crytic / crytic/slither

Improve --checklist output with ID and Impact/Confidence

Open
#711 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

Currently the `--checklist` outputs markdown as follows:

---

## arbitrary-send

| Analyzed | Description |
|----------------|-----------|
|

  • [ ] TP
  • [ ] FP
  • [ ] Unknown
|
  • SomeContract._someFn(uint256) (contracts/SomeContract.sol#11-12) sends eth to arbitrary user
    • Dangerous calls:
      • - (success) = msg.sender.call{value: someValue}() (contracts/SomeContract.sol#12)
        |
        • [ ] TP
        • [ ] FP
        • [ ] Unknown
        |
        • SomeOtherContract._someOtherFn(uint256) (contracts/SomeOtherContract.sol#74-79) sends eth to arbitrary user
          • Dangerous calls:
            • - (success) = msg.sender.call{value: _amount}() (contracts/SomeOtherContract.sol#78)

              ---

              It would be really useful if the following improvements were made to this output:
              - Give each slither finding an ID (start at 1, increment). This would allow to easily refer to a specific finding when communicating these slither results. For example, you could then say: "Opened issue #999 for slither finding 2", or "Could you take a look at slither finding 14, I'm not too sure about it"
              - add Impact and Confidence to each finding

              ---

              This might break other projects that use the `--checklist` and somehow integrate/parse it.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.