crytic / crytic/crytic-compile

Etherscan(-like) platforms might cause files to be compiled which are not actually deployed at an address

Open
#246 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
197
Forks
97
PR merge metrics
No merged PRs in 30d

Description

If the etherscan download results in a multi-file response then currently crytic-compile will compile them all, and download and save them all. This will then result in slither also analyzing them all.

However, there are some cases where the entire OZ package has been uploaded as well as the entire projects `contracts/` dir. For example this one: https://etherscan.io/address/0xf38ca0cffc53a6b6c62c2be87967fcc13e807751#code

There are 59 files, but the contract that is actually deployed here is `EMAOracle` which - if you follow the dependencies - only inherits 4 other contracts/libraries, namely:
- `@openzeppelin/contracts/math/SafeMath.sol`
- `contracts/libs/DecMath.sol`
- `contracts/models/interest-oracle/IInterestOracle.sol`
- `contracts/moneymarkets/MoneyMarket.sol`

Another example is this one: https://etherscan.io/address/0x5678de8fbf89ae22aebd2217d3d15fee468f4aac#code. This is the proxy contract for the Aave Token. It lists 19 files, and the contract that is deployed is `InitializableAdminUpgradeabilityProxy`. If you follow the dependencies there are only 6.

What we would like is for `crytic-compile` to - using the deployed contract name returned by etherscan - to only download the files that are actually included and remove the others from the compilation unit and also remove any downloaded files which are not actually included in the deployment.

This would result in slither not giving back results for contracts which are not deployed at an address.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.