crytic / crytic/slither

Slither considers constructors as a taint source

Open
#404 3 comments 0 reactions 0 assignees View on GitHub
documentation
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

```
contract SlitherTaintBug {

uint count;
constructor (uint _count) public {
count = _count;

}

function deposit() public payable {

uint local_count = count;
}


}
```
If I use slither's ` slither.analyses.data_dependency.data_dependency.is_tainted()` with `local_count` as the variable and `contract` as context. It will output true. Is that intended?

According to my understanding, `constructors` are deployed by a contract owner. Hence, any variable declared by arguments of constructors within a constructor is done by the owner. So, it is can not be external user-controlled. Right?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.