crytic / slither

Static Analyzer for Solidity and Vyper
https://blog.trailofbits.com/2018/10/19/slither-a-solidity-static-analysis-framework/
GNU Affero General Public License v3.0
5.33k stars 968 forks source link

Flattening and etherscan upload #253

Closed montyly closed 5 years ago

montyly commented 5 years ago

Slither should be able to flatten any codebase and upload it to the etherscan verified contracts database, through their API

One caveat is to support aliasing of import

montyly commented 5 years ago

Task Description

The goal is to create a new utility (ex: slither-upload-etherscan) that will:

The utility guideline shows how to create new utility.

Acceptance criteria

A nice to have feature is the handling of import aliasing.

Required Skill

No experience with Slither is required, but it would be a plus

Feel free to ask questions here, or join our slack (#ethereum)

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done


This issue now has a funding of 150.0 DAI (150.0 USD @ $1.0/DAI) attached to it.

Skyge commented 5 years ago

I am not sure, but for some have been verified contracts, they upload repeated pragma statements, such like this one: cDAI so we want to remove these, Whether these have influence or not?

montyly commented 5 years ago

Hi @Skyge,

Thank you for your interest in this work.

It's a good question. After some thinking, maybe we can offer an option like --clean-code that will for now, remove the unnecessary pragma statements. In the long run, this option could do other modifications, like re-ordering the contracts to improve the readability, etc.

Does that make sense?

Skyge commented 5 years ago

OK, I see. That sounds good.

spm32 commented 5 years ago

Hi @Skyge do you still have some time to take this one on, how's it going?

Skyge commented 5 years ago

@ceresstation Yeah, sorry for my delaying, I will finish this in three weeks.

gitcoinbot commented 5 years ago

@skyge Hello from Gitcoin Core - are you still working on this issue? Please submit a WIP PR or comment back within the next 3 days or you will be removed from this ticket and it will be returned to an ‘Open’ status. Please let us know if you have questions!

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

Skyge commented 5 years ago

Hi, I want to find a file to save etherscan api key by this approach:

import os
os.environ['ETHERSCAN_API] = xxx

so which one has existed is suitable, if not, I will create a new file, or we would like to use some packages, such as python-dotenv or something else to do this in the .env.

montyly commented 5 years ago

Hi @Skyge ,

That's a potential solution, but I would favor another approach:

I would favor the use of the interactive mode, to prevent the write of the key locally. Only people uploading frequently to etherscan should have to save the key.

Skyge commented 5 years ago

@montyly Emmm, but when we verify the contract by the etherscan api, we need some config message, such as, compilerversion, optimizationUsed, constructorArguements and so on, so if we use the interactive mode, the user really needs to type these necessary parameters, so I think maybe we can use a config file to add these config parameters. so what's your final recommendation?

gitcoinbot commented 5 years ago

@skyge Hello from Gitcoin Core - are you still working on this issue? Please submit a WIP PR or comment back within the next 3 days or you will be removed from this ticket and it will be returned to an ‘Open’ status. Please let us know if you have questions!

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

Skyge commented 5 years ago

I made a temporary pr, it has not been finished totally.

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done


@skyge due to inactivity, we have escalated this issue to Gitcoin's moderation team. Let us know if you believe this has been done in error!

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

marcusrbrown commented 5 years ago

Since this appears to be completd, would you mind closing out the bounty on Gitcoin?

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Cancelled


The funding of 150.0 DAI (150.0 USD @ $1.0/DAI) attached to this issue has been cancelled by the bounty submitter