crytic / crytic/slither

[False Negative]: reentrancy-no-eth for interprocedural case

Open
#2,544 1 comment 0 reactions 0 assignees View on GitHub
false-negative
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### What bug did Slither miss and which detector did you anticipate would catch it?

The following should be detected by `reentrancy-no-eth` but it is incorrectly considered benign. It is more important to highlight that there is a read-call-write than a write after a call

### Frequency

Very Frequently

### Code example to reproduce the issue:

```
contract T1 {
uint x;
function re() external {
require(x != 9);
re2();
}
function re2() internal {
address(1).call("");
x = 9;
}

}
```

### Version:

0.10.4

### Relevant log output:

```shell
INFO:Detectors:
T1.re2() (t.sol#7-10) ignores return value by address(1).call() (t.sol#8)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#unchecked-low-level-calls
INFO:Detectors:
Reentrancy in T1.re2() (t.sol#7-10):
External calls:
- address(1).call() (t.sol#8)
State variables written after the call(s):
- x = 9 (t.sol#9)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#reentrancy-vulnerabilities-2
INFO:Detectors:
Low level call in T1.re2() (t.sol#7-10):
- address(1).call() (t.sol#8)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.