crytic / crytic/slither

More robust triage mode

Open
#2,300 4 comments 0 reactions 0 assignees View on GitHub
enhancement High Priority
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

There are two ways to triage an issue:
1. Using `// slither-disable` comments
2. Using triage mode to save findings to a database

I prefer (2) because (1) can get noisy and result in many source code comments.

In https://github.com/crytic/slither-action/issues/70#issuecomment-1933104976 @elopez helped me notice that the triage database isn't robust to unrelated to source code changes. In that example, a contract had 8 `incorrect-return` findings ignored via triage, and after removing 2 unused `error` declarations in that contract, those resurfaced.

It [seems](https://github.com/crytic/slither/blob/e3dcf1ecd3e9de60da046de471c5663ab637993a/slither/core/slither_core.py#L442-L443) this happens because the ID of the finding changed. I'm not sure how IDs are determined, but my guess is they are a function of line number.

I'm not sure of the best way to implement this feature, but it would be very helpful if the database findings were most robust to source code changes.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.