@@ -4,6 +4,7 @@ var categories = require('./categories')
...
@@ -4,6 +4,7 @@ var categories = require('./categories')
varcommon=require('./staticAnalysisCommon')
varcommon=require('./staticAnalysisCommon')
varfcallGraph=require('./functionCallGraph')
varfcallGraph=require('./functionCallGraph')
varAbstractAst=require('./abstractAstView')
varAbstractAst=require('./abstractAstView')
varyo=require('yo-yo')
functionchecksEffectsInteraction(){
functionchecksEffectsInteraction(){
this.abstractAst=newAbstractAst()
this.abstractAst=newAbstractAst()
...
@@ -36,7 +37,7 @@ function report (contracts, multipleContractsWithSameName) {
...
@@ -36,7 +37,7 @@ function report (contracts, multipleContractsWithSameName) {
varcomments=(hasModifiers)?'<br/><i>Note:</i> Modifiers are currently not considered by this static analysis.':''
varcomments=(hasModifiers)?'<br/><i>Note:</i> Modifiers are currently not considered by this static analysis.':''
comments+=(multipleContractsWithSameName)?'<br/><i>Note:</i> Import aliases are currently not supported by this static analysis.':''
comments+=(multipleContractsWithSameName)?'<br/><i>Note:</i> Import aliases are currently not supported by this static analysis.':''
warnings.push({
warnings.push({
warning:`Potential Violation of Checks-Effects-Interaction pattern in <i>${funcName}</i>: Could potentially lead to re-entrancy vulnerability. ${comments}`,
warning:yo`<span>Potential Violation of Checks-Effects-Interaction pattern in <i>${funcName}</i>: Could potentially lead to re-entrancy vulnerability. ${comments}</span>`,
text=`use of "send": "send" does not throw an exception when not successful, make sure you deal with the failure case accordingly.
text=yo`<span>use of "send": "send" does not throw an exception when not successful, make sure you deal with the failure case accordingly.
Use "transfer" whenever failure of the ether transfer should rollback the whole transaction.
Use "transfer" whenever failure of the ether transfer should rollback the whole transaction.
Note: if you "send/transfer" ether to a contract the fallback function is called, the callees fallback function is very limited due to the limited amount of gas provided by "send/transfer".
Note: if you "send/transfer" ether to a contract the fallback function is called, the callees fallback function is very limited due to the limited amount of gas provided by "send/transfer".
No state changes are possible but the callee can log the event or revert the transfer. "send/transfer" is syntactic sugar for a "call" to the fallback function with 2300 gas and a specified ether value. <br />`
No state changes are possible but the callee can log the event or revert the transfer. "send/transfer" is syntactic sugar for a "call" to the fallback function with 2300 gas and a specified ether value. <br /></span>`
warning:`<i>${funcName}</i>: Variables have very similar names <i>${sim.var1}</i> and <i>${sim.var2}<i>. ${comments}`,
warning:yo`<span><i>${funcName}</i>: Variables have very similar names <i>${sim.var1}</i> and <i>${sim.var2}</i>. ${hasModifiersComments}${multipleContractsWithSameNameComments}</span>`,
warning:'Use of "this" for local functions: Never use this to call functions in the same contract, it only consumes more gas than normal local calls.',
warning:yo`<span>Use of "this" for local functions: Never use this to call functions in the same contract, it only consumes more gas than normal local calls.</span>`,
@@ -20,8 +21,8 @@ txOrigin.prototype.visit = function (node) {
...
@@ -20,8 +21,8 @@ txOrigin.prototype.visit = function (node) {
txOrigin.prototype.report=function(){
txOrigin.prototype.report=function(){
returnthis.txOriginNodes.map(function(item,i){
returnthis.txOriginNodes.map(function(item,i){
return{
return{
warning:`Use of tx.origin: "tx.origin" is useful only in very exceptional cases.<br />
warning:yo`<span>Use of tx.origin: "tx.origin" is useful only in very exceptional cases.<br />
If you use it for authentication, you usually want to replace it by "msg.sender", because otherwise any contract you call can act on your behalf.`,
If you use it for authentication, you usually want to replace it by "msg.sender", because otherwise any contract you call can act on your behalf.</span>`,