diff --git a/package.json b/package.json index 75ffabda..e48909cb 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,8 @@ "deploy-eth-rollup": "hardhat run scripts/createEthRollup.ts", "deploy-erc20-rollup": "hardhat run scripts/createERC20Rollup.ts", "create-rollup-testnode": "hardhat run scripts/local-deployment/deployCreatorAndCreateRollup.ts", - "deploy-cachemanager-testnode": "hardhat run scripts/local-deployment/deployCacheManager.ts" + "deploy-cachemanager-testnode": "hardhat run scripts/local-deployment/deployCacheManager.ts", + "slither-triage": "slither . --skip-assembly --triage-mode" }, "dependencies": { "@offchainlabs/upgrade-executor": "1.1.0-beta.0", diff --git a/slither.db.json b/slither.db.json new file mode 100644 index 00000000..8086a94f --- /dev/null +++ b/slither.db.json @@ -0,0 +1 @@ +[{"elements": [{"type": "function", "name": "_executeLowLevelCall", "source_mapping": {"start": 1379, "length": 299, "filename_relative": "src/bridge/Bridge.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/bridge/Bridge.sol", "filename_short": "src/bridge/Bridge.sol", "is_dependency": false, "lines": [42, 43, 44, 45, 46, 47, 48, 49], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "Bridge", "source_mapping": {"start": 702, "length": 1090, "filename_relative": "src/bridge/Bridge.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/bridge/Bridge.sol", "filename_short": "src/bridge/Bridge.sol", "is_dependency": false, "lines": [20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54], "starting_column": 1, "ending_column": 2}}, "signature": "_executeLowLevelCall(address,uint256,bytes)"}}, {"type": "node", "name": "(success,returnData) = to.call{value: value}(data)", "source_mapping": {"start": 1620, "length": 51, "filename_relative": "src/bridge/Bridge.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/bridge/Bridge.sol", "filename_short": "src/bridge/Bridge.sol", "is_dependency": false, "lines": [48], "starting_column": 9, "ending_column": 60}, "type_specific_fields": {"parent": {"type": "function", "name": "_executeLowLevelCall", "source_mapping": {"start": 1379, "length": 299, "filename_relative": "src/bridge/Bridge.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/bridge/Bridge.sol", "filename_short": "src/bridge/Bridge.sol", "is_dependency": false, "lines": [42, 43, 44, 45, 46, 47, 48, 49], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "Bridge", "source_mapping": {"start": 702, "length": 1090, "filename_relative": "src/bridge/Bridge.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/bridge/Bridge.sol", "filename_short": "src/bridge/Bridge.sol", "is_dependency": false, "lines": [20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54], "starting_column": 1, "ending_column": 2}}, "signature": "_executeLowLevelCall(address,uint256,bytes)"}}}}], "description": "Bridge._executeLowLevelCall(address,uint256,bytes) (src/bridge/Bridge.sol#42-49) sends eth to arbitrary user\n\tDangerous calls:\n\t- (success,returnData) = to.call{value: value}(data) (src/bridge/Bridge.sol#48)\n", "markdown": "[Bridge._executeLowLevelCall(address,uint256,bytes)](src/bridge/Bridge.sol#L42-L49) sends eth to arbitrary user\n\tDangerous calls:\n\t- [(success,returnData) = to.call{value: value}(data)](src/bridge/Bridge.sol#L48)\n", "first_markdown_element": "src/bridge/Bridge.sol#L42-L49", "id": "52aa149e251bcbda3478032a3845253462c6d80e50cde35746a072dd6dd226a6", "check": "arbitrary-send-eth", "impact": "High", "confidence": "Medium"}, {"elements": [{"type": "function", "name": "_fundAndDeploy", "source_mapping": {"start": 8525, "length": 2154, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "DeployHelper", "source_mapping": {"start": 525, "length": 11692, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160], "starting_column": 1, "ending_column": 2}}, "signature": "_fundAndDeploy(address,uint256,address,bytes,address,uint256)"}}, {"type": "node", "name": "IInbox(inbox).createRetryableTicket{value: feeAmount}({to:_l2Address,l2CallValue:_value,maxSubmissionCost:submissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:GASLIMIT,maxFeePerGas:maxFeePerGas,data:})", "source_mapping": {"start": 10156, "length": 399, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [87, 88, 89, 90, 91, 92, 93, 94, 95, 96], "starting_column": 13, "ending_column": 15}, "type_specific_fields": {"parent": {"type": "function", "name": "_fundAndDeploy", "source_mapping": {"start": 8525, "length": 2154, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "DeployHelper", "source_mapping": {"start": 525, "length": 11692, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160], "starting_column": 1, "ending_column": 2}}, "signature": "_fundAndDeploy(address,uint256,address,bytes,address,uint256)"}}}}], "description": "DeployHelper._fundAndDeploy(address,uint256,address,bytes,address,uint256) (src/rollup/DeployHelper.sol#46-100) sends eth to arbitrary user\n\tDangerous calls:\n\t- IInbox(inbox).createRetryableTicket{value: feeAmount}({to:_l2Address,l2CallValue:_value,maxSubmissionCost:submissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:GASLIMIT,maxFeePerGas:maxFeePerGas,data:}) (src/rollup/DeployHelper.sol#87-96)\n", "markdown": "[DeployHelper._fundAndDeploy(address,uint256,address,bytes,address,uint256)](src/rollup/DeployHelper.sol#L46-L100) sends eth to arbitrary user\n\tDangerous calls:\n\t- [IInbox(inbox).createRetryableTicket{value: