New detector for `msg.value > address(this).balance` conditions (honeypot detection)
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
### Describe the desired feature
Slither should issue a warning where you have `msg.value > address(this).balance` conditions (the same for `>=` with the caveat that it's possible to hold `true` if the initial balance is zero). These conditions are many times used for honeypots!
#### Example Snippet
```solidity
// SPDX-License-Identifier: WTFPL
pragma solidity ^0.8.19;
contract TryToReachMe {
constructor() payable {
assert(msg.value == 1 wei);
}
function tryMeBabe(address addr) public payable {
uint256 balance = address(this).balance;
if (msg.value > balance) {
unchecked {
payable(addr).transfer(balance + msg.value);
}
}
}
}
```
### Current Behaviour
Run `slither sepolia:0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1 --etherscan-apikey `
#### Output
```bash
INFO:Detectors:
TryToReachMe.tryMeBabe(address).addr (crytic-export/etherscan-contracts/0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1-sepolia.etherscan.io-TryToReachMe.sol#9) lacks a zero-check on :
- address(addr).transfer(balance + msg.value) (crytic-export/etherscan-contracts/0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1-sepolia.etherscan.io-TryToReachMe.sol#13)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-address-validation
INFO:Detectors:
Pragma version^0.8.19 (crytic-export/etherscan-contracts/0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1-sepolia.etherscan.io-TryToReachMe.sol#2) necessitates a version too recent to be trusted. Consider deploying with 0.8.18.
solc-0.8.19 is not recommended for deployment
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity
INFO:Slither:sepolia:0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1 analyzed (1 contracts with 85 detectors), 3 result(s) found
```
Contributor guide
Research direction
Start with Slither's detector entry points and existing detector tests, then run the issue's TryToReachMe Solidity snippet through the slither command. Done means emitting a warning for msg.value > address(this).balance and for >= with the stated zero-initial-balance caveat.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, solidity
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100