|
|
@ -9,8 +9,7 @@ |
|
|
|
TODO: dont report if the value is tainted by msg.value |
|
|
|
TODO: dont report if the value is tainted by msg.value |
|
|
|
""" |
|
|
|
""" |
|
|
|
|
|
|
|
|
|
|
|
from slither.analyses.taint.calls import KEY |
|
|
|
from slither.analyses.taint.all_variables import is_tainted as is_tainted_from_inputs |
|
|
|
from slither.analyses.taint.calls import run_taint as run_taint_calls |
|
|
|
|
|
|
|
from slither.analyses.taint.specific_variable import is_tainted |
|
|
|
from slither.analyses.taint.specific_variable import is_tainted |
|
|
|
from slither.analyses.taint.specific_variable import \ |
|
|
|
from slither.analyses.taint.specific_variable import \ |
|
|
|
run_taint as run_taint_variable |
|
|
|
run_taint as run_taint_variable |
|
|
@ -33,8 +32,7 @@ class ArbitrarySend(AbstractDetector): |
|
|
|
|
|
|
|
|
|
|
|
WIKI = 'https://github.com/trailofbits/slither/wiki/Vulnerabilities-Description#functions-that-send-ether-to-arbitrary-destinations' |
|
|
|
WIKI = 'https://github.com/trailofbits/slither/wiki/Vulnerabilities-Description#functions-that-send-ether-to-arbitrary-destinations' |
|
|
|
|
|
|
|
|
|
|
|
@staticmethod |
|
|
|
def arbitrary_send(self, func): |
|
|
|
def arbitrary_send(func): |
|
|
|
|
|
|
|
""" |
|
|
|
""" |
|
|
|
""" |
|
|
|
""" |
|
|
|
if func.is_protected(): |
|
|
|
if func.is_protected(): |
|
|
@ -59,8 +57,7 @@ class ArbitrarySend(AbstractDetector): |
|
|
|
if is_tainted(ir.call_value, SolidityVariableComposed('msg.value')): |
|
|
|
if is_tainted(ir.call_value, SolidityVariableComposed('msg.value')): |
|
|
|
continue |
|
|
|
continue |
|
|
|
|
|
|
|
|
|
|
|
if KEY in ir.context: |
|
|
|
if is_tainted_from_inputs(self.slither, ir.destination): |
|
|
|
if ir.context[KEY]: |
|
|
|
|
|
|
|
ret.append(node) |
|
|
|
ret.append(node) |
|
|
|
return ret |
|
|
|
return ret |
|
|
|
|
|
|
|
|
|
|
@ -85,9 +82,6 @@ class ArbitrarySend(AbstractDetector): |
|
|
|
""" |
|
|
|
""" |
|
|
|
results = [] |
|
|
|
results = [] |
|
|
|
|
|
|
|
|
|
|
|
# Look if the destination of a call is tainted |
|
|
|
|
|
|
|
run_taint_calls(self.slither) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Taint msg.value |
|
|
|
# Taint msg.value |
|
|
|
taint = SolidityVariableComposed('msg.value') |
|
|
|
taint = SolidityVariableComposed('msg.value') |
|
|
|
run_taint_variable(self.slither, taint) |
|
|
|
run_taint_variable(self.slither, taint) |
|
|
@ -101,7 +95,7 @@ class ArbitrarySend(AbstractDetector): |
|
|
|
for (func, nodes) in arbitrary_send: |
|
|
|
for (func, nodes) in arbitrary_send: |
|
|
|
calls_str = [str(node.expression) for node in nodes] |
|
|
|
calls_str = [str(node.expression) for node in nodes] |
|
|
|
|
|
|
|
|
|
|
|
info = "{}{} sends eth to arbirary user\n" |
|
|
|
info = "{}.{} sends eth to arbirary user\n" |
|
|
|
info = info.format(func.contract.name, |
|
|
|
info = info.format(func.contract.name, |
|
|
|
func.name) |
|
|
|
func.name) |
|
|
|
info += '\tDangerous calls:\n' |
|
|
|
info += '\tDangerous calls:\n' |
|
|
|