From 84e1fbdce28e4092de1c1c256f6937b200e67f29 Mon Sep 17 00:00:00 2001 From: Ivaylo Ivanov Date: Mon, 18 Dec 2023 16:37:41 +0100 Subject: [PATCH] Add conclustions and open challenges --- SemSEreport/exercises.pdf | Bin 157165 -> 157785 bytes SemSEreport/exercises.tex | 14 +++++++++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/SemSEreport/exercises.pdf b/SemSEreport/exercises.pdf index bc5306efdf347b2a6ae86d187ffa1c83d67e9241..af9a2b367fcc4ef945f99cb92ca80a0eedb4fdf7 100644 GIT binary patch delta 6716 zcmai&RXp8+!^U-YcXxM8JDM?F)7{OP`f1bMW;oc!^f2As)69`$7>+#J`~QF5%lG2F z`(8ZP&*%9*r<0g#bC?azL`dR7dHqU=96+~;reCoHLC>SHw|zCzJTls9(cX%qTh_$- z-d*}W1O8>Q7*)Qq_2{eYW@g`Zp}mKblMaUZ^W2xS12?q>EH&>y`KPPt-R&EfLNt+t z4?<4;yKG}7>AFP3C8$Y4cO;jlN}QU5elBk|3)k|7>Fae&iAa0|o&2&H6o#COg@I!f zyf*W&`syW~T}u3omLWv!l_s}rm!)4_Q3=KI)TYxWbgk8O_D5nhu1rIN9>NgDWEXIa zwL#FxG51)%3w!n z)=D2l>oxt>6q8oAKyQYqz?2)XJ>XMvNY|Gij3GCZ$nwvhmD;Da_J!nTR^sM3Fk15} zpIm#T(&y|73MxsC2*7^Uh5cwFD=_xlLm)n9bn8m2_6#vS75~v<{-EWomlM7uGv|;S zIf=1N#Q){gf+)PAi@$AeAxi8^PCU7>^D9R=&j+fQDbO8V9VmR`*sNuC1Q38TST367 zR4e13DIo6Mrkhd0cXj&d@VFTG!YFb*E2~wde7z`b(8yoUlJi!MI|x%UpC_Unv4PDa zg-@T2=}h0@&o-HBh^K)a@c7T|H>J3Pz(Sa-?NR~an4eNQ@psN$+(0T~S#!IPxd&WB zJO|`DZu%YUC5W1yIV#pMFgfC+GR|Bu{%Mtv=V#{pn*WQw#c0*CoG__m`^SN-X)9|i z_u@%XijdsOYt~%HcZFol(wHap;1FK{Of^JXmaC8V4046POEvQt%c|}ZD>W&Lg3CEa z8!^o%Ju?U7zLA`mt4a410NN-f@f>&kKES}Ru|LG#nbov2%(9MJh?=P6(4|()yLS9PtK8%9rB&| zvII{{Qo0E_?zfgqzzhQ~TO1ttJwMvS67{bJ44xRJn)qq3mcw?i!UBqwJN`|vLEP1WE=j2)fFzpsMajz;7^yQA~AD_V{ zEIxF^6|5}SIV)0Ztjl@vrT$j6NNNURmHl>BY@z&6Hwp`*iM#aYG4>W%1Ifm1f%2|0 z9mN`r=4g>CWW5_5wiFKul2_th>v18eaQA}wyoz~a<0%w?H50zfj`mT#v18Z?AL{r} ztbZ08H-ZX$9oGxuxJ3yLi*<=hW@cQVXcFG2I#Xz7#MZCYt0h|3OqSG$Qox*YObK;L z_|Os9tf|``Y1&yg)4g^pP`0yaW=sB;Etb6CfN=eWjqNQ~mpK&0jP0#P_SAxRV=lb& zXG_CSa#a}#nqSI;HoBwxOo7oV9TxN%;j4J-xa9}lW_Y=6ksmEG;#Otk8t7V_V!W+7&?V%cky|a6 z3zDp#b`ZK#Oa331dkVA{ zQdhZty>wOeOzQK;`L zmV>9gpTDnzjmLk<%hnZ3NSr}{;lF?2Y$@5~@1D3;f!gvbT_r;;}$h=&$4>fi~WCauECnAD^+@E%v%=t~{OFBeNt0>vZ3L!Tp} z#vO^Y_@F3f@aO5G`*?