Sother

Sother is a Solidity static analyzer base on Slither and aggregates most of Falcon's detectors.

Install

poetry install

Usage

detect vulnerability and print default markdown:

sother ./solidity --print markdown

Detectors stat

------ All ------
High: 34
Medium: 47
Low: 52
Informational: 28
Optimization: 50
Total: 211

------ Sother ------
High: 2
Medium: 18
Low: 35
Informational: 5
Optimization: 45
Total: 105

------ Slither ------
High: 27
Medium: 21
Low: 14
Informational: 21
Optimization: 5
Total: 88

------ Falcon ------
High: 24
Medium: 20
Low: 11
Informational: 16
Optimization: 2
Total: 73

Detectors list

Num	Check	What it Detects	Impact	Confidence
1	abiencoderv2-array	Storage abiencoderv2 array	High	High
2	arbitrary-send-erc20	transferFrom uses arbitrary `from`	High	High
3	array-by-reference	Modifying storage array by value	High	High
4	incorrect-constructor-name	https://swcregistry.io/docs/SWC-118	High	High
5	incorrect-shift	The order of parameters in a shift instruction is incorrect.	High	High
6	integer-underflow	contract needs to check if the function input incase of integer underflow or overflow	High	High
7	multiple-constructors	Multiple constructor schemes	High	High
8	name-reused	Contract's name reused	High	High
9	protected-vars	Detected unprotected variables	High	High
10	public-mappings-nested	Public mappings with nested variables	High	High
11	rtlo	Right-To-Left-Override control character is used	High	High
12	shadowing-state	State variables shadowing	High	High
13	sig-replay-attacks-protection	SWC-121: Missing Protection Against Signature Replay Attacks	High	High
14	state-variable-not-initialized	Detect that state variable not initialized and not written in contract but be used in contract	High	High
15	suicidal	Functions allowing anyone to destruct the contract	High	High
16	unchecked-ecrecover	return value of 0 from `ecrecover` not checked	High	High
17	uninitialized-state	Uninitialized state variables	High	High
18	uninitialized-storage	Uninitialized storage variables	High	High
19	unprotected-ether-withdrawal	https://swcregistry.io/docs/SWC-105	High	High
20	unprotected-upgrade	Unprotected upgradeable contract	High	High
21	codex	Use Codex to find vulnerabilities.	High	Low
22	arbitrary-send-erc20-permit	transferFrom uses arbitrary from with permit	High	Medium
23	arbitrary-send-eth	Functions that send Ether to arbitrary destinations	High	Medium
24	controlled-array-length	Tainted array length assignment	High	Medium
25	controlled-delegatecall	Controlled delegatecall destination	High	Medium
26	defi-action-nested	transferFrom uses arbitrary from with permit	High	Medium
27	delegatecall-loop	Payable functions using `delegatecall` inside a loop	High	Medium
28	modifier-unsafe	Modifier Unsafe	High	Medium
29	msg-value-loop	msg.value inside a loop	High	Medium
30	reentrancy-eth	Reentrancy vulnerabilities (theft of ethers)	High	Medium
31	signature-malleability	https://swcregistry.io/docs/SWC-117	High	Medium
32	storage-array	Signed storage integer array compiler bug	High	Medium
33	weak-prng	Weak PRNG	High	Medium
34	constant-result	Tautology Fixed	Medium	High
35	deprecated-approve	`Approve` Race Condition	Medium	High
36	deprecated-chainlink	Usage of deprecated ChainLink APIs	Medium	High
37	domain-separator-collision	Detects ERC20 tokens that have a function whose signature collides with EIP-2612's DOMAIN_SEPARATOR()	Medium	High
38	enum-conversion	Detect dangerous enum conversion	Medium	High
39	erc20-interface	Incorrect ERC20 interfaces	Medium	High
40	erc721-interface	Incorrect ERC721 interfaces	Medium	High
41	hardcode-gas-amount	https://swcregistry.io/docs/SWC-134	Medium	High
42	ignored-chainlink-returns	`latestRoundData` returns has been ignored	Medium	High
43	incorrect-equality	Dangerous strict equalities	Medium	High
44	integer-overflow	contract needs to check if the function input incase of integer underflow or overflow	Medium	High
45	invalid-array-deletion	Deletion on array containing a structure	Medium	High
46	lack-deadline-in-uniswap	Lack of deadline for Uniswap AMM	Medium	High
47	lack-slippage-protection	Lack of slippage protection can lead to significant loss of user funds	Medium	High
48	locked-ether	Contracts that lock ether	Medium	High
49	mapping-deletion	Deletion on mapping containing a structure	Medium	High
50	missing-gap-state-variable	Upgradeable contract is missing a `__gap` storage variable to allow for new storage variables in later versions	Medium	High
51	owner-centralization	The owner is a single point of failure and a centralization risk	Medium	High
