Adds two new detectors AnyoneCanUpdate and AnyoneCanDelete.
The current CanUpdate detector reports paths that allow updating the application. CanUpdate does not consider any other details, for example, it does not consider if the transaction sender is checked to be an admin address or not. CanUpdate detector is more like is-updatable detector.
Similarly, CanDelete checks if it is possible to delete the application. It does not consider whether the contract is protected by other validations and access controls. CanDelete is is-deletable detector.
New detectors AnyoneCanUpdate and AnyoneCanDelete report paths that allow updating/deleting the application AND for which the transaction sender can be ANY address.
The workflow of AnyoneCanUpdate detector can be considered as:
Find is-updatable paths: execution paths that allow updating the applications
For each of is-updatable path, check if transaction sender is compared against SOME address. If transaction sender is not validated i.e it can be any address Then report the path.
The same goes for the AnyoneCanDelete detector:
find is-deletable paths
check if the transaction sender is validated for each of them.
if not validated report the path.
TODO: determine if it is better to rename current CanUpdate to IsUpdatable, CanDelete to IsDeletable. And AnyoneCanUpdate to CanUpdate, AnyoneCanDelete to CanDelete.
Adds two new detectors AnyoneCanUpdate and AnyoneCanDelete.
The current CanUpdate detector reports paths that allow updating the application. CanUpdate does not consider any other details, for example, it does not consider if the transaction sender is checked to be an admin address or not. CanUpdate detector is more like is-updatable detector.
Similarly, CanDelete checks if it is possible to delete the application. It does not consider whether the contract is protected by other validations and access controls. CanDelete is is-deletable detector.
New detectors AnyoneCanUpdate and AnyoneCanDelete report paths that allow updating/deleting the application AND for which the transaction sender can be ANY address.
The workflow of AnyoneCanUpdate detector can be considered as:
The same goes for the AnyoneCanDelete detector:
TODO: determine if it is better to rename current
CanUpdate
toIsUpdatable
,CanDelete
toIsDeletable
. AndAnyoneCanUpdate
toCanUpdate
,AnyoneCanDelete
toCanDelete
.