{GjGaRt9(HkfmVve&;hjRhw&!w|IsfG!f3}$9ZmX6S54$hT z0x8`ZHFfhRK?|ldC{V!eTX2<}HfX11Q~WXMF?{#C`5kFV>-0wW!_5IRhd@>&y`ygz zhd=pqtHXGlI2qXfTeXHbwTI8iQ*<(0`)76`g`6FRjD7`4dVhV_)qKa|q^HCk53GwA$|8Erq$1K=MstIf^ZR<6$!mtclL{;hNtV`X-e=ry`m z9Cp*pi|2^53x-LuDZWCeN7cqg@TYm`)%oB%(GLBfoWSc;ps2Ng_Ue0eTMiqm9j30B zd)cFr;fDKnQz>9awIS13)CAENS;_B^kM;S@RS*Ny+)Iq1vS!GGHmQsSg~|-I&D}ok zgZJ%V;y-jreXmZkpexZSmd=Q8yeWGNgjb-juT5Ja%|;Wyn9dMp?2aQ-w@{%b3v7@2Zby<1U=tP@RwTlCo9p;}imHa`|t z>$;?nDSFP~%XABomciL-;xyE!kOmzjIQby+?M3$qU4`FW?5St!Mn~E0GUhBQ?gp=X z4X$7+aY6vf@}r(55^eQdF<9)=ulcC)oT+57-%_ZCXKH>#=Hy1^lsAjB%qMWP321-M zcbLRUQq}C%UBQ3M|x)<<|sq& zt_w^(YM*?l<%zMM5zJz`QO>6wnZgTdX(Us0bXpzn!)5x^%xgW0*_J2(Z)Tt-ZMPsv zf6S$_AyGKt3f__wVSQ?F8>}DgA@%teukbJQWU(Dr=i$~k`dQ#|27Sr;r_#Z*W&9TEEy|FFd6W9&l-5mSudgq;zk8X2r2 zG|ncq9Dz-LAd?g7A&7qSL3|tb_u6CtU&yjzAWuP7#ar1$S>;rs{;p6W_PX|@ED|6h zhPXIRt?P6ELzssoZ}jquFaL5JAt3y^sg*xd=l{j4{j_JFq>W@N8ahZZ#e$<^TzyPZ z%%?D(vus{v*&rV9M`FbzftJ|xuyU75eT=ck-%xZ2(hljksM?pQ(F+jG4J}}US_L

kjTek>;d8e60V10*qWL4f+41v}#4rU+$4U{@BPxpZw7eFs4LUo65 z(u98|%II;{8kqcvSuil|z;PF5-ZFB!i_k;%9g;tjDe;E3Pw7DiH{rw%<@pA_bh+@S z_rrfio7x1VA)P?12UsTwW(uj~o{)%5m)3dLH5f3ALBp1eTLv3Q-a!bGO~?OG|!h>q8UOVy;mGi7l7qp0=n0eP_O zvuAwCX@u5KBOIz2?k?USj2U1mt}(NUy?I9%u}bxw2AFNjWGQsd34eh6@jadVpjps* z!;mCHCJ`zntc<2z|0%a6=giT`<6DuBAG*)*3bzF!Kj)^57J#@uvE6Lo*bXmqm8xC@ z&xKsh0*Jf~mG`=oK{#+TnzW0f{TNPBQLFFt+9D(NG{y}xo96J z_u8|8^mC;T*D!+aLC#Yq(*-i)#lfo1h}>*5T7wCUfntir$wg9L|LG78-8tBqUy(Y2R_i`)ToJ;rFI-q*~4I1PJr5 zBQa;Q$+fr~lb!U0+_2bq{qRO`ue1g3xMS>z`0FaSkz9$Y$XczjjD#kHP|akWtE>UF zy>hHNZ-~fy(PZ=0nZcif9%b|f$r!w(rJ8P4h`CMPIa(pe#?#3WZ>_5Zk!$^(;BsrI#2}K{alRdN z5DSTtD>3&S4~9IO4EC=?mfYq zAloWRuJL_8osW8(X8!cE`0c@hr6jWPyHVXW`oJJ|t5s!0S~B?