crytic / crytic/crytic-compile

Impact by Etherscan's lack of error on Reinit issues

Open
#604 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
197
Forks
97
PR merge metrics
No merged PRs in 30d

Description

## Introduction

crytic-compile will not recognize this problem when meet a reinit contract. This is mainly because the data returned by the Etherscan API does not provide any error information for reinit, although this waring information is displayed on the etherscan web page. But it is worth noting that all API-dependent tools have been impact.

## Details

Related PoC Contract : https://api-sepolia.etherscan.io/api?module=contract&action=getsourcecode&address=0x9fB39EE8a5879DC788a525D29C596b9BBBE9f5A4&apikey=HEGX18IPPBPB9M23C4W1UDNP5I4F57XX1F

Image

https://sepolia.etherscan.deth.net/address/0x9fB39EE8a5879DC788a525D29C596b9BBBE9f5A4

Image

https://sepolia.etherscan.io/address/0x9fB39EE8a5879DC788a525D29C596b9BBBE9f5A4#code

## Impact
It is worth noting that this problem will cause the user to obtain a source code that does not match the current bytecode. Because the target contract may be created using create2 and after verification is completed, another bytecode is deployed.

## Ethic Things
i already report the reinit issue in API feedback in 2 year ago. but etherscan don't give any feedback. so i think i should report to the user of this api.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.