crytic / crytic/slither

New detector for `msg.value > address(this).balance` conditions (honeypot detection)

Open
#1,860 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

Slither should issue a warning where you have `msg.value > address(this).balance` conditions (the same for `>=` with the caveat that it's possible to hold `true` if the initial balance is zero). These conditions are many times used for honeypots!

#### Example Snippet

```solidity
// SPDX-License-Identifier: WTFPL
pragma solidity ^0.8.19;

contract TryToReachMe {
constructor() payable {
assert(msg.value == 1 wei);
}

function tryMeBabe(address addr) public payable {
uint256 balance = address(this).balance;
if (msg.value > balance) {
unchecked {
payable(addr).transfer(balance + msg.value);
}
}
}
}
```

### Current Behaviour

Run `slither sepolia:0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1 --etherscan-apikey `

#### Output

```bash
INFO:Detectors:
TryToReachMe.tryMeBabe(address).addr (crytic-export/etherscan-contracts/0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1-sepolia.etherscan.io-TryToReachMe.sol#9) lacks a zero-check on :
- address(addr).transfer(balance + msg.value) (crytic-export/etherscan-contracts/0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1-sepolia.etherscan.io-TryToReachMe.sol#13)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-address-validation
INFO:Detectors:
Pragma version^0.8.19 (crytic-export/etherscan-contracts/0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1-sepolia.etherscan.io-TryToReachMe.sol#2) necessitates a version too recent to be trusted. Consider deploying with 0.8.18.
solc-0.8.19 is not recommended for deployment
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity
INFO:Slither:sepolia:0xd411B211bCD6DE869570238FEBb4EfF7f3c6d1D1 analyzed (1 contracts with 85 detectors), 3 result(s) found
```

Contributor guide

Open the contributing guide

Research direction

Start with Slither's detector entry points and existing detector tests, then run the issue's TryToReachMe Solidity snippet through the slither command. Done means emitting a warning for msg.value > address(this).balance and for >= with the stated zero-initial-balance caveat.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, solidity
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.