crytic / crytic/slither

Detect untrusted input used to make a call

Open
#2,510 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

A common way a contract can be made vulnerable is to make a call with attacker-controlled target and data. For example, see [this Li.Fi exploit](https://x.com/AlexSmirnov__/status/1813224734475116643).

Slither could detect that the arguments to `.call` are untrusted and flag it as a warning.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.