Package: slitherin
Slitherin by Pessimistic.ioWelcome!We are thepessimistic.ioteam, and in recent months we have been actively developing ourownSlither detectorsto help with code review and audit process. This repository contains everything you may require to work with them!We increased the sensitivity of our detectors since they arequite straightforwardand not written in the "original style." As a result, they produce FPs (False Positives) more frequently than original ones. So that, our detectors are a kind of automation of the checks implemented in the checklist, their main purpose is to look for issues and assist the code auditor.Please let us know if you have discovered anissue/bug/vulnerabilityvia our custom Slither detectors. You may contact us via opening aPR/Issueordirectly, whichever is more convenient for you. If you have any further questions or suggestions, pleasejoin our Discord ServerorTelegram chat! We hope to see you there, and we intend to support the community and its initiatives!Repository NavigationTable of Contents:SectionLinkDocsDocs for each detectorSlitherinDetectors codeTestsTest contracts for detectorsUtilsAuxiliary filesIssuesSuggest an ideaInstallation ProcessStep-by-Step guideDetectorsDetectors tableEnhancements & New DetectorsProject ImprovementsInstallation ProcessUsing GitTo install Pessimistic Detectors:Install theoriginal Slither;Clone our repository;Run the following command in our repository folder to add new detectors to Slither:python3setup.pydevelopKeep in mind that you don't have to reinstall the plugin after changes in the repository!Dependencies must be installed in order to test the detectors on our test contracts:npminstallUsing PipInstall theoriginal Slither;Install the pippackage:pipinstallslitherinUsageSlitherin-cli (Recommended)Use Slitherin-cli to run detectors on a Hardhat/Foundry/Dapp/Brownie application. You have the following options:Run ONLY Slitherin detectors:slitherin.--pessRun ONLY Slither detectors:slitherin.--slitherRun Slither detectors, then Slitherin detectors:slitherin.--separatedRun Arbitrum-specific Slitherin detectors:slitherin.--arbitrumKeep in mind that Slitherin-cli supports all Slither run options.SlitherSlitherin detectors are included into original Slither after the installation. You can use Slitheras usual.Detectors TableDetector LinkDocs & SetupTest ContractValid* IssuesUnprotected SetterExploreTest1Unprotected InitializeExploreTest0TX Gasprice WarningExploreTest0UniswapV2 IntegrationExploreTest0Token FallbackExploreTest0Timelock ControllerExploreTest1Strange SetterExploreTest0Read-only ReentrancyExploreTest0NFT Approve WarningExploreTest0Multiple Storage ReadExploreTest9Magic NumberExploreTest3Inconsistent Non-ReentrantExploreTest0Falsy Only EOA ModifierExploreTest0Missing Event SetterExploreTest1Dubious TypecastExploreTest0Double Entry Token PossibilityExploreTest0Call Forward To ProtectedExploreTest0Before Token TransferExploreTest2For Continue IncrementExploreTest0AAVE Flasloan CallbackExploreTest0Arbitrary CallExploreTest0Elliptic Curve RecoverExploreTest0Public vs ExternalExploreTest0Please note:*Valid - issues included in reports and fixed by developers (January 2023 - June 2023).There are two detectors which have several checks inside:pess-uni-v2andarbitrary-call.Enhancements & New DetectorsHere we indicate our updates, workflows and mark completed tasks and improvements!You can add your owndetector/idea/enhancementbyopening the Issue at the following link.Prior to adding a customdetector, ensure that:In a documentation file, your detector is comprehensively described;The detector test contract is presented and correctly compiles;The detector code is presented and works properly.Prior to adding anidea, ensure that:Your concept or idea is well articulated;A vulnerability example (or PoC) is provided;Prior to adding anenhancement, ensure that:Your enhancement doesnotmake the base code worse;Your enhancement is commented.Detectors Backlog:AcknowledgementsOur team would like to express our deepest gratitude to theSlither toolcreators:Josselin Feist, Gustavo Grieco, and Alex Groce, as well asCrytic,Trail of Bits'blockchain security division, and all the people who believe in the original tool and its evolution!Slitherin in mass mediaWeek in Ethereum NewsBlockthreatRelease article by officercia.ethArbitrary Calls & New Slitherin Detector ReleaseWhat’s up Slitherin?DefillamaEssential Tools for Auditing Smart Contracts by HexensETH BelgradetalkIntegrated intoAuditWizardThank you!It would be fantastic if you could bookmark, share, star, or fork this repository. Any attention will help us achieve our common goal of makingWeb3 a little bit saferthan it was before: therefore, we require your support!For our part, we'll do everything in our power to ensure that this project continues to grow successfully in terms of both code and technology as well as community and professional interaction! We sincerely hope you find our work useful and appreciate any feedback, so please do not hesitate tocontact us!Pessimistic delivers trusted security audits since 2017.Require expert oversight of your safety?Explore our services atpessimistic.io.