slither
slither copied to clipboard
analyze internal calls after performing constant propagation
This detector currently under-approximates arbitrary from's in transferFrom
as it does not consider internal calls and it's dependency analysis is not strict (if msg.sender
is used anywhere in the contract it's considered okay despite other tainted values).
This PR addresses those issues in two ways:
-
It performs constant propagation on
address(this)
andmsg.sender
so that arguments passed to library/internal function calls represent the underlying value. -
Whenever
high_level_calls
was being used, it wasn't returning internal nodes/IRs to analyze, so I added a recursive analysis whenever an IR is anINTERNAL_CALL
.
This pull request introduces 1 alert when merging 8e77dd791163c5e3192d2861dc507709772c491c into 168e96298fb8f8a588c110aa75cd38b3a7662ed9 - view on LGTM.com
new alerts:
- 1 for Unused import
This pull request introduces 1 alert when merging 3beca4b107c3054763b2188192f9f02ff1f70329 into 6a2e1e0819f0dde932484b20bb0e0d3e39293adf - view on LGTM.com
new alerts:
- 1 for Unused import