Open RickVM opened 7 months ago
What is in apps/contracts/security-scans/slither/results/TimePieceEscrow/TimePieceEscrow-Slither.result
? And how does your analysis-config.toml
look?
But from the error message it seems that path to security scanner/slither/slither.config.json
can't be found. This file exists and is updated during execution. Before running slither.
You could try adding the following lines in security-scans/slither/slither_runner/src/lib.rs
before line 39
:
println!("\nslither_config_path: {slither_config_path}\n");
println!("\nslither_config_tmp_path: {slither_config_tmp_path}\n");
I guess that in your case you need to use:
yarn --cwd ./ run scan:generate-report \
/Users/rick/Documents/projects/openchrono/apps/contracts/ \
./ \
/Users/rick/Documents/projects/openchrono/apps/contracts/analysis-config.toml
I was able to create slither reports (see report-openchrono-slither.zip). However, I had to update the docker file (Dockerfile.analysisToolbox
) a bit. Since the Byont analysis-toolbox image was only build for apple silicon and building it from scratch gave from build problems. So I commented out the base-ubuntu-tooling-z3-solc-kevm
part, the # Install Mythril
part and updated SLITHER_VERSION
to 0.10.0
. I also updated SOLC_VERSION
to 0.8.23
but I don't know if that was really needed.
With SLITHER_VERSION=0.9.2
I got the following error when running slither: slither.exceptions.SlitherException: unresolved reference to identifier INITIALIZABLE_STORAGE
.
This is my apps/contracts/analysis-config.toml
:
[environment]
security_scans_rel_path = "./security-scans"
source_rel_path = "./src"
remappings = [
"ds-test/=libs/forge-std/lib/ds-test/src/",
"@openzeppelin/contracts-upgradeable/=libs/openzeppelin-contracts-upgradeable/contracts/",
"@openzeppelin/contracts/=libs/openzeppelin-contracts/contracts/",
"@openzeppelin/foundry-upgrades/=libs/openzeppelin-foundry-upgrades/src/",
"@contracts/=src/",
"@interfaces/=src/interfaces/",
"ds-test/=libs/ds-test/src/",
"forge-std/=libs/forge-std/src/"
]
solc_version = "0.8.23"
[report]
report_output_rel_path = "./report"
[[report.contract]]
name = "TimePieceEscrow"
report_custom_name = ""
[[report.contract]]
name = "TimePiecePayments"
report_custom_name = ""
[[report.contract]]
name = "TimePiecePassport"
report_custom_name = ""
[mythril]
enabled = false
[slither]
enabled = true
[smtchecker]
enabled = false
[kevm]
enabled = false
kevm_spec_rel_path = "./kevm-specs"
This example is for the openchrono repo
cd src/apps/contracts
git submodule add git@github.com:Byont-Ventures/smart-contract-analysis-tools.git security-scans
Result: