crytic / slither

Static Analyzer for Solidity and Vyper
https://blog.trailofbits.com/2018/10/19/slither-a-solidity-static-analysis-framework/
GNU Affero General Public License v3.0
5.27k stars 964 forks source link

slither-constellation / slither-composability: create a mapping of connected contracts #1353

Open montyly opened 2 years ago

montyly commented 2 years ago

We can extend what we did with slither-read-storage to create a graph of contracts that are connected to each others:

We might need to limit the iteration in case the graph is becoming too large. We could also have different types of edges (to highlight the type of calls, transfer of funds, etc..).

We might need some heuristics, or user configuration, for array/mapping, in case there are too many elements to check.

plotchy commented 2 years ago

A test contract full of abundance for one-level deeper (also grabbing & iterating on addresses in storage) is UniswapV2Factory.

If you'd like to experiment with reading mappings w/o replaying historical txs or relying on event gathering to find mapping keys, using a tool like erigon-db to walk_storage() can provide results for you.