feeAmount}({to:_l2Address,l2CallValue:_value,maxSubmissionCost:submissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:GASLIMIT,maxFeePerGas:maxFeePerGas,data:})](src/rollup/DeployHelper.sol#L87-L96)\n", "first_markdown_element": "src/rollup/DeployHelper.sol#L46-L100", "id": "58b5f7a8d77486bc6173862a853121ecdf5d9979f84cc2e05b66e0f0fd11218c", "check": "arbitrary-send-eth", "impact": "High", "confidence": "Medium"}, {"elements": [{"type": "function", "name": "perform", "source_mapping": {"start": 10685, "length": 1095, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "DeployHelper", "source_mapping": {"start": 525, "length": 11692, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160], "starting_column": 1, "ending_column": 2}}, "signature": "perform(address,address,uint256)"}}, {"type": "node", "name": "address(msg.sender).transfer(address(this).balance)", "source_mapping": {"start": 11712, "length": 51, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [142], "starting_column": 13, "ending_column": 64}, "type_specific_fields": {"parent": {"type": "function", "name": "perform", "source_mapping": {"start": 10685, "length": 1095, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "DeployHelper", "source_mapping": {"start": 525, "length": 11692, "filename_relative": "src/rollup/DeployHelper.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/DeployHelper.sol", "filename_short": "src/rollup/DeployHelper.sol", "is_dependency": false, "lines": [13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160], "starting_column": 1, "ending_column": 2}}, "signature": "perform(address,address,uint256)"}}}}], "description": "DeployHelper.perform(address,address,uint256) (src/rollup/DeployHelper.sol#102-144) sends eth to arbitrary user\n\tDangerous calls:\n\t- address(msg.sender).transfer(address(this).balance) (src/rollup/DeployHelper.sol#142)\n", "markdown": "[DeployHelper.perform(address,address,uint256)](src/rollup/DeployHelper.sol#L102-L144) sends eth to arbitrary user\n\tDangerous calls:\n\t- [address(msg.sender).transfer(address(this).balance)](src/rollup/DeployHelper.sol#L142)\n", "first_markdown_element": "src/rollup/DeployHelper.sol#L102-L144", "id": "ce5c492f55419016b34eb4e4de36fb8212599a42274960d6402d10a63f45ad40", "check": "arbitrary-send-eth", "impact": "High", "confidence": "Medium"}, {"elements": [{"type": "function", "name": "_deployFactories", "source_mapping": {"start": 10667, "length": 2520, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "RollupCreator", "source_mapping": {"start": 703, "length": 12941, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336], "starting_column": 1, "ending_column": 2}}, "signature": "_deployFactories(address,address,uint256)"}}, {"type": "node", "name": "l2FactoriesDeployer.perform{value: cost}(_inbox,_nativeToken,_maxFeePerGas)", "source_mapping": {"start": 11074, "length": 77, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [270], "starting_column": 13, "ending_column": 90}, "type_specific_fields": {"parent": {"type": "function", "name": "_deployFactories", "source_mapping": {"start": 10667, "length": 2520, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "RollupCreator", "source_mapping": {"start": 703, "length": 12941, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336], "starting_column": 1, "ending_column": 2}}, "signature": "_deployFactories(address,address,uint256)"}}}}, {"type": "node", "name": "(sent,None) = msg.sender.call{value: address(this).balance}()", "source_mapping": {"start": 11262, "length": 65, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [274], "starting_column": 13, "ending_column": 78}, "type_specific_fields": {"parent": {"type": "function", "name": "_deployFactories", "source_mapping": {"start": 10667, "length": 2520, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319], "starting_column": 5, "ending_column": 6}, "type_specific_fields": {"parent": {"type": "contract", "name": "RollupCreator", "source_mapping": {"start": 703, "length": 12941, "filename_relative": "src/rollup/RollupCreator.sol", "filename_absolute": "/Users/sejanus/code/nitro-contracts/src/rollup/RollupCreator.sol", "filename_short": "src/rollup/RollupCreator.sol", "is_dependency": false, "lines": [17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336], "starting_column": 1, "ending_column": 2}}, "signature": "_deployFactories(address,address,uint256)"}}}}], "description": "RollupCreator._deployFactories(address,address,uint256) (src/rollup/RollupCreator.sol#257-319) sends eth to arbitrary user\n\tDangerous calls:\n\t- l2FactoriesDeployer.perform{value: cost}(_inbox,_nativeToken,_maxFeePerGas) (src/rollup/RollupCreator.sol#270)\n\t- (sent,None) = msg.sender.call{value: address(this).balance}() (src/rollup/RollupCreator.sol#274)\n", "markdown": "[RollupCreator._deployFactories(address,address,uint256)](src/rollup/RollupCreator.sol#L257-L319) sends eth to arbitrary user\n\tDangerous calls:\n\t- [l2FactoriesDeployer.perform{value: cost}(_inbox,_nativeToken,_maxFeePerGas)](src/rollup/RollupCreator.sol#L270)\n\t- [(sent,None) = msg.sender.call{value: address(this).balance}()](src/rollup/RollupCreator.sol#L274)\n", "first_markdown_element": "src/rollup/RollupCreator.sol#L257-L319", "id": "e32ac19fa5acfe09c5801bc159274ba4eec6af7ab2f6419b30ee33d02c33277f", "check": "arbitrary-send-eth", "impact": "High", "confidence": "Medium"}] \ No newline at end of file