Class UnprotectedCall

A detector that identifies unprotected calls or state modifications.

Why is it bad?

Without conditions or permission checks, some calls can be exploited to disrupt the contract's intended behavior or allow malicious actors to perform unauthorized actions. For example, a publicly accessible set function in a mapping or an unguarded send call can enable draining contract's funds, denial-of-service (DoS) attacks or other malicious activities.

Example

receive(msg: Insert) {
    // Bad: No protection for the mapping update
    m.set(msg.key, msg.val);
}

Use instead:

receive(msg: Insert) {
    // OK: Permission check ensures only the owner can modify the state
    require(ctx.sender == this.owner, "Invalid sender");
    m.set(msg.key, msg.val);
}

Hierarchy (view full)

Constructors

constructor

Properties

category ctx severity

Accessors

id kind shareImportedWarnings usesSouffle

Methods

check getCategory getSeverity makeWarning skipUnused

Constructors

constructor

Properties

category

category: Category = Category.SECURITY

Readonlyctx

ctx: MistiContext

severity

severity: Severity = Severity.HIGH

Accessors

id

  • get id(): string

  • Gets the short identifier of the detector, used in analyzer warnings.

    Returns string

    The unique identifier of the detector.

kind

shareImportedWarnings

  • get shareImportedWarnings(): WarningsBehavior

  • Defines the behavior of warnings generated by this detector when working with multiple projects within a single Tact configuration.

    Here are the available options:

    1. "union" Leave this value if you don't care about warnings generated in other projects.
    2. "intersect" If the warning is generated for some source location of the imported file, it should be generated by each of the projects. Example: Constants from an imported file should not be reported iff they are unused in all the projects, so you need "intersect".

    Returns WarningsBehavior

usesSouffle

  • get usesSouffle(): boolean

  • Checks whether this detector needs the Soufflé binary to be executed.

    Returns boolean

Methods

check

getCategory

getSeverity

ProtectedmakeWarning

ProtectedskipUnused

Settings

Member Visibility

On This Page

Why is it bad?Example
Constructors
Properties
Accessors
Methods