52	shadowing-abstract	State variables shadowing from abstract contracts	Medium	High
53	tautology	Tautology or contradiction	Medium	High
54	unchecked-chainlink-round	Unchecked return data `roundId` from Chainlink aggregators	Medium	High
55	unchecked-chainlink-staleness	`latestRoundData` might return stale results	Medium	High
56	unsafe-transfer	Unsafe use of `transfer()/transferFrom()` with IERC20	Medium	High
57	void-function	Function not implemented	Medium	High
58	write-after-write	Unused write	Medium	High
59	arbitrary-storage-location	https://swcregistry.io/docs/SWC-124	Medium	Low
60	for-continue-increment	Loop might turn out infinite	Medium	Low
61	tx-gas-price-warning	The contract uses tx.gasprice variable	Medium	Low
62	boolean-cst	Misuse of Boolean constant	Medium	Medium
63	bytes-variables-risk	Contract respects e standard	Medium	Medium
64	constant-function-asm	Constant functions using assembly code	Medium	Medium
65	constant-function-state	Constant functions changing the state	Medium	Medium
66	divide-before-multiply	Imprecise arithmetic operations order	Medium	Medium
67	fee-on-transfer	Incompatibility with transfer-on-fee or deflationary tokens	Medium	Medium
68	functiontype-var	contract needs to check if there are function type variable to avoid Arbitrary Jump with Function Type Variable	Medium	Medium
69	public-mint-burn		Medium	Medium
70	reentrancy-no-eth	Reentrancy vulnerabilities (no theft of ethers)	Medium	Medium
71	reused-constructor	Reused base constructor	Medium	Medium
72	transfer-in-loop	ether transfer inside a loop	Medium	Medium
73	tx-origin	Dangerous usage of `tx.origin`	Medium	Medium
74	unchecked-lowlevel	Unchecked low-level calls	Medium	Medium
75	unchecked-send	Unchecked send	Medium	Medium
76	unchecked-transfer	Return values of `transfer()/transferFrom()` not checked	Medium	Medium
77	uninitialized-local	Uninitialized local variables	Medium	Medium
78	unsafe-721-mint	Use `_safeMint` instead of `_mint` for ERC721	Medium	Medium
79	unsafe-721-transfer	Using `ERC721.transferFrom()` may cause the user's NFT to be frozen in a contract that does not support ERC721	Medium	Medium
80	unused-return	Unused return values	Medium	Medium
81	deprecated-assert	`revert CustomError()` should be used instead of `assert()`	Low	High
82	deprecated-ownable	Lack of a double-step `transferOwnership()` pattern	Low	High
83	deprecated-safe-approve	`safeApprove()` is deprecated due to `Approve` Race Condition	Low	High
84	division-by-zero	Division by zero not prevented	Low	High
85	encode-packed-collision	ABI encodePacked Collision	Low	High
86	external-calls-in-loop	External calls in an un-bounded `for-`loop may result in a DOS	Low	High
87	incorrect-deadline	Incorrect EIP-2612 deadline check	Low	High
88	incorrect-modifier	Modifiers that can return the default value	Low	High
89	missing-erc721-received	`onERC721Received` not implemented in ERC721 received contract	Low	High
90	missing-sender-in-event	Events are missing sender information	Low	High
91	missing-supports-interface	Missing `supportsInterface` functions	Low	High
92	non-compliant-erc721	NFT token do not comply with `ERC721`, breaking composability	Low	High
93	open-todos	OPEN TODOs	Low	High
94	payable-calls	Don't use `payable.transfer()`/`payable.send()`	Low	High
95	reentrancy-send-value	Missing Reentrancy-Guard when using `sendValue` from OZ's `Address.sol`	Low	High
96	reentrancy-transfer	Functions calling contracts/addresses with transfer hooks are missing reentrancy guards	Low	High
97	revert-on-approve-max	Approve `type(uint256).max` not work with some tokens	Low	High
98	revert-on-total-supply	Calls will revert when `totalSupply()` returns zero	Low	High
99	shadowing-builtin	Built-in symbol shadowing	Low	High
100	shadowing-local	Local variables shadowing	Low	High
101	susceptible-ecrecover	Direct usage of `ecrecover` allows signature malleability	Low	High
102	unchecked-array-length	Missing array length check when inputting multiple arrays	Low	High
103	unchecked-erc721-received	`onERC721Received` callback is never called when new tokens are minted or transferred	Low	High
104	unchecked-setters	Setters should check the input value	Low	High
105	unchecked-token-id	`tokenURI()` does not follow EIP-721	Low	High
106	uninitialized-fptr-cst	Uninitialized function pointer calls in constructors	Low	High
107	unnecessary-reentrancy-guard	Function not implemented	Low	High
108	unprotected-nft-fork	NFT doesn't handle hard forks	Low	High
109	unprotected-upgrade-front-run	Use `disableInitializers` to prevent front-running on the initialize function	Low	High
110	unsafe-assembly	Storage Write Removal Bug On Conditional Early Termination	Low	High