#27YsaFsv)@FoVZ? zr}qW@zL4?j{kjeAf&s+eRn-$m6roCO{5=Nf?1pVz{XwhqyR`CsC2~$($f|!>RsX7&%ht_GtJ}d3EJa3iRK6k628BPl#Hz5A$T6-eV0-^62Z|}>WyhIB& z;WKtMvVgdl*GbL^@c8&x%FMVo5%S(F188MD{qkIKgiEMrMPfx@=E)-24~zc3BdFKm zuZFS;?e8lcV)?Yfvju zE!E){T6<@ZZyS-w0-kP`J;qOMs2%EQcK)1zxD#s|=dH8a^PTDD@H}8>C5s+XsX$`M zut#V-gI&vxdYoCG&4k;M@4;*Pi;Qw%Y}DZdiSizP^(8#rft5k%CFd24*=T)a%9@a2 z1EMZRVg1diL#gx*8aW8Hlk-u@^oGS;@zx=jsP;RiHA;kC1i+<97JiF-ixhlCW4r z7QA6B8=dT5!*A3f@>o4;^E`Nc#9P@25RoifWU4{p4-#p4gx+@|`b2-^RZC4>8!d|qmUI8AL-O1pxdY6e zk%z?ovZxWhr?Cb|`pHpU2Y*TI#WdtM9yo+2k&x zUuieEdEdg{EQ}eMw9={EQ4|kX_l$`>9?DUOT@7Fa;Q2PTmTs*4;0uCN)=KZU!I2U}`~qJoD{r{1c4Q@~+m%)H zjdJF7{DG9izf--dod-7&Lbpowb6u65G%IL6&V^;hW+G&ii5{6IVJTIvQF@@-h;5Rw zsztSUt_Ho4K$@_`YnXkRH`A9cnL35`OH z^3*`4+K3#&;+Xrik%ejzsTM}0^c$pSd8rB+bpUO3?fVTy5_@8Cf}_-V0=Jud?aDfl z?M(eqMSJ6C4aMCNbuKIsajPtUvhXBBt9lU^5i^nv7XD`Au+V-ezf<=StgcXN4;#L5 z#+%#)ee~{my!_G)+4R%x>-#E|FGwpIc=YMDpz&Y9kP!3t5hP@<7pZ2tp8E}i!jR3* zJm8PFH*y=aRl+mcZWaZP&S-PKp-q@BSp#kIv%#O!kSP#vcnO;VG+xxRLq9a>6@P1w z|Bg`ZfW2$79-IdMFh1$iE7iHPGC0fHyCZIO?l~byf0-6KG#WaRsWhI<{#J4OtvOYvQ@GFe9?dL0w`1{d6p_MvLf;HH^G=WI0ulk{~>e6Kj9Kw z<-QJV5z3rLmY(sN$eg4;Dj9kS6(%b{p@GaEKPh_ApiBWPS@+rabk+pDGn6?ihVE}& zg3E6fLiKVQ(J4!EKHEgD!LYq8Hnk=*jeB+OXuz+ZfE}xQ`ak|n2M8@G$Zyc=fmCg& z?TEd%jNg(-GL4~L0_|(xaP`3GMm|YVfxfFpS{dw&*xmtk{&iWB%K%IEGdZB+2!58q!plQr=R{>f>`-TXsUZn(q=?5u`g z4=|XH8iXOZP!V5CVZemdCf97343(!!2OV}p1?pC~Ej6%Hlvck7JJzs(!7v;66Z!t7 zzug)#7iswL0Su_2%mNg@3nsK_vQ=j5a0kbmwwsek?O#<(JqHFvcZgA@$orWt$xe4N zzsdQY$`b9e7CWIYSLkjvFP2mL7%D~&-+?U_X-&R8+u-V@540@l{>=!#$BkFHrhAE| zu@WB0>OTCZa(-G{d2P6ef93!V4?$JJL5G)A`rQi5oR_)OxC7z-w+Bn}_d4vK_L!ea z4#TTr@c$KLdiN~DE)l(YxSJA-t8JAH8oyzXQ73ILg^F<1{3Z#};Q|ED-aZUoAhc3h zS`89ym-=i# zOyzQx`b457?5$xL?