WIKI_RECOMMENDATION = 'Set the appropriate return values and types for the defined `ERC20` functions.'
@staticmethod
def incorrect_erc20_interface(signature):

@ -17,7 +17,7 @@ class IncorrectERC721InterfaceDetection(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-erc721-interface'
WIKI_TITLE = 'Incorrect erc721 interface'
WIKI_DESCRIPTION = 'Incorrect return values for ERC721 functions. A contract compiled with solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing.'
WIKI_DESCRIPTION = 'Incorrect return values for `ERC721` functions. A contract compiled with solidity > 0.4.22 interacting with these functions will fail to execute them, as the return value is missing.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract Token{
@ -25,9 +25,9 @@ contract Token{
//...
}
```
`Token.ownerOf` does not return an address as ERC721 expects. Bob deploys the token. Alice creates a contract that interacts with it but assumes a correct ERC721 interface implementation. Alice's contract is unable to interact with Bob's contract.'''
`Token.ownerOf` does not return an address like `ERC721` expects. Bob deploys the token. Alice creates a contract that interacts with it but assumes a correct `ERC721` interface implementation. Alice's contract is unable to interact with Bob's contract.'''
WIKI_RECOMMENDATION = 'Set the appropriate return values and value-types for the defined ERC721 functions.'
WIKI_RECOMMENDATION = 'Set the appropriate return values and vtypes for the defined `ERC721` functions.'
@staticmethod
def incorrect_erc721_interface(signature):

@ -16,8 +16,8 @@ class UnindexedERC20EventParameters(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#unindexed-erc20-event-parameters'
WIKI_TITLE = 'Unindexed ERC20 Event Parameters'
WIKI_DESCRIPTION = 'Detects that events defined by the ERC20 specification which are meant to have some parameters as `indexed`, are missing the `indexed` keyword.'
WIKI_TITLE = 'Unindexed ERC20 event oarameters'
WIKI_DESCRIPTION = 'Detects whether events defined by the `ERC20` specification that should have some parameters as `indexed` are missing the `indexed` keyword.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract ERC20Bad {
@ -28,9 +28,10 @@ contract ERC20Bad {
// ...
}
```
In this case, Transfer and Approval events should have the 'indexed' keyword on their two first parameters, as defined by the ERC20 specification. Failure to include these keywords will not include the parameter data in the transaction/block's bloom filter. This may cause external tooling searching for these parameters to overlook them, and fail to index logs from this token contract.'''
`Transfer` and `Approval` events should have the 'indexed' keyword on their two first parameters, as defined by the `ERC20` specification.
Failure to include these keywords will exclude the parameter data in the transaction/block's bloom filter, so external tooling searching for these parameters may overlook them and fail to index logs from this token contract.'''
WIKI_RECOMMENDATION = 'Add the `indexed` keyword to event parameters which should include it, according to the ERC20 specification.'
WIKI_RECOMMENDATION = 'Add the `indexed` keyword to event parameters that should include it, according to the `ERC20` specification.'
STANDARD_JSON = False

