Repository: crytic/slither

Issue:
FileNotFoundError: [Errno 2] No such file or directory: 'solc'
I launch  program like this:

    slither Contract.sol 

and receive an error:
"FileNotFoundError: [Errno 2] No such file or directory: 'solc'"

I have solc installed.

    $ solcjs --version
    0.4.25+commit.59dbf8f1.Emscripten.clang

But executable is called **solcjs**, not **solc**. Or it is something different?

Reasoning for "Trusted" versions of Solidity
Re: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

I am wondering why `0.4.25 or 0.5.11` are chosen as trusted versions.

Would 0.4.26 or 0.5.17 be acceptable? (current highest patches of those minor versions)

Why are none of the 0.6.x versions included as a "trusted" version?

What are the criteria for adding / bumping the version of "trusted"? Is it based on a simple metric like time since release? Or were those two specific versions manually audited by your team members?

Sorry for all the questions. I have a project which is fairly portable between `>=0.5.0 <=0.7.0` and am wondering which version to target... I would like to use `immutable` from `>=0.6.5`, but not at the expense of some possible security issue. And after using this tool I wondered what the criteria was for "trusted versions" of the compiler.

Thanks.


Discussion:
Yes, these are two different commands. Please follow the install instructions for solc https://solidity.readthedocs.io/en/v0.4.21/installing-solidity.html
Thank you!
I installed solc through apt-get, and now it works!

https://solidity.readthedocs.io/en/v0.4.21/installing-solidity.html#binary-packages

I added a troubleshooting section to capture questions and answers like this: https://github.com/trailofbits/slither/wiki#troubleshooting
Hi @junderw 

Thank you for these questions. We are in the process of updating our recommendations for this detector.
Our criterias include:
- The [known solidity bugs](https://solidity.readthedocs.io/en/v0.7.0/bugs.html)
- The release date of the version. With the history of bugs in the compiler, we do not recommend using any latest version for deployment, specially if changes were made in the optimizer or the language semantic

Unfortunately, we do not manually review every version of solc, as this would require too much effort on our side. However we do fuzz from time to time the compiler (see our [blogpost](https://blog.trailofbits.com/2020/06/05/breaking-the-solidity-compiler-with-a-fuzzer/) about our experience).

Note that the recommendation here is for code deployment. We do recommend to use the latest available (and compatible) to benefit from the latest warnings generated by solc. You can see more details in our guideline to [write secure contract](https://github.com/crytic/building-secure-contracts/blob/master/development-guidelines/guidelines.md#solidity) (note that the version in the guideline is also slightly out-to-date and will be updated soon)


Thanks for the link.

Yes, it looks like that recommendation for 0.5.x was written right after 0.6.1 was released. (0.6.0 had a bad bug that 0.6.1 fixed, not very confidence inspiring...)

Since then it's been a little over half a year, and in April 0.6.5 came out with `immutable` which is quite a big security gain if we assume the implementation of the feature itself in the compiler is not buggy.

If possible, I would try to get at least 0.6.5 on the "trusted" list just so people can use `immutable`.

Thanks for the reply.
Yes I agree that we need to update the recommendations to include 0.6. We will take into consideration the usage of `immutable` for our update.

Resolving patch:
diff --git a/slither/detectors/attributes/incorrect_solc.py b/slither/detectors/attributes/incorrect_solc.py
--- a/slither/detectors/attributes/incorrect_solc.py
+++ b/slither/detectors/attributes/incorrect_solc.py
@@ -33,23 +33,30 @@ class IncorrectSolc(AbstractDetector):
 `solc` frequently releases new compiler versions. Using an old version prevents access to new Solidity security checks.
 We also recommend avoiding complex `pragma` statement.'''
     WIKI_RECOMMENDATION = '''
-Use Solidity 0.4.25 or 0.5.11. Consider using the latest version of Solidity for testing the compilation, and a trusted version for deploying.'''
+Deploy with any of the following Solidity versions:
+- 0.5.11 - 0.5.13,
+- 0.5.15 - 0.5.17,
+- 0.6.8,
+- 0.6.10 - 0.6.11.
+Use a simple pragma version that allows any of these versions.
+Consider using the latest version of Solidity for testing.'''
 
