Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Slither detects reentrancy vulnerability against the code using a mutex to guard reentrancy. #2618

Open
c-kado opened this issue Dec 19, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@c-kado
Copy link

c-kado commented Dec 19, 2024

Describe the desired feature

Slither detects reentrancy in the code below.
I think the code is safe for reentrancy.
bool locked is a variable for mutex.
Slither detects vulnerabilities by recognizing the variable as a state variable written after an external call.

pragma solidity ^0.7.0;

contract MutexPattern {
    bool locked = false;
    mapping(address => uint256) public balances;

    function withdraw(uint _amount) public payable returns(bool) {
        require(!locked, "Blocked from reentrancy.");
        locked = true;

        require(balances[msg.sender] >= _amount, "No balance to withdraw.");
        
        balances[msg.sender] -= _amount;
        (bool success, ) = msg.sender.call{value: _amount}("");
        require(success);

        locked = false;
        return true;
    }
}

Slither detects the code below using a modifier as safe, although the functionality is the same as the above code.

pragma solidity ^0.7.0;

contract MutexPattern {
    bool locked = false;
    mapping(address => uint256) public balances;
    
    modifier noReentrancy() {
        require(!locked, "Blocked from reentrancy.");
        locked = true;
        _;
        locked = false;
    }

    function withdraw(uint _amount) public payable noReentrancy returns(bool) {
        require(balances[msg.sender] >= _amount, "No balance to withdraw.");
        
        balances[msg.sender] -= _amount;
        (bool success, ) = msg.sender.call{value: _amount}("");
        require(success);

        return true;
    }
}

What differences are in them?

@c-kado c-kado added the enhancement New feature or request label Dec 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants
@c-kado and others