crytic / crytic/slither

controlled-array-length detector reports array.push(x) array.pop(x) where x is user controlled

Open
#752 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

> Detects the direct assignment of an array's length.

https://github.com/crytic/slither/wiki/Detector-Documentation#array-length-assignment

To me `array.push` seems different than a direct assignment of an array's length.

Is this ever a true positive?

If not we should not have the detector report it as it creates noise.

`example.sol`:

```solidity
pragma solidity ^0.6.12;

contract Example {
address[] public modules;

function example() external {
modules.push(msg.sender);
}
}
```

```
$ slither example.sol
Example (example.sol#3-9) contract sets array length with a user-controlled value:
- modules.push(msg.sender) (example.sol#7)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#array-length-assignment
```

Update: same for `array.pop()`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.