@ -24,14 +24,14 @@ class ArbitrarySend(AbstractDetector):
"""
ARGUMENT = 'arbitrary-send'
HELP = 'Functions that send ether to arbitrary destinations'
HELP = 'Functions that send Ether to arbitrary destinations'
IMPACT = DetectorClassification.HIGH
CONFIDENCE = DetectorClassification.MEDIUM
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#functions-that-send-ether-to-arbitrary-destinations'
WIKI_TITLE = 'Functions that send ether to arbitrary destinations'
WIKI_DESCRIPTION = 'Unprotected call to a function executing sending ethers to an arbitrary address.'
WIKI_TITLE = 'Functions that send Ether to arbitrary destinations'
WIKI_DESCRIPTION = 'Unprotected call to a function sending Ether to an arbitrary address.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract ArbitrarySend{
@ -47,7 +47,7 @@ contract ArbitrarySend{
```
Bob calls `setDestination` and `withdraw`. As a result he withdraws the contract's balance.'''
WIKI_RECOMMENDATION = 'Ensure that an arbitrary user cannot withdraw unauthorize funds.'
WIKI_RECOMMENDATION = 'Ensure that an arbitrary user cannot withdraw unauthorized funds.'
def arbitrary_send(self, func):
"""

@ -14,14 +14,14 @@ class ExternalFunction(AbstractDetector):
"""
ARGUMENT = 'external-function'
HELP = 'Public function that could be declared as external'
HELP = 'Public function that could be declared external'
IMPACT = DetectorClassification.OPTIMIZATION
CONFIDENCE = DetectorClassification.HIGH
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#public-function-that-could-be-declared-as-external'
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#public-function-that-could-be-declared-external'
WIKI_TITLE = 'Public function that could be declared as external'
WIKI_TITLE = 'Public function that could be declared external'
WIKI_DESCRIPTION = '`public` functions that are never called by the contract should be declared `external` to save gas.'
WIKI_RECOMMENDATION = 'Use the `external` attribute for functions never called from the contract.'

@ -15,18 +15,18 @@ class NamingConvention(AbstractDetector):
"""
ARGUMENT = 'naming-convention'
HELP = 'Conformance to Solidity naming conventions'
HELP = 'Conformity to Solidity naming conventions'
IMPACT = DetectorClassification.INFORMATIONAL
CONFIDENCE = DetectorClassification.HIGH
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#conformance-to-solidity-naming-conventions'
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#conformity-to-solidity-naming-conventions'
WIKI_TITLE = 'Conformance to Solidity naming conventions'
WIKI_DESCRIPTION = '''
Solidity defines a [naming convention](https://solidity.readthedocs.io/en/v0.4.25/style-guide.html#naming-conventions) that should be followed.
#### Rules exceptions
- Allow constant variables name/symbol/decimals to be lowercase (ERC20)
- Allow `_` at the beginning of the mixed_case match for private variables and unused parameters.'''
#### Rule exceptions
- Allow constant variable name/symbol/decimals to be lowercase (`ERC20`).
- Allow `_` at the beginning of the `mixed_case` match for private variables and unused parameters.'''
WIKI_RECOMMENDATION = 'Follow the Solidity [naming convention](https://solidity.readthedocs.io/en/v0.4.25/style-guide.html#naming-conventions).'

@ -18,7 +18,7 @@ class LowLevelCalls(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls'
WIKI_TITLE = 'Low level calls'
WIKI_TITLE = 'Low-level calls'
WIKI_DESCRIPTION = 'The use of low-level calls is error-prone. Low-level calls do not check for [code existence](https://solidity.readthedocs.io/en/v0.4.25/control-structures.html#error-handling-assert-require-revert-and-exceptions) or call success.'
WIKI_RECOMMENDATION = 'Avoid low-level calls. Check the call success. If the call is meant for a contract, check for code existence.'

@ -27,11 +27,11 @@ contract MyConc{
}
}
```
The return value of the low-level call is not checked. As a result if the callfailed, the ether will be locked in the contract.
The return value of the low-level call is not checked, so if the call fails, the Ether will be locked in the contract.
If the low level is used to prevent blocking operations, consider logging failed calls.
'''
WIKI_RECOMMENDATION = 'Ensure that the return value of low-level call is checked or logged.'
WIKI_RECOMMENDATION = 'Ensure that the return value of a low-level call is checked or logged.'
_txt_description = "low-level calls"

@ -19,7 +19,7 @@ class UncheckedSend(UnusedReturnValues):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#unchecked-send'
WIKI_TITLE = 'Unchecked Send'
WIKI_DESCRIPTION = 'The return value of a send is not checked.'
WIKI_DESCRIPTION = 'The return value of a `send` is not checked.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract MyConc{
@ -28,11 +28,11 @@ contract MyConc{
}
}
```
The return value of `send` is not checked. As a result if the send failed, the ether will be locked in the contract.
If `send` is used to prevent blocking operations, consider logging the failed sent.
The return value of `send` is not checked, so if the send fails, the Ether will be locked in the contract.
If `send` is used to prevent blocking operations, consider logging the failed `send`.
'''
WIKI_RECOMMENDATION = 'Ensure that the return value of send is checked or logged.'
WIKI_RECOMMENDATION = 'Ensure that the return value of `send` is checked or logged.'
_txt_description = "send calls"

@ -30,7 +30,7 @@ contract MyConc{
}
}
```
`MyConc` calls `add` of SafeMath, but does not store the result in `a`. As a result, the computation has no effect.'''
`MyConc` calls `add` of `SafeMath`, but does not store the result in `a`. As a result, the computation has no effect.'''
WIKI_RECOMMENDATION = 'Ensure that all the return values of the function calls are used.'