**8tO`d{Krq>Iq}qG+-vDiJ)a&ForyhbM8O>`R;CG1MSbl$qjOny~?KSuUq4RiQ}=2#0w_a(oEX z<%7XJ0zSekoStxJaDW(Lbosv96C3(O&8Ljak8%iE7seu)VqZy%y7?Bn#!E?8#={e? zfYu5^+q`Q#BzKUqproX-n4pq`u%e2hq>zx1h=`=3f{KKYps1ucNK8SNLHhrT{w1PPwB{%!v0{`j(@S$^<+opdX42ZDLiyN&CWFYl+_5*X)UTmsn-mdbIpK?3eh$)7-W@a5GIAw1dS zz3)E0_Qg=@LyNtpy*6qb;~+81t!?~$D+ZST`%U`!+xQaugMA$wu>?iMg(M}gSXq^I HRIvUBLx9gG delta 6064 zcmV;h7fd(%eno?oF`rSHSbJ|s)x77{0f5=vtS z4uQiWZESt4SFUzN2>tV&eaKjDprzEDw4V3O&dkmjN6QFD=SMhvpDvCbpJiD@QpD0J zjTX02PNSS)gjpUf>gXnB$%GJ^#aBZ2(&*&f;`!qyi`X=+61698)QE}2n=TOF~cy z!E#=jj#ow_9}XKqhoeJ0a+Ible*_Sb5W?31n2_r$=!@(s5VnykN zU2AVY8%$*BPGmh|@Ws0O(S_!bC)~z~4KeG22-TW_R|W#pdemD?QdI}6|5%%84mR5e zR`zzxU=k0fCfM?E*Ikh2rLuVb#_B(r5SsqG7}5~KmvA5A(?+(9`R*Wwe;CeN+0>1( z2HbmVtdCOYVB*#Z=O<(+Z+wQjK#fsO;}ffLTT|dlv7;MGt4uR6phS#OZ^2ti@E*^| zUUve7uczMS`itg0(yjcKs)^^bz7F~FU7A3}l~{tV?@~nmi>3t1c99fm+wc8o-zcJ0D{CmV!(Q#_$@RfQJ-c$1 zMm@)DarDO#0UVA$E zo6Ecs&_MLdv&F$L^n50{P1J?eYs&|cUtMy=m!dnoawvy;ckP954({kP(XEBPSZ|~lMk8*1Ml-&+oVhDKc8#KK6s2s`n;$6Qk|GM_ z&RFi0{zwUz8KQaae?(2o&_xMzUQZas@x*^ty!HpPa>E6jb{}C6@sp1bY9Lr|8Yu$f zU1L`Mq{kBgKzdb+&L1%<5VjK&g)znqf_iDCkP_^$LGk(MAFL8ai+nsC?%FY$g3v*4 z@>(@Ir0Z)oYJ{Be?bSrVQ75;PlF|L!>Sa# zgL(2vGRZI`r5|GeerHG6w)^1rBl~-csqL@=gN#Y&OWJQ6PpQIOY(=iPltL|q zekd&11%^$-f3kNaZefs8l_&n%1?(++H{{)jI=XS5J?BD;-fb&W=qszXagOEjX=^L! z-c?YmJo?vW9kBC|vg_t=sPkT%FV)w2^m*5astpv!Qhc)D62MkY9#J0 ziSJ}=>YE>nFJ`mZW9apezn8v&4NN0HFBJ3(RW5l$8Nt9Uu4FXi`8yrX}QViHf2a{@vK6fj90i$eS@73T19&b98cLVQmU! zZe(v_Y6>zqATS_rVrmLJJPI#NWo~D5Xdp2)0yQ|7VNL=le~ng6bK5u!z4ur6R(d9q zMe2i6Z)uWd)2_3fI_+$m?SZjriyK?=P*So^5Bt{_AgCmE)XrXP2m}F;?*U*mT8*O7 z`K##Q|LxVQ$vcsZim=E;Ho97lq!>vag;6X=SBud#yB6Qa->=?3?igJMX%w+V-L1-c zEONGMbvO=qe~6w&y_p0s#-U*M{bj(?