controlled-array-length detector reports array.push(x) array.pop(x) where x is user controlled
- Dominant language
- Python
- Stars
- 6.4k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
> Detects the direct assignment of an array's length.
https://github.com/crytic/slither/wiki/Detector-Documentation#array-length-assignment
To me `array.push` seems different than a direct assignment of an array's length.
Is this ever a true positive?
If not we should not have the detector report it as it creates noise.
`example.sol`:
```solidity
pragma solidity ^0.6.12;
contract Example {
address[] public modules;
function example() external {
modules.push(msg.sender);
}
}
```
```
$ slither example.sol
Example (example.sol#3-9) contract sets array length with a user-controlled value:
- modules.push(msg.sender) (example.sol#7)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#array-length-assignment
```
Update: same for `array.pop()`
Contributor guide
Assessment
This issue has not been assessed yet.