@ -12,8 +12,8 @@ class VoidConstructor(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#void-constructor'
WIKI_TITLE = 'Void Constructor'
WIKI_DESCRIPTION = 'Detect the call to a constructor not implemented'
WIKI_TITLE = 'Void constructor'
WIKI_DESCRIPTION = 'Detect the call to a constructor that is not implemented'
WIKI_RECOMMENDATION = 'Remove the constructor call.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
@ -22,7 +22,7 @@ contract B is A{
constructor() public A(){}
}
```
By reading B's constructor definition, the reader might assume that `A()` initiate the contract, while no code is executed.'''
When reading `B`'s constructor definition, we might assume that `A()` initiates the contract, but no code is executed.'''
def _detect(self):

@ -24,7 +24,7 @@ class ReentrancyBenign(Reentrancy):
WIKI_TITLE = 'Reentrancy vulnerabilities'
WIKI_DESCRIPTION = '''
Detection of the [re-entrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Detection of the [reentrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Only report reentrancy that acts as a double call (see `reentrancy-eth`, `reentrancy-no-eth`).'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
@ -38,7 +38,7 @@ Only report reentrancy that acts as a double call (see `reentrancy-eth`, `reentr
`callme` contains a reentrancy. The reentrancy is benign because it's exploitation would have the same effect as two consecutive calls.'''
WIKI_RECOMMENDATION = 'Apply the [check-effects-interactions pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION = 'Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
STANDARD_JSON = False

@ -24,12 +24,12 @@ class ReentrancyEth(Reentrancy):
WIKI_TITLE = 'Reentrancy vulnerabilities'
WIKI_DESCRIPTION = '''
Detection of the [re-entrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Do not report reentrancies that don't involve ethers (see `reentrancy-no-eth`)'''
Detection of the [reentrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Do not report reentrancies that don't involve Ether (see `reentrancy-no-eth`)'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
function withdrawBalance(){
// send userBalance[msg.sender] ethers to msg.sender
// send userBalance[msg.sender] Ether to msg.sender
// if mgs.sender is a contract, it will call its fallback function
if( ! (msg.sender.call.value(userBalance[msg.sender])() ) ){
throw;
@ -40,7 +40,7 @@ Do not report reentrancies that don't involve ethers (see `reentrancy-no-eth`)''
Bob uses the re-entrancy bug to call `withdrawBalance` two times, and withdraw more than its initial deposit to the contract.'''
WIKI_RECOMMENDATION = 'Apply the [check-effects-interactions pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION = 'Apply the [`check-effects-interactions pattern`](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
STANDARD_JSON = False

@ -23,8 +23,8 @@ class ReentrancyEvent(Reentrancy):
WIKI_TITLE = 'Reentrancy vulnerabilities'
WIKI_DESCRIPTION = '''
Detection of the [re-entrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Only report reentrancies leading to out-of-order Events'''
Detection of the [reentrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Only report reentrancies leading to out-of-order events.'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
function bug(Called d){
@ -34,9 +34,9 @@ Only report reentrancies leading to out-of-order Events'''
}
```
If `d.()` reenters, the `Counter` events will be showed in an incorrect order, which might lead to issues for third-parties.'''
If `d.()` re-enters, the `Counter` events will be shown in an incorrect order, which might lead to issues for third parties.'''
WIKI_RECOMMENDATION = 'Apply the [check-effects-interactions pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION = 'Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
STANDARD_JSON = False