|Zq0VBgS8q9 z$y^L=f621Z^Uj*q0ZpFT(!v%1k~7sdWK~!6-9M;nI5N{ zxkKTB(*BN8$xiCcrmM^x4ODB~pW~s~ znuWP1MCJ*R3=(42-695oh&lV9)>eUc0ZGoZ-jep5Zd0%Q%CrU&(9&tC@WSqiIc{Ch znMI7QZ`@AWzbI+XtW;4a$s`PT65C@AK+MCIom-a*m(H>ZwafLE$ZsV z5J3+>g|x#Yi(i1s^FsthT7(Ht4vIP*#PB^LQfVxhEM^~Ux80)Xp+Mb9Y2h#ial_9~ zbZk0P!X@Pee@rdp*s^39+Cd@?AS~AehEoD!tWg% zrs%e7=^Ri7Q$?gP(6=gWcSz1(mO|e~mMoDPy*PqiFx~P zGSn!X%Z)jpsvpBikx?zlr_No#=pQT%A=6M6{C}558Wk>H8s$_Pe<)x_B~HXTI5~l&6QJ>Ho_iI}5Y#0slRt9dwXVL<(7n{DzMLNGD{-UY*iV)|(%yNW z4UvJOgJ4TYytX6{Ae9&}%KW6h1kb{VixD*HEG(jgA|`uAXIHQO1B=9?f`hamhqNF8 zx3nMvBRT{yG%-1s+gbu21TZu)IhX!g0?h(9GM8aa0w{m&T3c@$xek8!uh8Q;SkxNb zC7@U!mpV;`#o?1|%3$4>2Wx7}ZVNJ_TlnK+F%-NgaUKA6@>6h(fdNXZ_< z3Z_{omlE1ALpT&AkZ=@@)OkFUN~2d7oHD#3Ty(c&G@ zfW3cw$#@5hc9E+CF#FU5H-*$h`-%mJM;lW+Ab5!fkW-7P7V(O0ClDKKgRcDjbkaL5 zD|QJA?sphJE5BCkDw**xK(eSKB>dkFQHDznMs9Qt1~^`dzXS|j2SdvL6)^J1a0++G za}4zjL+#&gXl`BZ(x+RuB8>6-!Oi`2aLs=%mpbtM^2@MSo*e96p{Pq;_;z5C8X?+( zIcwXHDhr~oG11;t=f%5%7_c_{Xpc0Re z>Ei%<=!YGw6OBDi;nr8QU2$tTO+J7_5^j?~M=C{J3N{eleHG1=1UbMFXqH;Yi!+mK ziJmliDI2*I9&rmipP=(80F-Mls1lfB6y!BWry#SDdQI6C;c^;N6wQD1ZZVEO6yTQt zS+Rd1TcT2Mla4D!?$};&X?oTfM*Q$U78y-hRYre5(RVyYXa2?BHLnMxu_tSxHhPVrWtz0MPm`6*d~hA z*J!FHNHx?72u^`$N{w)+0xM-~$I<7|C?}_JEv;f?A&ot_@$g22p0nT{;DibUn@D=x zU{Dv}MkFnc5~q^Lqn$_+urh*^F#pkbl1j5v8zKNvFVGLPLRx>5Xn>W?T92`KqR5eG zw)37SS%cPktt}zu{2EW18~dpwBy60dqCj(VnZ&d3Tdewe#Yv;lqSz*SmEG_0R=r=& zdeh;3HJQd+_Pg#KjJ)0Zc(MEXr@iCd3sJzps5_W39XWRCqW{8J_CjKr5msY?f$RRx ztcTZq8-R1Kd;fpB91d>b(c2csWpM0;z`?_+I~w+O#)DDGK>TS{-hIG4)Z!Ou66Af5 zaoe5ZE&gA8kH6x_{DhzKF2CkI-sdGR$Nlc?mfsA&l>C<8e!IUd$9%{?@ev>M37?Eh ze$VgA>2T8LQ$FJr|H8lhJKE40!pd4?KTCWUk`E^bC;NW~5fZrp5`~ZmumsD(kAS2I zk3g~ypd9ie0OlS4g}*0wJ^(=7JFt4z9rp>U-efcx1HHTJM%YjozX9ALbT^avln)+3 z5P!oNl{ZyvO=)_9_49mEm9YmAo|Rufz-;&xu&!>WWy!1GCwvaL|IWYiZ~TvPI$3jo z+QtE$gExQ2XB}|B$)=FhMGDEH_#Xc1N%-3wekF4Fcld5{L5Cmk*WidZ{B6w{XZ#!- z@{wQgU-@t7m>Hrq`viWuo_2em%8GDJ?TBODVf|q_EoZ~o(sPTj=Qo)TM-RC1Kjg?e zaOHRio_vZw??>|){~X=gzaGW0hLi7xQN{1NyXk*$vyH=dj^7@>+98K;*l=)Cq74_k z|1thH8~uF-ek6=%BZPltZ^K5njg1HII{WXA$VRupMiqlP0C-M^C);Q?