Comments (4)
We have never implemented it because it requires precise value range analysis which is slow and even then still prone to false positives. I don't think a tool like slither is the best way to identify overflows compared to something like a sanitizer in debug versions of solc paired with a fuzzer
from slither.
I wonder if there might be a middle ground that leverages Slither's capabilities without compromising its performance and accuracy.
For instance, Instead of a full range analysis, could we implement a more basic detector that flags only clear-cut cases of potential overflows and underflows? This detector could serve as an initial check, with more complex scenarios left for dynamic analysis tools as you suggested.
from slither.
You're welcome to give it a shot! It may be possible to flag exclusively overflows that will definitely occur like if (x > y) { unchecked { y - x }};
i.e. the detector would only identify true positives and allow false negatives.
This functionality could also be built on top of slither as an extension and not as a detector. Then, it could use something like an SMT solver and find counterexamples that demonstrate an overflow can occur.
Fwiw we are planning to remove (or not run by default) noisy detectors after benchmarking in the near future.
from slither.
Okay, I'd like to proceed with its development. Just wanted make sure, if this was the right process before i attempt to make any sort of contribution. I'd like to build an exclusive overflow detector to only flag clear-cut cases. :)
from slither.
Related Issues (20)
- [Bug- Candidate]: Failed to generate IR HOT 1
- [Bug]: ERROR:root:Top level EventDefinition not supported HOT 5
- [Bug-Candidate]: Fail to scan in a project that supports both Hardhat and Foundry, keeps deleting the `build-info` folder when `slither .` is used HOT 7
- Monthly issue metrics report
- [Bug]: ERROR:ContractSolcParsing when using same alias for import HOT 2
- [Bug-Candidate]: ERROR:SlitherSolcParsing HOT 2
- [Bug]: detector `unused-import` mistakes the interface inheritance HOT 1
- Monthly issue metrics report
- [Bug]: ERROR:SlitherSolcParsing: Failed to convert IR to SSA for EnumerableSetLib contract. HOT 5
- optimize and make sure unused-imports is accurate HOT 1
- [Bug]: info from `solc-version` detector displays misleading message HOT 4
- slither fails to resolve imports in dependency due to issue in foundry HOT 2
- Typo in Wiki about 'Dead-code' HOT 2
- [Bug-Candidate]: ERROR:SlitherSolcParsing: assert isinstance(right, TupleVariable) AssertionError HOT 1
- [Bug-Candidate]: redundant control flow edge after try block HOT 2
- [Bug-Candidate]: Failed to convert IR to SSA for Initializable contract. HOT 2
- add test that results are sorted by impact and able to be filtered
- [False-Positive]: dead-code
- [Bug-Candidate]: `--solc-ast` flag does nothing and all HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from slither.