@ -27,8 +27,8 @@ class ReentrancyNoGas(Reentrancy):
WIKI_TITLE = 'Reentrancy vulnerabilities'
WIKI_DESCRIPTION = '''
Detection of the [re-entrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Only report reentrancy that are based on `transfer` or `send`.'''
Detection of the [reentrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Only report reentrancy that is based on `transfer` or `send`.'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
function callme(){
@ -37,9 +37,9 @@ Only report reentrancy that are based on `transfer` or `send`.'''
}
```
`send` and `transfer` does not protect from reentrancies in case of gas-price change.'''
`send` and `transfer` do not protect from reentrancies in case of gas price changes.'''
WIKI_RECOMMENDATION = 'Apply the [check-effects-interactions pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION = 'Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
@staticmethod
def can_callback(ir):

@ -24,8 +24,8 @@ class ReentrancyReadBeforeWritten(Reentrancy):
WIKI_TITLE = 'Reentrancy vulnerabilities'
WIKI_DESCRIPTION = '''
Detection of the [re-entrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Do not report reentrancies that involve ethers (see `reentrancy-eth`)'''
Detection of the [reentrancy bug](https://github.com/trailofbits/not-so-smart-contracts/tree/master/reentrancy).
Do not report reentrancies that involve Ether (see `reentrancy-eth`).'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
@ -38,7 +38,7 @@ Do not report reentrancies that involve ethers (see `reentrancy-eth`)'''
}
```
'''
WIKI_RECOMMENDATION = 'Apply the [check-effects-interactions pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
WIKI_RECOMMENDATION = 'Apply the [`check-effects-interactions` pattern](http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html#re-entrancy).'
STANDARD_JSON = False

@ -19,7 +19,7 @@ class BuiltinSymbolShadowing(AbstractDetector):
WIKI_TITLE = 'Builtin Symbol Shadowing'
WIKI_DESCRIPTION = 'Detection of shadowing built-in symbols using local variables/state variables/functions/modifiers/events.'
WIKI_DESCRIPTION = 'Detection of shadowing built-in symbols using local variables, state variables, functions, modifiers, or events.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
pragma solidity ^0.4.24;
@ -38,7 +38,7 @@ contract Bug {
```
`now` is defined as a state variable, and shadows with the built-in symbol `now`. The function `assert` overshadows the built-in `assert` function. Any use of either of these built-in symbols may lead to unexpected results.'''
WIKI_RECOMMENDATION = 'Rename the local variable/state variable/function/modifier/event, so as not to mistakenly overshadow any built-in symbol definitions.'
WIKI_RECOMMENDATION = 'Rename the local variables, state variables, functions, modifiers, and events that shadow a builtin symbol.'
SHADOWING_FUNCTION = "function"
SHADOWING_MODIFIER = "modifier"

@ -17,7 +17,7 @@ class LocalShadowing(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#local-variable-shadowing'
WIKI_TITLE = 'Local Variable Shadowing'
WIKI_TITLE = 'Local variable shadowing'
WIKI_DESCRIPTION = 'Detection of shadowing using local variables.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
@ -38,9 +38,9 @@ contract Bug {
}
}
```
`sensitive_function.owner` shadows `Bug.owner`. As a result, the use of `owner` inside `sensitive_function` might be incorrect.'''
`sensitive_function.owner` shadows `Bug.owner`. As a result, the use of `owner` in `sensitive_function` might be incorrect.'''
WIKI_RECOMMENDATION = 'Rename the local variable so as not to mistakenly overshadow any state variable/function/modifier/event definitions.'
WIKI_RECOMMENDATION = 'Rename the local variables that shadow another component.'
OVERSHADOWED_FUNCTION = "function"
OVERSHADOWED_MODIFIER = "modifier"

@ -34,11 +34,11 @@ class NameReused(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#name-reused'
WIKI_TITLE = 'Name reused'
WIKI_DESCRIPTION = '''If a codebase has two contracts with the similar name, the compilation artifacts
will not contain one of the contract with the dupplicate name.'''
WIKI_DESCRIPTION = '''If a codebase has two contracts the similar names, the compilation artifacts
will not contain one of the contracts with the duplicate name.'''
WIKI_EXPLOIT_SCENARIO = '''
Bob's truffle codebase has two contracts named `ERC20`.
When `truffle compile` runs, only one of the two contract will generate artifacts in `build/contracts`.
Bob's `truffle` codebase has two contracts named `ERC20`.
When `truffle compile` runs, only one of the two contracts will generate artifacts in `build/contracts`.
As a result, the second contract cannot be analyzed.
'''
WIKI_RECOMMENDATION = 'Rename the contract.'

