crytic / tealer

Static Analyzer for Teal
GNU Affero General Public License v3.0
62 stars 14 forks source link

Add anyone can update/delete detectors #138

Closed S3v3ru5 closed 1 year ago

S3v3ru5 commented 1 year ago

Adds two new detectors AnyoneCanUpdate and AnyoneCanDelete.

The current CanUpdate detector reports paths that allow updating the application. CanUpdate does not consider any other details, for example, it does not consider if the transaction sender is checked to be an admin address or not. CanUpdate detector is more like is-updatable detector.

Similarly, CanDelete checks if it is possible to delete the application. It does not consider whether the contract is protected by other validations and access controls. CanDelete is is-deletable detector.

New detectors AnyoneCanUpdate and AnyoneCanDelete report paths that allow updating/deleting the application AND for which the transaction sender can be ANY address.

The workflow of AnyoneCanUpdate detector can be considered as:

The same goes for the AnyoneCanDelete detector:

TODO: determine if it is better to rename current CanUpdate to IsUpdatable, CanDelete to IsDeletable. And AnyoneCanUpdate to CanUpdate, AnyoneCanDelete to CanDelete.

S3v3ru5 commented 1 year ago

Builds on #136

montyly commented 1 year ago

Will be merge into dev directly once #129 is merged