New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

parent and child insurance stubs #272

Merged

godzillaba merged 2 commits into devjam-interop from devjam-henry-child-insurance

Dec 4, 2024

Merged

parent and child insurance stubs #272

implement buy

GitHub Advanced Security / Slither failed Dec 4, 2024 in 5s

3 new alerts including 2 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

2 high
1 medium

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 38 in src/insurance/Parent.sol

Code scanning / Slither

Uninitialized state variables High

Parent.depositedAmount is never initialized. It is used in:
- Parent.buy(uint256,Parent.SequencerCommitment,bytes,Parent.RetryableParams)

Check failure on line 125 in src/insurance/Parent.sol

Code scanning / Slither

Reentrancy vulnerabilities High

Reentrancy in Parent.buy(uint256,Parent.SequencerCommitment,bytes,Parent.RetryableParams):
External calls:
- inbox.createRetryableTicket{value: msg.value}({to:childChainContract,l2CallValue:commitment.insuranceCost,maxSubmissionCost:retryableParams.maxSubmissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:retryableParams.gasLimit,maxFeePerGas:retryableParams.gasPrice,data:data})
State variables written after the call(s):
- sequenceNumber ++
Parent.sequenceNumber can be used in cross function reentrancies:
- Parent.buy(uint256,Parent.SequencerCommitment,bytes,Parent.RetryableParams)
- Parent.sequenceNumber

Check warning on line 125 in src/insurance/Parent.sol

Code scanning / Slither

Unused return Medium

Parent.buy(uint256,Parent.SequencerCommitment,bytes,Parent.RetryableParams) ignores return value by inbox.createRetryableTicket{value: msg.value}({to:childChainContract,l2CallValue:commitment.insuranceCost,maxSubmissionCost:retryableParams.maxSubmissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:retryableParams.gasLimit,maxFeePerGas:retryableParams.gasPrice,data:data})