crytic / crytic/slither

Data dependency: add "must depend on"

Open
#175 4 comments 0 reactions 0 assignees View on GitHub
0.7 enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

Right now, the data dependency is an over-approximation that merges all the dependencies coming from all the node's fathers.

As a result, in a code like:

```solidity
function f(address destination) internal{
// use of destination
}
function g() internal{
f(msg.sender):
f(owner);
}
```
`destination` in `f` is both dependent of `msg.sender` and `owner`. We should have a *must depend on* mode, to detect if a variable is **always** dependent of another one.

We can implement it by adding a new mode in [analyses/data_dependency/data_dependency.py](https://github.com/trailofbits/slither/blob/master/slither/analyses/data_dependency/data_dependency.py), where only the dependencies present in all the node's fathers are kept.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.