Skip to content

Releases: crytic/slither

0.10.2

08 Apr 13:08
@0xalpharush 0xalpharush
0.10.2
fdf54f6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
0.10.2 Latest
Latest

0.10.2 - 2024-04-08

This minor release contains several enhancements and resolves several bugs, most notably:

  • Revamps slither-mutate with first class support for Foundry projects (see quickstart)
  • New detector identifies unused imports (slither . --detect unused-import)
  • Resolves longstanding issues in import resolution and lack of support for aliases (see #1452)
  • Improves the reference/declaration API in order to facilitate LSP integration
  • Accurately models implicit returns in the intermediate representation (see #1880)

We would like to thank our external contributors:

New Features

Bug Fixes

Enhancements

New Contributors

Full Changelog: 0.10.1...0.10.2

Contributors

kevinclancy, elopez, and 11 other contributors
Assets 10

0.10.1

29 Feb 21:05
@0xalpharush 0xalpharush
0.10.1
3523093
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
0.10.1

0.10.1 - 2024-02-29

This is a minor release that adds support for Solidity 0.8.24 and top level events. It includes a new detector, out-of-order-retryable, which detects potential misuse of Arbitrum's retryable transactions. Also, there is a new CLI flag, --include-paths which allows one to only include results from a given path.

We would like to thank all of our external contributors:

What's Changed

New Features

  • Add support top level events by @smonicas in #2219
  • Add support Solidity 0.8.24 by @smonicas in #2281
  • Add --include-paths option by @smonicas in #2330
    • For example, slither . --include-paths (src/|contracts/) will only include results from files within src or contracts directory. Note, this is uses python-style regex and cannot be used at the same time as --filter-paths.
  • Feat: out of order retryable detector by @0xalpharush in #2340

Bug Fixes

Enhancements

New Contributors

Full Changelog: 0.10.0...0.10.1

Contributors

elopez, UsmannK, and 8 other contributors
Assets 10

0.10.0

18 Oct 15:16
@montyly montyly
0.10.0
e3dcf1e
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
0.10.0

0.10.0 - 2023-10-18

This release adds support for Vyper 0.3.7 (thanks to the funding from VyperLang)! Currently, Vyper frameworks such as Ape are not supported. To run slither on Vyper codebases, target the source directory e.g. run slither ./contracts if the Vyper contracts are in the contracts/ directory.

Additionally, this release includes 5 new detectors, 3 new printers, and several bugs fixes related to recent solidity features. The echidna/medusa integration was sped up and provides more information to the fuzzers.

With the release of crytic-compile 0.3.5, support for foundry projects is significantly improved: Slither can now be run on a single file from a foundry project and detect the necessary imports automatically (ex: run slither contracts/some_file.sol instead of slither . ).

We would like to thank all of our external contributors:

What's Changed

New Features:

Breaking Changes:

Enhancements:

Bug Fixes:

Continuous Integration and Dependencies:

New Contributors

Full Changelog: 0.9.6...0.10.0

Contributors

SEJeff, kevinclancy, and 11 other contributors
Assets 10

v0.9.6

06 Jul 16:34
@0xalpharush 0xalpharush
0.9.6
e5f2a86
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.6

0.9.6 - 2023-07-06

This release fixes a regression in the unchecked-lowlevel call detector and a crash in the cache-array-length detector.

What's Changed

New Contributors

Full Changelog: 0.9.5...0.9.6

Contributors

dependabot, sambacha, and 0xalpharush
Assets 10

v0.9.5

28 Jun 12:47
@0xalpharush 0xalpharush
0.9.5
3d4f934
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.5

0.9.5 - 2023-06-28

This is a patch release that fixes forward compatibility with Python 3.11.

What's Changed

Full Changelog: 0.9.4...0.9.5

Contributors

elopez
Assets 10

v0.9.4

26 Jun 18:40
@0xalpharush 0xalpharush
0.9.4
9244f96
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.4

0.9.4 - 2023-06-26

This release adds initial support of user defined operators, improves support for try catch, reduces false positives, and fixes numerous bugs. Finally three new detectors, one new printer, and one new tool were added.

We would like to thank all of our external contributors:

For CI integration: If you were using the fail-high, fail-medium, fail-low, fail-pedantic in slither.conf.json, Slither will warn these configurations are deprecated and recommend migrating to the respective fail-on config e.g. fail-high becomes fail-on: high. These flags are now decoupled from excluding which detectors run, meaning the flags --exclude-informational and --exclude-optimization will be honored without also passing --no-fail-pedantic. Consider using slither-action for CI integration

Added

  • Detectors
    • cache-array-length: Detects for loops that use length member of some storage array in their loop condition and don't modify it by @bart1e in #1694
    • encode-packed-collision: Detects collisions caused by use of encode packed on dynamic types by @0xalpharush in #1845
    • incorrect-using-for: Detects using-for statement usage when no function from a given library matches a given type by @bart1e in #1653
  • Printer
    • loc- Count the total number lines of code (LOC), source lines of code (SLOC), and comment lines of code (CLOC) found in source files (SRC), dependencies (DEP), and test files (TEST) - by @devtooligan in #1882
  • Tool

Changed

Fixed

New Contributors

Full Changelog: 0.9.3...0.9.4

Contributors

ydm, daog1, and 18 other contributors
Assets 10

v0.9.3

20 Mar 17:34
@0xalpharush 0xalpharush
0.9.3
e6b8af8
Compare
Choose a tag to compare
v0.9.3

0.9.3 - 2023-03-20

This release adds a new detector for high complexity functions, improves Echidna's performance (on enums), adds support for less common and new Solidity features (ternary operations, using for, and yul support), and improves slither-read-storage and existing detectors.

