crytic / crytic/slither

[False-Positive]: Function marked as re-entrant

Open
#1,807 5 comments 0 reactions 0 assignees View on GitHub
false-positive
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the false alarm that Slither raise and how you know it's inaccurate:

I have a function F in contract A, that can only be called from contract B.
Slither marks some lines of F as possible re-entrant, while this is not possible.

Is it possible to disable the check for the whole function, or do I have to add `//slither-disable-next-line reentrancy-no-eth` over every re-entrant line?

### Frequency

Occasionally

### Code example to reproduce the issue:

```Solidity
modifier onlyOtherContract () {
require(msg.sender == otherContract, "Only otherContract can call this");
_;
}

function F() external onlyOtherContract {
...
bool successfulApproval = _token.approve(address(_gToken), _amount); // <<-- one of the lines that is marked as possibly re-entrant
...
}
```

### Version:

I use it in a github action, with `crytic/slither-action@v0.3.0`

### Relevant log output:

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the report with the Solidity modifier and function example using the reentrancy-no-eth detector, starting from the suppression behavior exposed by the Slither CLI or GitHub Action. Trace how next-line suppression is applied and determine whether function-level suppression is supported; done means the requested scope works consistently or the documented limitation is clear.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, solidity
Domain
devtools, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.