     COMPLEX_PRAGMA_TXT = "is too complex"
     OLD_VERSION_TXT = "allows old versions"
     LESS_THAN_TXT = "uses lesser than"
 
-    TOO_RECENT_VERSION_TXT = "necessitates versions too recent to be trusted. Consider deploying with 0.5.11"
-    BUGGY_VERSION_TXT = "is known to contain severe issue (https://solidity.readthedocs.io/en/v0.5.8/bugs.html)"
+    TOO_RECENT_VERSION_TXT = "necessitates a version too recent to be trusted. Consider deploying with 0.6.11"
+    BUGGY_VERSION_TXT = "is known to contain severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)"
 
     # Indicates the allowed versions. Must be formatted in increasing order.
-    ALLOWED_VERSIONS = ["0.4.25", "0.4.26", "0.5.11"]
+    ALLOWED_VERSIONS = ["0.5.11", "0.5.12", "0.5.13", "0.5.15", "0.5.16", "0.5.17", "0.6.8", "0.6.10", "0.6.11"]
 
     # Indicates the versions that should not be used.
     BUGGY_VERSIONS = ["0.4.22", "^0.4.22",
                       "0.5.5", "^0.5.5",
                       "0.5.6", "^0.5.6",
-                      "0.5.14", "^0.5.14"]
+                      "0.5.14", "^0.5.14",
+                      "0.6.9", "^0.6.9"]
 
     def _check_version(self, version):
         op = version[0]
@@ -110,6 +117,17 @@ def _detect(self):
 
                 results.append(json)
 
+        if self.slither.crytic_compile:
+            if self.slither.crytic_compile.compiler_version:
+                if self.slither.crytic_compile.compiler_version.version not in self.ALLOWED_VERSIONS:
+                    info = ["solc-",
+                            self.slither.crytic_compile.compiler_version.version,
+                            " is not recommended for deployement\n"]
+
+                    json = self.generate_result(info)
+
+                    results.append(json)
+
         return results
 
     @staticmethod


Test patch:
diff --git a/scripts/travis_test_embark.sh b/scripts/travis_test_embark.sh
--- a/scripts/travis_test_embark.sh
+++ b/scripts/travis_test_embark.sh
@@ -17,7 +17,7 @@ cd embark_demo || exit 255
 npm install
 slither . --embark-overwrite-config
 
-if [ $? -eq 3 ]
+if [ $? -eq 4 ]
 then
     exit 0
 fi
diff --git a/scripts/travis_test_etherlime.sh b/scripts/travis_test_etherlime.sh
--- a/scripts/travis_test_etherlime.sh
+++ b/scripts/travis_test_etherlime.sh
@@ -15,7 +15,7 @@ npm i -g etherlime
 etherlime init
 slither .
 
-if [ $? -eq 6 ]
+if [ $? -eq 7 ]
 then
     exit 0
 fi
diff --git a/scripts/travis_test_truffle.sh b/scripts/travis_test_truffle.sh
--- a/scripts/travis_test_truffle.sh
+++ b/scripts/travis_test_truffle.sh
@@ -15,7 +15,7 @@ npm install -g truffle
 truffle unbox metacoin
 slither .
 
