Skip to content

Vulnerability found with Solidity 0.7 but not 0.8 #1908

@TheresaBo

Description

@TheresaBo

I am testing Mythril on the vulnerability of unchecked return values of low-level calls (SWC-104) and several Solidity versions.
In the following contract Mythril detects the vulnerability with Solidity version 0.7.6. In the exact same contract but version 0.8.29 it doesn't. I've used Mythril version 0.24.7 in sourcecode mode and bytecode mode.
I've encountered this behaviour also with the constructs staticcall and delegatecall in similarly designed contracts.

What is the reason or motivation behind this?
Thank you for the help!

pragma solidity 0.7.6;

contract Contract_100 {
    constructor() public {
    }
    function test(address callAddress) public {
        callAddress.call(abi.encodeWithSignature("foo()"));
    }
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions