You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Regarding zero address check I think it's too subjective. Maybe something like, if there is an address parameter, as long as there is some type of binary check on the address it should be okay. What do you think @alexroan ?
Feature related technical debt in the codebases
(We'll open another one for refactoring related stuff)
Some points to remember
These were not taken good care of while writing the initial detectors.
revert()
andrevert Error()
are different. The former is a function call while the latter is a revert statement. We've skipped cases in many places.address
oraddress payable
. We should handle both cases where necessary without skipping them.selfdestruct
is fine, but we also have to handlesuicide
.is_constructor
, because for newer versions of solc, even for constructors that returns false, so you should checkkind()
.Detectors
Delegate call in a loop detector should use callgraph, currently doesn't. #689
Unprotected init function should use callgraph, currently doesn't. #688
Multiple constructors - Use the modern
kind()
to cover all solidity versions #687Require in string detctor detector fail to follow the 1st point above ^ #685
Revert and require in loops detector don't account for revert statements #684
Zero address check should use callgraph (but maybe put on hold, cuz we lose the data-context as we dont have a CFG yet)
Dear open source community, if you are looking at this feel free to pick one up and send PRs :)
The text was updated successfully, but these errors were encountered: