search

eth-sri / securify

[DEPRECATED] Security Scanner for Ethereum Smart Contracts
Apache License 2.0
215 stars 50 forks source link

Improve Memory Tagging #44

Open ritzdorf opened 5 years ago

ritzdorf commented 5 years ago

Memory tagging needs to be improved for certain opcodes including ReturnDataCopy and CallDataCopy.

Reference: https://github.com/eth-sri/securify/blob/master/src/main/java/ch/securify/analysis/AbstractDataflow.java#L472

Example:

No MissingInputValidation here:

contract SimpleBank {
    bytes32 x;
    function withdraw(bytes  memory a) public {
        x = keccak256(a);
    }
}

but it is detected if a non-dynamic data type is used.