@ -13,8 +13,8 @@ class RightToLeftOverride(AbstractDetector):
CONFIDENCE = DetectorClassification.HIGH
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#right-to-left-override-character'
WIKI_TITLE = 'Right-To-Left-Override character'
WIKI_DESCRIPTION = 'An attacker can manipulate the logic of the contract by using a right-to-left-override character (U+202E)'
WIKI_TITLE = 'Right-to-Left-Override character'
WIKI_DESCRIPTION = 'An attacker can manipulate the logic of the contract by using a right-to-left-override character (`U+202E)`.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract Token

@ -21,7 +21,7 @@ class Assembly(AbstractDetector):
WIKI_TITLE = 'Assembly usage'
WIKI_DESCRIPTION = 'The use of assembly is error-prone and should be avoided.'
WIKI_RECOMMENDATION = 'Do not use evm assembly.'
WIKI_RECOMMENDATION = 'Do not use `evm` assembly.'
@staticmethod
def _contains_inline_assembly_use(node):

@ -19,8 +19,8 @@ class BooleanEquality(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#boolean-equality'
WIKI_TITLE = 'Boolean Equality'
WIKI_DESCRIPTION = '''Detects the comparison to boolean constant.'''
WIKI_TITLE = 'Boolean equality'
WIKI_DESCRIPTION = '''Detects the comparison to boolean constants.'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract A {
@ -33,7 +33,7 @@ contract A {
}
}
```
Boolean can be used directly and do not need to be compare to `true` or `false`.'''
Boolean constants can be used directly and do not need to be compare to `true` or `false`.'''
WIKI_RECOMMENDATION = '''Remove the equality to the boolean constant.'''

@ -40,7 +40,8 @@ contract A {
}
}
```
Boolean constants in code have only a few legitimate uses. Other uses (in complex expressions, as conditionals) indicate either an error or (most likely) the persistence of debugging/development code that is likely faulty.'''
Boolean constants in code have only a few legitimate uses.
Other uses (in complex expressions, as conditionals) indicate either an error or, most likely, the persistence of faulty code.'''
WIKI_RECOMMENDATION = '''Verify and simplify the condition.'''

@ -20,7 +20,7 @@ class MultipleCallsInLoop(AbstractDetector):
WIKI_TITLE = 'Calls inside a loop'
WIKI_DESCRIPTION = 'Calls inside a loop might lead to denial of service attack.'
WIKI_DESCRIPTION = 'Calls inside a loop might lead to a denial-of-service attack.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract CallsInLoop{
@ -39,7 +39,7 @@ contract CallsInLoop{
}
```
If one of the destinations has a fallback function which reverts, `bad` will always revert.'''
If one of the destinations has a fallback function that reverts, `bad` will always revert.'''
WIKI_RECOMMENDATION = 'Favor [pull over push](https://github.com/ethereum/wiki/wiki/Safety#favor-pull-over-push-for-external-calls) strategy for external calls.'

@ -16,7 +16,7 @@ class ControlledDelegateCall(AbstractDetector):
WIKI_TITLE = 'Controlled Delegatecall'
WIKI_DESCRIPTION = 'Delegatecall or callcode to an address controlled by the user.'
WIKI_DESCRIPTION = '`Delegatecall` or `callcode` to an address controlled by the user.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract Delegatecall{
@ -25,7 +25,7 @@ contract Delegatecall{
}
}
```
Bob calls `delegate` and delegates the execution to its malicious contract. As a result, Bob withdraws the funds of the contract and destructs it.'''
Bob calls `delegate` and delegates the execution to his malicious contract. As a result, Bob withdraws the funds of the contract and destructs it.'''
WIKI_RECOMMENDATION = 'Avoid using `delegatecall`. Use only trusted destinations.'