*l1L4W3e97 zm}ieDc0Z;}8(m#uyrl?R#MhRwwMq~b;YKmC23*(%xQnwlzkN7I;OxV=$we{{LH&^6 z@M?c!aG>>IQ*MpfsH|pAn4sT7fS*HJ&JGi)Dq;p5E)(aYalKygQd(#v!e-So zTP4B6gO9rxzaW-p8_OO*sqiN@hkveSND6e^&90?uVs`#kTC=v1;gk_@J07b;KvXtI4p+f=q5^4Wachr?5EGA%c`Z>#)%*m-^a zdWYQSHyj$#dvKN2c+CjU_MWpFy|=fP(pOPGco5i=R$AC&&0Z&%;OwAJ_{e;e4&(@&PyB6<9?MRj~r9*i;0IjYaT!J{px(Zi;;% zmA@MICjH@f080&TZs3SE#{WYvg|bP&Rnv4>e12WgBX)vscDu8Z{@QF@xYm%u*DdIO z*3NJ`t58)qNwxSjL<{)XKBm^$^#PE8$MR|lCg zb;L@Y&`?KjuTJggU(?1mv=M9CxRo}pp^e#Io7%awrj2j7%4OR4Oc~!$#%`}n?Ety1 zj42w*6dN3+i-tCCdu`TFWi@4*K^!t=a7!+bkquq^p9q?@GgVC&{bXHKLzjQBy)N|= zQB52BWH-siesab3>eLSvHFX*xtn8XPdWB9SYMl5J>Z}*Zb!}`ThLzcrY(zsFxxF^c zT2xc05yxU3AADM9lsvmA7x;o(UBw5|Gro8;!#8i{pb((_cG!pF5?^l-@eME;U!9S( zNo&PsuM0JAGH69P+3Pp|1zrQR5s;T)W&&(OGea~+H!wp+H!?6rMmRM$L_#(*H8?gj zF*HL$FhwypJ|H|ZLo`M=FhfQ+GB8F)I5js!LN+rsI5spfG($o#MKL#*4`%{7f4we) zVHn2o>w56^Ri&@`cyfumrv zabLIPm;ZAm_X7aG0Z3voDe{5>1d32?iw&_QHbq<1#g1r*U54w1U+jr75s0|$TT4uc zaiWy@))YAr5$U&YQ=%ZI#f&J5X+*4xSy2*mVqPo|l}rC%k;vY?QeyaDW#a3_Yl%#r zyq3x1N3Rv~=H6?Se7N;mBj0*n6^7{5tIAO8d({{^127ys8;2i8w_qG~jgvd$bYz@; q8s}vri;asPzujlJO6}Q;@COea9tf8(XaXJ!Ha0gn3MC~)Peuxp51P*a diff --git a/SemSEreport/exercises.tex b/SemSEreport/exercises.tex index 05c762d..545777c 100644 --- a/SemSEreport/exercises.tex +++ b/SemSEreport/exercises.tex @@ -131,7 +131,6 @@ We attempted to implement an automatic weakness detection pipeline by using a mu \item \textbf{Slither}: A highly useful tool that offers a large static analysis toolkit for solidity, it not only allows the extraction of contract data like storage layouts but also automatic scanning for common weaknesses. Although it did not seem to be able to detect SWC-124, the storage layout functionality was used extensively by our team. \end{itemize} - \section{Exploit Creation}\label{sec:exploit-creation} \subsection{Short recap of weakness definitions} @@ -193,7 +192,7 @@ Using the