crytic / crytic/slither

Arbitrary-send-eth false positive

Open
#1,225 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

UPDATE:

(2) and (3) are resolved by using detector name "arbitrary-send", not "arbitrary-send-eth". That could be made more clear in the docs since it is titled "Check: arbitrary-send-eth" on the man page, but it has been resolved

However, (1) still seems to be an issue

OP:

arbitrary-send-eth seems broken- both producing false positive (1), and not working as a detector that can be ignored or detected against individually (2) and (3).

```
function getPayout(address payable addressOfProposer)
public
returns (bool)
{
// Get the available allowance first amd store in uint256.
uint256 allowanceAvailable = _payoutTotals[addressOfProposer];
require(allowanceAvailable > 0, "You do not have any funds available.");
_decreasePayout(addressOfProposer, allowanceAvailable);

(bool success,) = addressOfProposer.call{value: allowanceAvailable}("");
require(success, "Failed to send eth");

emit Withdraw(addressOfProposer, allowanceAvailable);
return true;
}
```

(1) This code appears controlled, not sending ether to an arbitrary user address. They have to have an allowanceAvailable per contract state, yet slither produces:
```

PowDAO.getPayout(address) (PowDAO.sol#142-157) sends eth to arbitrary user
Dangerous calls:
- (success) = addressOfProposer.call{value: allowanceAvailable}() (PowDAO.sol#152)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#functions-that-send-ether-to-arbitrary-destinations
```

That's the first bug.

(2) Next, I added this line:
```
//slither-disable-next-line arbitrary-send-eth
(bool success,) = addressOfProposer.call{value: allowanceAvailable}("");
```

It still produces the high level warning

(3) Third, I ran

`slither PowDAO.sol --detect arbitrary-send-eth
`
And I got the response
```
Traceback (most recent call last):
File "/home/gerald/.local/bin//slither", line 8, in
sys.exit(main())
File "/home/gerald/.local/lib/python3.8/site-packages/slither/__main__.py", line 632, in main
main_impl(all_detector_classes=detectors, all_printer_classes=printers)
File "/home/gerald/.local/lib/python3.8/site-packages/slither/__main__.py", line 671, in main_impl
detector_classes = choose_detectors(args, all_detector_classes)
File "/home/gerald/.local/lib/python3.8/site-packages/slither/__main__.py", line 211, in choose_detectors
raise Exception(f"Error: {detector} is not a detector")
Exception: Error: arbitrary-send-eth is not a detector
```

### Code example to reproduce the issue:

```
function getPayout(address payable addressOfProposer)
public
returns (bool)
{
// Get the available allowance first amd store in uint256.
uint256 allowanceAvailable = _payoutTotals[addressOfProposer];
require(allowanceAvailable > 0, "You do not have any funds available.");
_decreasePayout(addressOfProposer, allowanceAvailable);
//slither-disable-next-line arbitrary-send-eth
(bool success,) = addressOfProposer.call{value: allowanceAvailable}("");
require(success, "Failed to send eth");

emit Withdraw(addressOfProposer, allowanceAvailable);
return true;
}
```

### Version:

0.8.3

### Relevant log output:

```shell
PowDAO.getPayout(address) (PowDAO.sol#142-157) sends eth to arbitrary user
Dangerous calls:
- (success) = addressOfProposer.call{value: allowanceAvailable}() (PowDAO.sol#152)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#functions-that-send-ether-to-arbitrary-destinations
```

and

`slither PowDAO.sol --detect arbitrary-send-eth
`
```
Traceback (most recent call last):
File "/home/gerald/.local/bin//slither", line 8, in
sys.exit(main())
File "/home/gerald/.local/lib/python3.8/site-packages/slither/__main__.py", line 632, in main
main_impl(all_detector_classes=detectors, all_printer_classes=printers)
File "/home/gerald/.local/lib/python3.8/site-packages/slither/__main__.py", line 671, in main_impl
detector_classes = choose_detectors(args, all_detector_classes)
File "/home/gerald/.local/lib/python3.8/site-packages/slither/__main__.py", line 211, in choose_detectors
raise Exception(f"Error: {detector} is not a detector")
Exception: Error: arbitrary-send-eth is not a detector
```
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.