search

code-423n4 / 2021-07-sherlock-findings

0 stars 0 forks source link

[NativeLock.sol] Local Variables shadowing other variables #57

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

eriksal1217

Vulnerability details

Impact

Low Risk Vulnerability - This does not immediately affect transfers or funds of the user but can lead to misuse of functionality in the contract which can lead to improper implementation during development.

Proof of Concept

According to the Slither analyzer documentation (https://github.com/crytic/slither/wiki/Detector-Documentation#local-variable-shadowing), the misuse of variables is entirely possible in this case because the name of local variables are the same as the variables being imported from node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol, in this case.

They should be renamed in order to mitigate incorrect usage during development and implementation.

Code snippet:

  1. NativeLock.constructor(string,string,IERC20)._name

contract NativeLock is ERC20, ILock, Ownable { IERC20 public override underlying;

constructor( string memory _name, ... } <---- Shadowing

(contracts/NativeLock.sol#17)

shadows:

(node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#42)

  1. NativeLock.constructor(string,string,IERC20)._symbol

contract NativeLock is ERC20, ILock, Ownable { IERC20 public override underlying;

constructor( string memory _name, string memory _symbol, ... } <---- Shadowing

(contracts/NativeLock.sol#18)

shadows:

(node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#43)

Console Output (Slither Analyzer):

ForeignLock.constructor(string,string,IERC20,IERC20)._name (contracts/ForeignLock.sol#17) shadows:

ForeignLock.constructor(string,string,IERC20,IERC20)._symbol (contracts/ForeignLock.sol#18) shadows:

NativeLock.constructor(string,string,IERC20)._name (contracts/NativeLock.sol#17) shadows:

NativeLock.constructor(string,string,IERC20)._symbol (contracts/NativeLock.sol#18) shadows:

Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#local-variable-shadowing

Tools Used

Sherlock Contracts Solidity (v 0.7.4) Slither Analyzer (v 0.8.0)

Recommended Mitigation Steps

  1. Clone repository for Sherlock Smart Contracts
  2. Create a python virtual environment with a stable python version
  3. Install Slither Analyzer on the python VEM
  4. Run Slither against all contracts
Evert0x commented 3 years ago

56

ghoul-sol commented 3 years ago

duplicate from the same warden, invalid