Skip to content

Commit

Permalink
Don't report if destination is immutable state var
Browse files Browse the repository at this point in the history
  • Loading branch information
smonicas committed Jun 21, 2024
1 parent 02df0dc commit 469286f
Show file tree
Hide file tree
Showing 7 changed files with 23 additions and 10 deletions.
3 changes: 3 additions & 0 deletions slither/detectors/functions/arbitrary_send_eth.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
SolidityCall,
Transfer,
)
from slither.core.variables.state_variable import StateVariable

# pylint: disable=too-many-nested-blocks,too-many-branches
from slither.utils.output import Output
Expand Down Expand Up @@ -67,6 +68,8 @@ def arbitrary_send(func: Function) -> Union[bool, List[Node]]:
continue
if ir.call_value == SolidityVariableComposed("msg.value"):
continue
if isinstance(ir.destination, StateVariable) and ir.destination.is_immutable:
continue
if is_dependent(
ir.call_value,
SolidityVariableComposed("msg.value"),
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
Test.indirect() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#19-21) sends eth to arbitrary user
Test.direct() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#16-18) sends eth to arbitrary user
Dangerous calls:
- destination.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#20)
- msg.sender.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#17)

Test.direct() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#11-13) sends eth to arbitrary user
Test.indirect() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#24-26) sends eth to arbitrary user
Dangerous calls:
- msg.sender.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#12)
- destination.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.6.11/arbitrary_send_eth.sol#25)

Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
Test.direct() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#11-13) sends eth to arbitrary user
Test.direct() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#16-18) sends eth to arbitrary user
Dangerous calls:
- msg.sender.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#12)
- msg.sender.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#17)

Test.indirect() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#19-21) sends eth to arbitrary user
Test.indirect() (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#24-26) sends eth to arbitrary user
Dangerous calls:
- destination.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#20)
- destination.send(address(this).balance) (tests/e2e/detectors/test_data/arbitrary-send-eth/0.7.6/arbitrary_send_eth.sol#25)

Original file line number Diff line number Diff line change
@@ -1,13 +1,18 @@
contract Test{

address payable destination;

address payable immutable destination_imm;
mapping (address => uint) balances;

constructor() public{
destination_imm = payable(msg.sender);
balances[msg.sender] = 0;
}

function send_immutable() public{
destination_imm.send(address(this).balance);
}

function direct() public{
msg.sender.send(address(this).balance);
}
Expand Down
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -1,13 +1,18 @@
contract Test{

address payable destination;

address payable immutable destination_imm;
mapping (address => uint) balances;

constructor() public{
destination_imm = payable(msg.sender);
balances[msg.sender] = 0;
}

function send_immutable() public{
destination_imm.send(address(this).balance);
}

function direct() public{
msg.sender.send(address(this).balance);
}
Expand Down
Binary file not shown.

0 comments on commit 469286f

Please sign in to comment.