ConsenSysDiligence / ConsenSysDiligence/mythril
Vulnerability found with Solidity 0.7 but not 0.8
- Dominant language
- Python
- Stars
- 4.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
I am testing Mythril on the vulnerability of unchecked return values of low-level calls (SWC-104) and several Solidity versions.
In the following contract Mythril detects the vulnerability with Solidity version 0.7.6. In the exact same contract but version 0.8.29 it doesn't. I've used Mythril version 0.24.7 in sourcecode mode and bytecode mode.
I've encountered this behaviour also with the constructs _staticcall_ and _delegatecall_ in similarly designed contracts.
What is the reason or motivation behind this?
Thank you for the help!
```
pragma solidity 0.7.6;
contract Contract_100 {
constructor() public {
}
function test(address callAddress) public {
callAddress.call(abi.encodeWithSignature("foo()"));
}
}
```
Contributor guide
Research direction
The issue names no repository files or tests. Reproduce the contract with Mythril 0.24.7 in sourcecode and bytecode modes using Solidity 0.7.6 and 0.8.29, then compare the generated bytecode and SWC-104 results. Done means documenting the cause of the difference or identifying the analysis change needed for consistent handling of call, staticcall, and delegatecall.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, solidity
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100