scilla
scilla copied to clipboard
Write an audit tool that uses `Callgraph`
We could use the Callgraph
module implemented in #1144 to create a tool that helps auditing smart contracts.
Desired functionality:
- [ ] A CLI option to don't show pure functions call on the
.dot
dump. This is usable to reduce the noise when analyzing imperative code. - [ ] Show changes in the imperative state of the contract for each procedure/transition. Read, write, and read-write (update) operations of fields should be shown differently.
- [ ] External calls, event, exceptions on the graph.
- [ ] Show clusters of procedures/transitions based on fields they access (if procedures commute, i.e. do not share common state, it should be clearly observable from the call graph).
The more filtering options this contract map tool supports the better. Remote reads also should be marked explicitly.
Moving to v0.14 due to lack of time.