Skip to content

Use storage key from function parameter detector #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Use storage key from function parameter detector #10

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions detectors/metadata/use-storage-key-from-function-parameter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
metadata:
id: use-storage-key-from-function-parameter
uid: y7XzWq
description: Detects smart contracts that use a storage key derived from a function parameter, which can lead to unexpected behavior and security vulnerabilities. It is crucial to ensure that storage keys are derived from secure and predictable sources.
report:
severity: high
tags:
- audit
- reportable
template:
title: Storage Key Derived from Function Parameter Detected
opening: Smart contracts should avoid using storage keys derived from function parameters, as this can lead to unexpected behavior and potential security vulnerabilities. Storage keys should be derived from secure and predictable sources to ensure the integrity of the contract's state.
body-single-file-single-instance: In `$file_name`, the function `$FUNCTION_NAME` in contract `$CONTRACT_NAME` uses a storage key derived from a function parameter.
body-single-file-multiple-instance: In `$file_name`, multiple functions use storage keys derived from function parameters.
body-multiple-file-multiple-instance: Across $total_files files, multiple functions use storage keys derived from function parameters.
body-list-item-intro: 'The following functions were found using storage keys derived from function parameters:'
body-list-item-single-file: '- Function `$FUNCTION_NAME` in Contract `$CONTRACT_NAME` in [`$file_name`]($instance_line_link)'
body-list-item-multiple-file: '- Function `$FUNCTION_NAME` in Contract `$CONTRACT_NAME` in [`$file_name`]($instance_line_link)'
closing: To ensure proper functionality and usability, avoid using storage keys derived from function parameters. Review the identified functions and refactor the code to derive storage keys from secure and predictable sources.