Slither considers constructors as a taint source
Open
documentation
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
```
contract SlitherTaintBug {
uint count;
constructor (uint _count) public {
count = _count;
}
function deposit() public payable {
uint local_count = count;
}
}
```
If I use slither's ` slither.analyses.data_dependency.data_dependency.is_tainted()` with `local_count` as the variable and `contract` as context. It will output true. Is that intended?
According to my understanding, `constructors` are deployed by a contract owner. Hence, any variable declared by arguments of constructors within a constructor is done by the owner. So, it is can not be external user-controlled. Right?
Contributor guide
Assessment
This issue has not been assessed yet.