mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
60 lines
1.9 KiB
TeX
60 lines
1.9 KiB
TeX
\section{Phase 1: Static Analysis with Slither}
|
|
|
|
|
|
\subsection{What Slither Does}
|
|
|
|
Slither is a static analysis framework for Solidity. It parses Solidity source code into
|
|
an intermediate representation (SlithIR) and runs detectors---pattern-matching rules that
|
|
identify known vulnerability classes.
|
|
|
|
\subsection{Running Slither}
|
|
|
|
\begin{lstlisting}[language=bash,caption={Running Slither on a Foundry project}]
|
|
# Install
|
|
pip install slither-analyzer
|
|
|
|
# Run all detectors
|
|
slither . --filter-paths "test/,script/,lib/"
|
|
|
|
# Run specific detector
|
|
slither . --detect reentrancy-eth
|
|
|
|
# Generate human-readable report
|
|
slither . --print human-summary
|
|
|
|
# Generate machine-readable JSON
|
|
slither . --json slither-report.json
|
|
\end{lstlisting}
|
|
|
|
\subsection{Key Detectors}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{@{}llr@{}}
|
|
\toprule
|
|
\textbf{Detector} & \textbf{Vulnerability} & \textbf{Findings} \\
|
|
\midrule
|
|
\texttt{reentrancy-eth} & Reentrancy with ETH transfer & 2 \\
|
|
\texttt{reentrancy-no-eth} & Reentrancy without ETH transfer & 5 \\
|
|
\texttt{uninitialized-state} & Uninitialized storage variables & 3 \\
|
|
\texttt{arbitrary-send-eth} & Unchecked ETH transfers & 4 \\
|
|
\texttt{controlled-delegatecall} & Delegatecall with user input & 1 \\
|
|
\texttt{suicidal} & Unprotected selfdestruct & 0 \\
|
|
\texttt{unchecked-transfer} & Unchecked ERC-20 transfer & 7 \\
|
|
\texttt{locked-ether} & Contracts that receive but cannot send ETH & 2 \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Slither detector results across Lux Network contracts.}
|
|
\end{table}
|
|
|
|
\subsection{False Positives}
|
|
|
|
Slither produces false positives. A finding is not a bug until confirmed by manual
|
|
review. Our false positive rate across 50 domains: 34\%. This means 66\% of Slither
|
|
findings are real issues. The remaining 34\% are either intentional patterns
|
|
(e.g., reentrancy guards that Slither does not recognize) or context-dependent
|
|
non-issues.
|
|
|
|
%% ============================================================
|