Cyfrin / aderyn

Aderyn 🦜 Rust-based Solidity AST analyzer.
https://docs.cyfrin.io/
GNU General Public License v2.0
368 stars 51 forks source link

Feature related Tech debt #682

Open TilakMaddy opened 3 weeks ago

TilakMaddy commented 3 weeks ago

Feature related technical debt in the codebases
(We'll open another one for refactoring related stuff)

Some points to remember

These were not taken good care of while writing the initial detectors.

  1. revert() and revert Error() are different. The former is a function call while the latter is a revert statement. We've skipped cases in many places.
  2. type strings can be address or address payable. We should handle both cases where necessary without skipping them.
  3. selfdestruct is fine, but we also have to handle suicide
  4. It's not enough to check .is_constructor, because for newer versions of solc, even for constructors that returns false, so you should check kind().
  5. Use callgraphs

Detectors

Dear open source community, if you are looking at this feel free to pick one up and send PRs :)

TilakMaddy commented 3 weeks ago

Regarding zero address check I think it's too subjective. Maybe something like, if there is an address parameter, as long as there is some type of binary check on the address it should be okay. What do you think @alexroan ?