crytic / crytic/slither

[False-Positive]: Weak PRNG Usage

Open
#2,267 3 comments 0 reactions 0 assignees View on GitHub
false-positive
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the false alarm that Slither raise and how you know it's inaccurate:

Slither reports `Weak PRNG` when it found there are some module usage `%`, regardless of it depends the `block.timestamp`.

### Frequency

Very Frequently

### Code example to reproduce the issue:

- For a real-world project on Etherscan:
`https://etherscan.io/address/0xc9fe6e1c76210be83dc1b5b20ec7fd010b0b1d15#code#F13`(jug.sol).

In function rpow:
```
function rpow(uint x, uint n, uint b) internal pure returns (uint z) {
assembly {
switch x case 0 {switch n case 0 {z := b} default {z := 0}}
default {
switch mod(n, 2) case 0 { z := b } default { z := x }
let half := div(b, 2) // for rounding.
for { n := div(n, 2) } n { n := div(n,2) } {
let xx := mul(x, x)
if iszero(eq(div(xx, x), x)) { revert(0,0) }
let xxRound := add(xx, half)
if lt(xxRound, xx) { revert(0,0) }
x := div(xxRound, b)
if mod(n,2) {
let zx := mul(z, x)
if and(iszero(iszero(x)), iszero(eq(div(zx, x), z))) { revert(0,0) }
let zxRound := add(zx, half)
if lt(zxRound, zx) { revert(0,0) }
z := div(zxRound, b)
}
}
}
}
}
```

It got:
```
INFO:Detectors:
Jug.rpow(uint256,uint256,uint256) (jug.sol#62-84) uses a weak PRNG: "switch_expr_2366_53_0_rpow_asm_0 = n % 2 (jug.sol#66)"
Jug.rpow(uint256,uint256,uint256) (jug.sol#62-84) uses a weak PRNG: "n % 2 (jug.sol#74-80)"
```

- We even tried another simple case for this rule (also in the same solidity file above, and add a line for function `add`):

```solidity
function add(uint x, uint y) internal pure returns (uint z) {
z = x + y;
z = z % 2;
require(z >= x);
}
```
It reported:

```
Jug.add(uint256,uint256) (jug.sol#86-90) uses a weak PRNG: "z = z % 2 (jug.sol#88)"
```

### Version:

0.10.0

### Relevant log output:

```shell
INFO:Detectors:
Jug.rpow(uint256,uint256,uint256) (jug.sol#62-84) uses a weak PRNG: "switch_expr_2366_53_0_rpow_asm_0 = n % 2 (jug.sol#66)"
Jug.rpow(uint256,uint256,uint256) (jug.sol#62-84) uses a weak PRNG: "n % 2 (jug.sol#74-80)"
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#weak-PRNG
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.