Additionally, we're so excited that Slither has been nominated in the latest round of @optimismFND 's RetroPGF's program! If you vote for these projects, please select Slither as one of your favorite tools from now until March 23!

We have also opened a GitHub discussion page for Slither to more easily communicate with our community of users and developers.

Finally, we would like to thank all of our external contributors:

Added

Changed

Fixed

New Contributors

Full Changelog: 0.9.2...0.9.3

Contributors

bsamuels453, elopez, and 9 other contributors
Assets 2

v0.9.2

11 Jan 17:06
@0xalpharush 0xalpharush
0.9.2
4c976d5
Compare
Choose a tag to compare
v0.9.2

0.9.2 - 2023-01-11

This release integrates codex into Slither via two features:

  • slither-documentation, a tool to auto-generate natspec for every function. See the usage on solmate.
  • the codex detector, which uses GPT3 to find vulnerabilities. This detector is not run by default and requires an explicit opt-in by using the --codex flag.

For both features, the environment variable OPENAI_API_KEY must be set. These features are experimental, and we recommend reading OpenAI's ToS, in particular, if you are using it on a private codebase. We will be exploring other areas where we can leverage LLM within Slither, and we would love the community's feedback and ideas.

Additionally, this release contains two new detectors, and refinements to existing detectors. This includes a better handling of nonReentrant for reentrancy detection, lowering the number of false alarms. Finally, this release contains several bug fixes and improvements for Solidity features such as "using for" directives and user defined value types.

We would like to thank all of our external contributors:
-@ardislu
-@bart1e
-@devtooligan
-@devtooligan
-@mds1
-@Pavan-Nambi
-@pcaversaccio
-@plotchy

Thanks to the community effort, slither has now reached 100+ contributors.

Added

Changed

Fixed

New Contributors

Full Changelog: 0.9.1...0.9.2

Contributors

elopez, webthethird, and 10 other contributors
Assets 2

v0.9.1

03 Nov 20:26
@0xalpharush 0xalpharush
0.9.1
a41f867
Compare
Choose a tag to compare
v0.9.1

0.9.1 - 2022-11-03

This release contains several bug fixes, and a new tool - slither-doctor - to help debugging slither.

We would like to thank all our external contributors:

Added

  • slither-doctor: a new tool to help diagnose issues with Slither (#1384)

Changed

  • Add contract types in constant optimization detector (#1443)
  • Remove redundant calls (#1434)
  • Missing text in solc version recommendation (#1406)
  • slither-flat support for top level objects (#1441 )

Fixed

  • Missing inherited storage slots in slither-read-storage (#1444)
  • Triage mode not working properly (#1435)
  • An incorrect parsing of library events (#1442)

Contributors

zhiqiangxu, medariox, and 4 other contributors
Assets 2

v0.9.0

05 Oct 13:43
@montyly montyly
0.9.0
a008df7
Compare
Choose a tag to compare
v0.9.0

0.9.0 - 2022-10-05

This release contains:

  • 3 new detectors
  • Reduction of false positives in detectors
  • Refactoring that will help us adding new features
  • Breaking changes in the internal APIs
  • Fixes for several bugs and improvements to testing

This release moves the Python requirement to 3.8.

We would like to thank all our external contributors:

For Foundry users: we do not support multiple compiler versions at the moment (see foundry-rs/foundry#3450).

Refactored

  • The source mapping API, to ease integration with third parties (#877) API breaking change
  • Solidity signature API (#1323, #1349, #1356) API breaking change
  • slither-read-storage to make it easier to maintain (#1311)

Added

  • Detector:
    • arbitrary-send-erc20 (#1025)
    • arbitrary-send-erc20-permit (#1025)
    • domain-separator-collision (#1334)
  • Printer
  • New flags
    • --checklist, to produce a markdown containing slither's results (#1190)
    • --convert-library-to-internal in slither-flat (#1298)
  • Hash of known codebase to detect known libraries (#1134)
  • Support for ERC1363, ERC4524 in slither-check-erc(#1274)
  • Solidity support
    • IdentifierPath(#1227)
    • min/max support for enum (#1276)
    • Top level enum (#1300)
  • More python type hints (#1388)
  • Testing
    • Tests for unification of path filtering across POSIX and Windows (#1303)
    • Detectors tests (#858)
    • New SSA tests (#1205)
    • Unit tests for new solc version (#1268)
  • pip-audit in the CI (#1243)
  • Improve setup.py with dev deps (#1178)
  • New API to detect if a type is dynamicType.is_dynamic (#1175)

Changed

  • Change the exit code returned by Slither (#1278, #1359) If you are using Slither in a CI, check out the new flags --fail-pedantic/--fail-high/--fail-medium/ ... and --no-fail-pedantic. The default behavior is --fail-pedantic, but this will be updated to be --no-fail-pedantic in a future release
  • Updated the solc-version recommendations (#1389)
  • Remove FPs on the external-functions detectors (#1318)
  • Remove FPs on the unprotected_upgradeable detector (#1344)
  • Remove immutable variable from the variable order printer (#1184)
  • too-many-digits detector: ignore checksummed address (#1193)
  • Better python regex (#1200, #1185)
  • Improvements to the dockerfile (#1242, #1335, #1369)
  • Unify path across POSIX and Windows (#1196)
  • Improve debug info in case of name reuse (#870)
  • Improvements to the exclude-dependencies flag (#1317)
  • Improvements to the function-id printer (#886)
  • Improvements to the constant parsing (#1377)
  • Improvements to the support of virtual modifier (#1387)
  • Use of the latest crytic-compile version (a008df7)

Fixed

Assets 2