chore: add slither config#12
Conversation
fedgiac
left a comment
fedgiac
left a comment
There was a problem hiding this comment.
Looks good! (Waiting for other PRs to be merged before approving.)
In my experience, Slither is very noisy, so I think we'll eventually end up turning off a lot of the checks. But for now it's fine to start with the defaults and then make tweaks once we learn what we need.
|
Slither actually reports "^0.8" as "too complex" of a version, so we might need to turn off that rule. |
|
(Code is good, just waiting for merging the previous PR.)
While A rule we most likely want to disable is |
|
|
||
| ```shell | ||
| npm install --prefix dev | ||
| python -m venv dev/.venv |
There was a problem hiding this comment.
Consider using uv, i think nowadays is better and more predictable and simple to use.
| .env | ||
|
|
||
| # Local development dependencies | ||
| dev/node_modules/ |
There was a problem hiding this comment.
This PR also has the wrong base branch. This is annoying because every PR we open shows the same changes over and over
There was a problem hiding this comment.
Everything's merging into main, I didn't stack PRs.
| @@ -0,0 +1,4 @@ | |||
| { | |||
| "detectors_to_exclude": "solc-version", | |||
| "filter_paths": "(lib/|test/|script/)" | |||
There was a problem hiding this comment.
This will filter out things like src/lib/Foo.sol
| "filter_paths": "(lib/|test/|script/)" | |
| "filter_paths": "^(lib|test|script)/" |
There was a problem hiding this comment.
That's necessary. We don't want to check those, as lib will contain dependencies we won't change or format.
| @@ -0,0 +1,4 @@ | |||
| { | |||
| "detectors_to_exclude": "solc-version", | |||
There was a problem hiding this comment.
Fairenough about disabling this, but this also adds the risk of the foundry version being in a vulnerable solidity and no-one noticing
Maybe we could have a check-solc recipe in the Justfile in a follow up PR
There was a problem hiding this comment.
Maybe there's better way, but this could work
# Check that foundry.toml's pinned solc has no known medium/high-severity bugs
check-solc:
#!/usr/bin/env bash
set -euo pipefail
SOLC=$(awk -F'"' '/^solc *=/ {print $2; exit}' foundry.toml)
[ -n "$SOLC" ] || { echo "could not read 'solc' from foundry.toml"; exit 1; }
BUGS=$(curl -sfL https://raw.githubusercontent.com/ethereum/solidity/develop/docs/bugs.json)
HITS=$(jq -r --arg v "$SOLC" '
def vparts: split(".") | map(tonumber);
.[]
| select(.severity == "high" or .severity == "medium")
| (.introduced // "0.0.0") as $i
echo "solc $SOLC matches known bugs:"
echo "$HITS"
exit 1
fi
echo "solc $SOLC: no known medium/high-severity bugs"
There was a problem hiding this comment.
I just don't see an issue there.
The thing with excluding solc-version detector is reducing noise when slither complains about ^0.8 pragma we want to use. That pragma is already old and possibly vulnerable. Contracts that get deployed with that pragma will always stay there and exploitable if we've made them so.
Also all Solidity versions have some known issues, that's why they're soon moving to 1.x versioning.
I don't think this will help.
## Summary Stack on top of #12. Replaces the `python -m venv` + `pip install -r dev/requirements.txt` flow with a uv-managed project so slither installs reproducibly and works on Python versions where `ensurepip` is broken (e.g. the Homebrew Python 3.14 build). - `dev/pyproject.toml` declares `slither-analyzer==0.11.5` as the only dependency (`package = false`, no build). - `dev/uv.lock` pins the full transitive tree. - `dev/requirements.txt` is removed — superseded by the lockfile. - README's local-tooling section collapses to one command: `uv sync --project dev`. ## Why uv-native instead of `uv pip install -r requirements.txt` - `requirements.txt` only pinned the top-level dependencies, while`uv.lock` locks the full graph so every contributor. - `uv` is faster - `uv` is more modern and cross platform https://docs.astral.sh/uv/guides/migration/pip-to-project/#project-environments ## Test plan ```shell uv sync --project dev dev/.venv/bin/slither --version dev/.venv/bin/slither src --config-file slither.config.json ``` Co-authored-by: Anxo <2352112+anxolin@users.noreply.github.com>
3 participants
Description
Add a minimal Slither config that uses the local Python dependency.
Context
Slither runs against
srcby default. Thesolc-versiondetector is disabled because the template intentionally keeps broad^0.8pragmas for easier integration.Out of Scope
This PR does not add Justfile commands, CI, or hooks.
Testing Instructions
python -m venv dev/.venv.dev/.venv/bin/pip install -r dev/requirements.txt.dev/.venv/bin/slither src --config-file slither.config.json.