-if [ $? -eq 5 ]
+if [ $? -eq 8 ]
 then
     exit 0
 fi
diff --git a/tests/expected_json/old_solc.sol.json.solc-version.txt b/tests/expected_json/old_solc.sol.json.solc-version.txt
--- a/tests/expected_json/old_solc.sol.json.solc-version.txt
+++ b/tests/expected_json/old_solc.sol.json.solc-version.txt
@@ -3,4 +3,3 @@ Pragma version0.4.21 (None) allows old versions
 Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity[0m
 tests/old_solc.sol.json analyzed (1 contracts with 1 detectors), 1 result(s) found
 [94mUse https://crytic.io/ to get access to additional detectors and Github integration[0m
-INFO:Slither:[93m/home/travis/build/crytic/slither/scripts/../tests/expected_json/old_solc.sol.json.solc-version.json exists already, the overwrite is prevented[0m
diff --git a/tests/expected_json/solc_version_incorrect.solc-version.json b/tests/expected_json/solc_version_incorrect.solc-version.json
--- a/tests/expected_json/solc_version_incorrect.solc-version.json
+++ b/tests/expected_json/solc_version_incorrect.solc-version.json
@@ -77,6 +77,15 @@
         "check": "solc-version",
         "impact": "Informational",
         "confidence": "High"
+      },
+      {
+        "elements": [],
+        "description": "solc-0.4.25 is not recommended for deployement\n",
+        "markdown": "solc-0.4.25 is not recommended for deployement\n",
+        "id": "5a4264386059605a5ac36e3f7dbc853e89e337be5bfbd8b05a64964a81d73790",
+        "check": "solc-version",
+        "impact": "Informational",
+        "confidence": "High"
       }
     ]
   }
diff --git a/tests/expected_json/solc_version_incorrect.solc-version.txt b/tests/expected_json/solc_version_incorrect.solc-version.txt
--- a/tests/expected_json/solc_version_incorrect.solc-version.txt
+++ b/tests/expected_json/solc_version_incorrect.solc-version.txt
@@ -1,6 +1,7 @@
 [92m
 Pragma version^0.4.23 (tests/solc_version_incorrect.sol#2) allows old versions
 Pragma version>=0.4.0<0.6.0 (tests/solc_version_incorrect.sol#3) allows old versions
+solc-0.4.25 is not recommended for deployement
 Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity[0m
-tests/solc_version_incorrect.sol analyzed (1 contracts with 1 detectors), 2 result(s) found
+tests/solc_version_incorrect.sol analyzed (1 contracts with 1 detectors), 3 result(s) found
 [94mUse https://crytic.io/ to get access to additional detectors and Github integration[0m
diff --git a/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.json b/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.json
--- a/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.json
+++ b/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.json
@@ -30,9 +30,9 @@
             }
           }
         ],
-        "description": "Pragma version^0.5.5 (None) is known to contain severe issue (https://solidity.readthedocs.io/en/v0.5.8/bugs.html)\n",
-        "markdown": "Pragma version[^0.5.5](None) is known to contain severe issue (https://solidity.readthedocs.io/en/v0.5.8/bugs.html)\n",
-        "id": "fa84bcbd40d52d8846dcd54be4cada287e43c5461898c9acbf089ca8a478f6e5",
+        "description": "Pragma version^0.5.5 (None) is known to contain severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n",
+        "markdown": "Pragma version[^0.5.5](None) is known to contain severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)\n",
+        "id": "b27987b5c734b3ac9a18d3aef5c96a20911b71fb0ffd8d222a1052252fea4151",
         "check": "solc-version",
         "impact": "Informational",
         "confidence": "High"
diff --git a/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.txt b/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.txt
--- a/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.txt
+++ b/tests/expected_json/solc_version_incorrect_05.ast.json.solc-version.txt
@@ -1,5 +1,5 @@
 [92m
-Pragma version^0.5.5 (None) is known to contain severe issue (https://solidity.readthedocs.io/en/v0.5.8/bugs.html)
+Pragma version^0.5.5 (None) is known to contain severe issues (https://solidity.readthedocs.io/en/latest/bugs.html)
 Pragma version0.5.7 (None) allows old versions
 Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity[0m
 tests/solc_version_incorrect_05.ast.json analyzed (1 contracts with 1 detectors), 2 result(s) found