securify
securify copied to clipboard
Improve Memory Tagging
Memory tagging needs to be improved for certain opcodes including ReturnDataCopy and CallDataCopy.
Reference: https://github.com/eth-sri/securify/blob/master/src/main/java/ch/securify/analysis/AbstractDataflow.java#L472
Example:
No MissingInputValidation here:
contract SimpleBank {
bytes32 x;
function withdraw(bytes memory a) public {
x = keccak256(a);
}
}
but it is detected if a non-dynamic data type is used.