@ -22,8 +22,8 @@ class DeprecatedStandards(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#deprecated-standards'
WIKI_TITLE = 'Deprecated Standards'
WIKI_DESCRIPTION = 'Detect the usage of deprecated standards (as defined by SWC-111), excluding only `constant` keyword detection on functions.'
WIKI_TITLE = 'Deprecated standards'
WIKI_DESCRIPTION = 'Detect the usage of deprecated standards.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract ContractWithDeprecatedReferences {

@ -58,7 +58,7 @@ class DivideBeforeMultiply(AbstractDetector):
WIKI_TITLE = 'Divide before multiply'
WIKI_DESCRIPTION = '''Solidity only supports integers, so division will often truncate; performing a multiply before a divison can sometimes avoid loss of precision.'''
WIKI_DESCRIPTION = '''Solidity integer division might truncate. As a result, performing a multiply before a divison might lead to loss of precision.'''
WIKI_DESCRIPTION = '''Solidity integer division might truncate. As a result, performing multiplication before divison might reduce precision.'''
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract A {
@ -69,9 +69,9 @@ contract A {
```
If `n` is greater than `oldSupply`, `coins` will be zero. For example, with `oldSupply = 5; n = 10, interest = 2`, coins will be zero.
If `(oldSupply * interest / n)` was used, `coins` would have been `1`.
In general, it's usually a good idea to re-arrange arithmetic to perform multiply before divide, unless the limit of a smaller type makes this dangerous.'''
In general, it's usually a good idea to re-arrange arithmetic to perform multiplication before division, unless the limit of a smaller type makes this dangerous.'''
WIKI_RECOMMENDATION = '''Consider ordering multiplication prior division.'''
WIKI_RECOMMENDATION = '''Consider ordering multiplication before division.'''
def _explore(self, node, explored, f_results, divisions):
if node in explored:

@ -33,9 +33,10 @@ contract Crowdsale{
return this.balance == 100 ether;
}
```
`Crowdsale` relies on `fund_reached` to know when to stop the sale of tokens. `Crowdsale` reaches 100 ether. Bob sends 0.1 ether. As a result, `fund_reached` is always false and the crowdsale never ends.'''
`Crowdsale` relies on `fund_reached` to know when to stop the sale of tokens.
`Crowdsale` reaches 100 Ether. Bob sends 0.1 Ether. As a result, `fund_reached` is always false and the `crowdsale` never ends.'''
WIKI_RECOMMENDATION = '''Don't use strict equality to determine if an account has enough ethers or tokens.'''
WIKI_RECOMMENDATION = '''Don't use strict equality to determine if an account has enough Ether or tokens.'''
sources_taint = [SolidityVariable('now'),
SolidityVariableComposed('block.number'),

@ -28,11 +28,11 @@ contract MyContract{
}
```
While `1_ether` looks like `1 ether`, it is `10 ether`. As a result, its usage is likely to be incorrect.
While `1_ether` looks like `1 ether`, it is `10 ether`. As a result, it's likely to be used incorrectly.
'''
WIKI_RECOMMENDATION = '''
Use:
- [Ether suffix](https://solidity.readthedocs.io/en/latest/units-and-global-variables.html#ether-units)
- [Ether suffix](https://solidity.readthedocs.io/en/latest/units-and-global-variables.html#ether-units),
- [Time suffix](https://solidity.readthedocs.io/en/latest/units-and-global-variables.html#time-units), or
- [The scientific notation](https://solidity.readthedocs.io/en/latest/types.html#rational-and-integer-literals)
'''

@ -18,7 +18,7 @@ class TxOrigin(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#dangerous-usage-of-txorigin'
WIKI_TITLE = 'Dangerous usage of `tx.origin`'
WIKI_DESCRIPTION = '`tx.origin`-based protection can be abused by malicious contract if a legitimate user interacts with the malicious contract.'
WIKI_DESCRIPTION = '`tx.origin`-based protection can be abused by a malicious contract if a legitimate user interacts with the malicious contract.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract TxOrigin {

@ -39,11 +39,11 @@ contract A {
}
}
```
`x` is an `uint256`, as a result `x >= 0` will be always true.
`y` is an `uint8`, as a result `y <512` will be always true.
`x` is a `uint256`, so `x >= 0` will be always true.
`y` is a `uint8`, so `y <512` will be always true.
'''
WIKI_RECOMMENDATION = '''Fix the incorrect comparison by chaning the value type or the comparison.'''
WIKI_RECOMMENDATION = '''Fix the incorrect comparison by changing the value type or the comparison.'''
def typeRange(self, t):
bits = int(t.split("int")[1])