heuristics above, we were not able to find a contract that is vulnerab \subsection{Non-exploitable contracts} -\noindent Solidity files that contained no contracts: +\noindent Solidity files that contained no contracts, just libraries, that would not introduce SWC-124 to the contracts using them as per the heuristics: \begin{itemize} \item AuctionLib.sol @@ -213,7 +212,7 @@ Using the heuristics above, we were not able to find a contract that is vulnerab \item GovernmentAlpha.sol \item HedgeSwap.sol \item HermesImplementation.sol - \item IMETACoin223Token\_13.sol - had this contract been compiled with solidity under 0.8.0, it could have been vulnerable. + \item IMETACoin223Token\_13.sol - had this contract been compiled with solidity under 0.8.0, it would have been vulnerable. \item UniswapV3PoolAdapter.sol \item UserDeposit.sol \item WPCMainnetBridge.sol @@ -223,10 +222,19 @@ Using the heuristics above, we were not able to find a contract that is vulnerab \subsection{Conclusions} +We have proposed initial heuristics which can show us whether a contract is vulnerable to SWC-124. They are easy to understand and apply even in large contracts. +We have demonstrated an example workflow that uses the tool Slither as a data-gathering aid and applies the heuristics. As a result of this workflow, we were unable to find +vulnerable specimen from the examples provided. + \subsection{Lessons learned: what works, what doesn't} +% TODO: Do we have something to add? + \subsection{Open challenges} +The initial heuristics are easy to add to a static code analysis tool, such as Slither. +Afterwards, it can be used to develop a dataset of vulnerable or non-vulnerable samples, which, alongside with manually verified contracts, can be used to improve or expand the heuristics. + \bibliography{exercise.bib} \end{document}