111	unsafe-double-cast	Double type casts create complexity within the code	Low	High
112	unsafe-downcast	Unsafe downcasting arithmetic operation	Low	High
113	unsafe-floating-pragma	Unsafe to use floating pragma	Low	High
114	unsafe-solmate-transfer-lib	Solmate's `SafeTransferLib` doesn't check whether the ERC20 contract exists	Low	High
115	unsafe-tx-origin	Use of `tx.origin` is unsafe in almost every context	Low	High
116	unsupported-decimals-token	Unsafe calls to optional ERC20 functions:`decimals()`/`name()`/`symbol()`	Low	High
117	unused-upgradeable-counterparts	Contracts are not using their OZ Upgradeable counterparts	Low	High
118	upgradeable-uninitialized	Upgradeable contracts are not initialized	Low	High
119	variable-scope	Local variables used prior their declaration	Low	High
120	void-cst	Constructor called not implemented	Low	High
121	pess-only-eoa-check	msg.sender == tx.origin	Low	Low
122	calls-loop	Multiple calls in a loop	Low	Medium
123	events-access	Missing Events Access Control	Low	Medium
124	events-maths	Missing Events Arithmetic	Low	Medium
125	incorrect-unary	Dangerous unary expressions	Low	Medium
126	initialize-permission	initialize method should has permission check	Low	Medium
127	input-validation	input validation	Low	Medium
128	missing-zero-check	Missing Zero Address Validation	Low	Medium
129	pess-event-setter	Contract function does not emit event after the value is set	Low	Medium
130	reentrancy-benign	Benign reentrancy vulnerabilities	Low	Medium
131	reentrancy-events	Reentrancy vulnerabilities leading to out-of-order Events	Low	Medium
132	timestamp	Dangerous usage of `block.timestamp`	Low	Medium
133	assembly	Assembly usage	Informational	High
134	assert-state-change	Assert state change	Informational	High
135	cyclomatic-complexity	Detects functions with high (> 11) cyclomatic complexity	Informational	High
136	deprecated-standards	Deprecated Solidity Standards	Informational	High
137	erc20-indexed	Un-indexed ERC20 event parameters	Informational	High
138	function-init-state	Function initializing state variables	Informational	High
139	immutable-in-upgradeable	Immutable variables used in upgradable contracts may cause DoS	Informational	High
140	low-level-calls	Low level calls	Informational	High
141	missing-inheritance	Missing inheritance	Informational	High
142	missing-msg-in-require	Missing Error Messages in `require/revert` Statements	Informational	High
143	naming-convention	Conformity to Solidity naming conventions	Informational	High
144	no-license	No SPDX license identifier	Informational	High
145	obsolete-use	Deprecated Solidity Standards	Informational	High
146	pragma	If different pragma directives are used	Informational	High
147	redundant-statements	Redundant statements	Informational	High
148	slither-incorrect-using-for	Detects using-for statement usage when no function from a given library matches a given type	Informational	High
149	solc-version	Incorrect Solidity version	Informational	High
150	unimplemented-functions	Unimplemented functions	Informational	High
151	unnecessary-public-function-modifier	Unnecessary Public Function and can be replaced with external	Informational	High
152	unused-event	Unused events	Informational	High
153	upgrade-to-latest	Should use latest solidity version	Informational	High
154	using-for-any-type	Using for any type '*'	Informational	Informational
155	costly-loop	Costly operations in a loop	Informational	Medium
156	error-msg	Code style required	Informational	Medium
157	reentrancy-unlimited-gas	Reentrancy vulnerabilities through send and transfer	Informational	Medium
158	similar-names	Variable names are too similar	Informational	Medium
159	too-many-digits	Conformance to numeric notation best practices	Informational	Medium
160	uncontrolled-resource-consumption	https://swcregistry.io/docs/SWC-128	Informational	Medium
161	array-length-in-loop	Cache the `<array>.length` for the loop condition	Optimization	High
162	assembly-update-address	Use `assembly` to write address storage values	Optimization	High
163	assignment-left-operation	`<x> += <y>` costs more gas than `<x> = <x> + <y>` for state variables	Optimization	High
164	bool-state-variables	Use `uint256(1)/uint256(2)` instead for `true` and `false` boolean states	Optimization	High
165	boolean-equal	Don't compare booleans to `true` or `false`	Optimization	High
166	cache-call-function-result	The result of function calls should be cached rather than re-calling the function	Optimization	High
167	constable-states	State variables that could be declared constant	Optimization	High