@ -27,8 +27,8 @@ class ConstCandidateStateVars(AbstractDetector):
WIKI_TITLE = 'State variables that could be declared constant'
WIKI_DESCRIPTION = 'Constant state variable should be declared constant to save gas.'
WIKI_RECOMMENDATION = 'Add the `constant` attributes to the state variables that never change.'
WIKI_DESCRIPTION = 'Constant state variables should be declared constant to save gas.'
WIKI_RECOMMENDATION = 'Add the `constant` attributes to state variables that never change.'
@staticmethod
def _valid_candidate(v):

@ -31,7 +31,7 @@ contract Uninitialized is Owner{
}
}
```
Bob calls `transfer`. As a result, the ethers are sent to the address 0x0 and are lost.'''
Bob calls `transfer`. As a result, all Ether is sent to the address `0x0` and is lost.'''
WIKI_RECOMMENDATION = 'Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero.'

@ -38,7 +38,7 @@ contract Uninitialized{
}
}
```
Bob calls `transfer`. As a result, the ethers are sent to the address 0x0 and are lost.
Bob calls `transfer`. As a result, the Ether are sent to the address `0x0` and are lost.
'''
WIKI_RECOMMENDATION = '''
Initialize all the variables. If a variable is meant to be initialized to zero, explicitly set it to zero.

@ -20,7 +20,7 @@ class UninitializedStorageVars(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#uninitialized-storage-variables'
WIKI_TITLE = 'Uninitialized storage variables'
WIKI_DESCRIPTION = 'An uinitialized storage variable will act as a reference to the first state variable, and can override a critical variable.'
WIKI_DESCRIPTION = 'An uninitialized storage variable will act as a reference to the first state variable, and can override a critical variable.'
WIKI_EXPLOIT_SCENARIO = '''
```solidity
contract Uninitialized{
@ -36,10 +36,10 @@ contract Uninitialized{
}
}
```
Bob calls `func`. As a result, `owner` is override to 0.
Bob calls `func`. As a result, `owner` is overridden to `0`.
'''
WIKI_RECOMMENDATION = 'Initialize all the storage variables.'
WIKI_RECOMMENDATION = 'Initialize all storage variables.'
# node.context[self.key] contains the uninitialized storage variables
key = "UNINITIALIZEDSTORAGE"

@ -21,7 +21,7 @@ class UnusedStateVars(AbstractDetector):
WIKI = 'https://github.com/crytic/slither/wiki/Detector-Documentation#unused-state-variables'
WIKI_TITLE = 'Unused state variables'
WIKI_TITLE = 'Unused state variable'
WIKI_DESCRIPTION = 'Unused state variable.'
WIKI_EXPLOIT_SCENARIO = ''
WIKI_RECOMMENDATION = 'Remove unused state variables.'

@ -9,6 +9,6 @@ funcNotCalled() should be declared external:
- ContractWithFunctionNotCalled2.funcNotCalled() (tests/external_function.sol#32-39)
parameter_read_ok_for_external(uint256) should be declared external:
- FunctionParameterWrite.parameter_read_ok_for_external(uint256) (tests/external_function.sol#74-76)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#public-function-that-could-be-declared-as-external
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#public-function-that-could-be-declared-external
tests/external_function.sol analyzed (6 contracts with 1 detectors), 5 result(s) found
Use https://crytic.io/ to get access to additional detectors and Github integration

@ -11,6 +11,6 @@ Modifier naming.CantDo() (tests/naming_convention.sol#41-43) is not in mixedCase
Parameter T.test(uint256,uint256)._used (tests/naming_convention.sol#59) is not in mixedCase
Variable T._myPublicVar (tests/naming_convention.sol#56) is not in mixedCase
Variable T.l (tests/naming_convention.sol#67) used l, O, I, which should not be used
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#conformance-to-solidity-naming-conventions
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#conformity-to-solidity-naming-conventions
tests/naming_convention.sol analyzed (4 contracts with 1 detectors), 12 result(s) found
Use https://crytic.io/ to get access to additional detectors and Github integration

Loading…
Cancel
Save