crytic / crytic/slither

[false-positive]: false positive on ERC3156 flash lender `arbitrary-from-in-transferfrom` in slither 0.9.2

Open
#1,658 1 comment 0 reactions 0 assignees View on GitHub
false-positive
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue:

https://eips.ethereum.org/EIPS/eip-3156

reference implementation for ERC3156 has this code for the flash lender:

```solidity
function flashLoan(
IERC3156FlashBorrower receiver,
address token,
uint256 amount,
bytes calldata data
) external override returns(bool) {
require(
supportedTokens[token],
"FlashLender: Unsupported currency"
);
uint256 fee = _flashFee(token, amount);
require(
IERC20(token).transfer(address(receiver), amount),
"FlashLender: Transfer failed"
);
require(
receiver.onFlashLoan(msg.sender, token, amount, fee, data) == CALLBACK_SUCCESS,
"FlashLender: Callback failed"
);
require(
IERC20(token).transferFrom(address(receiver), address(this), amount + fee),
"FlashLender: Repay failed"
);
return true;
}
```

slither complains (loudly, high severity, high confidence, red text) about the receiver in the repayment being an "arbitrary" transfer from, but it's the receiver of the loan

i don't see any way to rewrite this function that would satisfy both slither and ERC3156 as the ERC spec mandates the receiver being an argument to the `flashLoan` function

### Code example to reproduce the issue:

https://eips.ethereum.org/EIPS/eip-3156#flash-loan-reference-implementation

### Version:

0.9.2

### Relevant log output:

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.