168	dead-code	Functions that are not used	Optimization	High
169	divide-by-constant	Using `x >> constant(uint)` with the right shift operator is a more gas-efficient	Optimization	High
170	empty-block	Empty blocks should be removed or emit something	Optimization	High
171	external-function	Public function that could be declared external	Optimization	High
172	fetch-storage-to-memory	Using `storage` instead of `memory` for structs/arrays saves gas	Optimization	High
173	immutable-states	State variables that could be declared immutable	Optimization	High
174	inefficient-new-bytes	Expression `""` is cheaper than `new bytes(0)`	Optimization	High
175	internal-function-to-inline	`internal` functions only called once can be inlined to save gas	Optimization	High
176	memory-in-parameters	Use `calldata` instead of `memory` for function parameters	Optimization	High
177	mul-power-two	Multiplications of powers of 2 can be replaced by a left shift operation to save gas	Optimization	High
178	multiple-address-mappings	Multiple address `mappings` can be combined into a single `mapping`	Optimization	High
179	operator-and-in-require	Splitting `&&` in `require()` statements to saves gas	Optimization	High
180	payable-constructor	Setting the constructor to `payable`	Optimization	High
181	payable-function	Functions guaranteed to revert when called by normal users can be marked `payable`	Optimization	High
182	pre-plus-plus	`++i` costs less gas than `i++`, especially when it's used in for-loops (`--i/i--` too)	Optimization	High
183	public-to-private-constant	Using `private` rather than `public` for constants, saves gas	Optimization	High
184	reread-state-variables	Cache state variables instead of rereading	Optimization	High
185	revert-long-strings	Shortening revert strings to fit in 32 `bytes`	Optimization	High
186	safe-math-lib	Don't use `SafeMath` if use solidity version `>=0.8.0`	Optimization	High
187	slither-cache-array-length	Detects `for` loops that use `length` member of some storage array in their loop condition and don't modify it.	Optimization	High
188	smaller-uint-int	Usage of `uints`/`ints` smaller than 32 bytes (256 bits) incurs overhead	Optimization	High
189	state-should-be-constant	State variables that could be declared constant	Optimization	High
190	string-constants	`Bytes` constants are more efficient than `string` constants	Optimization	High
191	superfluous-fields-event	Superfluous fields in event	Optimization	High
192	unchecked-in-loop	The increment `++i/i++` in `for-loop`/`while-loop` post condition can be made `unchecked{++i}/unchecked{i++}`	Optimization	High
193	unindexed-event	Use indexed events for value types as they are less costly compared to non-indexed ones	Optimization	High
194	unnecessary-reentrancy-lock	Unnecessary reentrancy lock in the function	Optimization	High
195	unsigned-int-compare-zero	`!= 0` is less gas than `> 0` for unsigned integers	Optimization	High
196	unused-error	Remove unused error definition	Optimization	High
197	unused-local-var	Remove unused local variables	Optimization	High
198	unused-named-return-variables	Not using the named return variables anywhere in the function is confusing	Optimization	High
199	unused-parameter	Remove unused parameter variables	Optimization	High
200	unused-state-variables	Remove or replace unused state variables	Optimization	High
201	unused-struct	Remove unused struct declaration	Optimization	High
202	use-assembly-balance	Use `balance(address)` instead of address.balance()	Optimization	High
203	use-concat-on-bytes	Use `bytes.concat()` on mixing bytes and strings instead of `abi.encodePacked()` to save gas	Optimization	High
204	use-concat-on-string	Use `string.concat()` on string instead of `abi.encodePacked()` to save gas	Optimization	High
205	use-delete-statement	Use `delete` to Clear Variables	Optimization	High
206	use-self-balance	Use `selfbalance()` instead of `address(this).balance`	Optimization	High
207	var-read-using-this	Contract reads its own variable using `this`	Optimization	High
208	zero-address-optimization	Use assembly to check for `address(0)`	Optimization	High
209	zero-check-with-transfer	Amounts should be checked for `0` before calling a `transfer`	Optimization	High
210	zero-initialized-state-variable	It costs more gas to initialize state variables to zero than to let the default of zero be applied	Optimization	High

0xxfu / sother Goto Github PK

sother's Introduction

Sother

Install

Usage

Detectors stat

Detectors list

sother's People

Contributors

Stargazers

Forkers

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent