algorand/go-algorand: daemon/algod/api/server/v2/dryrun.go; 117 LoC

Found a possible issue in [algorand/go-algorand](https://www.github.com/algorand/go-algorand) at [daemon/algod/api/server/v2/dryrun.go](https://github.com/algorand/go-algorand/blob/c17ef9bc5dab5b98a9eb863b5c316aa06df69c27/daemon/algod/api/server/v2/dryrun.go#L406-L522)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first issue it finds, so please do not limit your consideration to the contents of the below message.

> reference to stxn was used in a composite literal at line 408

[Click here to see the code in its original context.](https://github.com/algorand/go-algorand/blob/c17ef9bc5dab5b98a9eb863b5c316aa06df69c27/daemon/algod/api/server/v2/dryrun.go#L406-L522)

Click here to show the 117 line(s) of Go which triggered the analyzer.

```go
for ti, stxn := range dr.Txns {
ep := logic.EvalParams{
Txn: &stxn,
Proto: proto,
TxnGroup: dr.Txns,
GroupIndex: ti,
//Logger: nil, // TODO: capture logs, send them back
}
var result generated.DryrunTxnResult
if len(stxn.Lsig.Logic) > 0 {
var debug dryrunDebugReceiver
ep.Debugger = &debug
pass, err := logic.Eval(stxn.Lsig.Logic, ep)
var messages []string
result.Disassembly = debug.lines
result.LogicSigTrace = &debug.history
if pass {
messages = append(messages, "PASS")
} else {
messages = append(messages, "REJECT")
}
if err != nil {
messages = append(messages, err.Error())
}
result.LogicSigMessages = &messages
}
if stxn.Txn.Type == protocol.ApplicationCallTx {
appIdx := stxn.Txn.ApplicationID
if appIdx == 0 {
creator := stxn.Txn.Sender.String()
// check and use the first entry in dr.Apps
if len(dr.Apps) > 0 && dr.Apps[0].Params.Creator == creator {
appIdx = basics.AppIndex(dr.Apps[0].Id)
}
}
if stxn.Txn.OnCompletion == transactions.OptInOC {
if idx, ok := dl.accountsIn[stxn.Txn.Sender]; ok {
acct := dl.dr.Accounts[idx]
var ad basics.AccountData
if ad, err = AccountToAccountData(&acct); err != nil {
response.Error = err.Error()
return
}
if ad.AppLocalStates == nil {
ad.AppLocalStates = make(map[basics.AppIndex]basics.AppLocalState)
}
ad.AppLocalStates[appIdx] = basics.AppLocalState{KeyValue: make(basics.TealKeyValue)}
dl.accounts[stxn.Txn.Sender] = basics.BalanceRecord{Addr: stxn.Txn.Sender, AccountData: ad}
}
}

l, err := makeAppLedger(&dl, &stxn.Txn, appIdx)
if err != nil {
response.Error = err.Error()
return
}
ep.Ledger = l
var app basics.AppParams
ok := false
for _, appt := range dr.Apps {
if appt.Id == uint64(appIdx) {
app, err = ApplicationParamsToAppParams(&appt.Params)
if err != nil {
response.Error = err.Error()
return
}
ok = true
break
}
}
var messages []string
if !ok {
messages = make([]string, 1)
messages[0] = fmt.Sprintf("uploaded state did not include app id %d referenced in txn[%d]", appIdx, ti)
} else {
var debug dryrunDebugReceiver
ep.Debugger = &debug
var program []byte
messages = make([]string, 1)
if stxn.Txn.OnCompletion == transactions.ClearStateOC {
program = app.ClearStateProgram
messages[0] = "ClearStateProgram"
} else {
program = app.ApprovalProgram
messages[0] = "ApprovalProgram"
}
pass, delta, err := logic.EvalStateful(program, ep)
result.Disassembly = debug.lines
result.AppCallTrace = &debug.history
result.GlobalDelta = StateDeltaToStateDelta(delta.GlobalDelta)
if len(delta.LocalDeltas) > 0 {
localDeltas := make([]generated.AccountStateDelta, len(delta.LocalDeltas))
for k, v := range delta.LocalDeltas {
ldaddr, err := stxn.Txn.AddressByIndex(k, stxn.Txn.Sender)
if err != nil {
messages = append(messages, err.Error())
}
localDeltas = append(localDeltas, generated.AccountStateDelta{
Address: ldaddr.String(),
Delta: *StateDeltaToStateDelta(v),
})
}
result.LocalDeltas = &localDeltas
}
if pass {
messages = append(messages, "PASS")
} else {
messages = append(messages, "REJECT")
}
if err != nil {
messages = append(messages, err.Error())
}
}
result.AppCallMessages = &messages
}
response.Txns[ti] = result
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: c17ef9bc5dab5b98a9eb863b5c316aa06df69c27