[False-Positive]:msg.value in a loop when msg.value is not transferred

[CJ42]

Describe the issue:

In the following code snippet, Slither detects the following:

This seems invalid as msg.value here is just checked as a conditional to ensure no value is sent to this function. In any case, no logic inside this function (including inside the internal _transfer function) forwards msg.value.

Code example to reproduce the issue:

    modifier noNativeTokens() {
        require(msg.value == 0, "Not aimed to receive native tokens");
        _;
    }
    
   function executeRelayCallBatch(
        bytes[] calldata signatures,
        uint256[] calldata nonces,
        uint256[] calldata validityTimestamps,
        uint256[] calldata values,
        bytes[] calldata payloads
    ) public payable noNativeTokens returns (bytes[] memory) {
        if (
            signatures.length != nonces.length ||
            nonces.length != validityTimestamps.length ||
            validityTimestamps.length != values.length ||
            values.length != payloads.length
        ) {
            revert("Batch ExecuteRelayCall Params Length Mismatch");
        }

        bytes[] memory castedVotes = new bytes[](payloads.length);

        for (uint256 ii; ii < payloads.length; ++ii) {
            require(values[ii] == 0, "Batch entry cannot contain value");

            // cast each votes one by one
            castedVotes[ii] = executeRelayCall(
                signatures[ii],
                nonces[ii],
                validityTimestamps[ii],
                payloads[ii]
            );
        }

        return castedVotes;
    }

Version:

0.10.0

Relevant log output:

No response

[0xalpharush]

Thanks for this! Fwiw there is a dedicated issue template for false positives. We can likely update the detector to check if the use of msg.value is only in a conditional (require, assert, if-revert) and not detect those cases, but we may need to inspect whether it's being compared to zero (cc @smonicas )

slither/slither/core/cfg/node.py

Line 545 in e3dcf1e

def is_conditional(self, include_loop: bool = True) -> bool:

slither/slither/detectors/statements/msg_value_in_loop.py

Lines 38 to 42 in e3dcf1e

	for ir in node.all_slithir_operations():
	if in_loop_counter > 0 and SolidityVariableComposed("msg.value") in ir.read:
	results.append(ir.node)
	if isinstance(ir, (InternalCall)):
	msg_value_in_loop(ir.function.entry_point, in_loop_counter, visited, results)