Improve --checklist output with ID and Impact/Confidence
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
Currently the `--checklist` outputs markdown as follows:
---
## arbitrary-send
| Analyzed | Description |
|----------------|-----------|
|
- [ ] TP
- [ ] FP
- [ ] Unknown
- SomeContract._someFn(uint256) (contracts/SomeContract.sol#11-12) sends eth to arbitrary user
- Dangerous calls:
- - (success) = msg.sender.call{value: someValue}() (contracts/SomeContract.sol#12)
|- [ ] TP
- [ ] FP
- [ ] Unknown
- SomeOtherContract._someOtherFn(uint256) (contracts/SomeOtherContract.sol#74-79) sends eth to arbitrary user
- Dangerous calls:
- - (success) = msg.sender.call{value: _amount}() (contracts/SomeOtherContract.sol#78)
---
It would be really useful if the following improvements were made to this output:
- Give each slither finding an ID (start at 1, increment). This would allow to easily refer to a specific finding when communicating these slither results. For example, you could then say: "Opened issue #999 for slither finding 2", or "Could you take a look at slither finding 14, I'm not too sure about it"
- add Impact and Confidence to each finding---
This might break other projects that use the `--checklist` and somehow integrate/parse it.
- - (success) = msg.sender.call{value: _amount}() (contracts/SomeOtherContract.sol#78)
- Dangerous calls:
- - (success) = msg.sender.call{value: someValue}() (contracts/SomeContract.sol#12)
- Dangerous calls:
Contributor guide
Assessment
This issue has not been assessed yet.