Module arbitrary_send_eth

Structs§

Analyzer 🔒
CallerGuards 🔒: Recognises guards that restrict msg.sender to a deploy-time-fixed principal, backed by a memoised analysis of which state variables may alias address(this).
SelfAssignScan 🔒: Scans one function, its modifiers / base constructors and inlined internal helpers for an assignment that may plant address(this) into target.
State 🔒: Path-sensitive facts.

HELPER_CALL_DEPTH 🔒: Cap on inlined helper calls (covers ctor → _init → _initInner → _initLeaf).
HELPER_DEPTH 🔒: Recursion budget for _msgSender()-style helper chains.
SELF_ALIAS_DEPTH 🔒: Recursion budget for self-alias chains.

expr_is_array_or_bytes 🔒
expr_is_function 🔒
identity_helper_arg 🔒: Argument returned verbatim (modulo casts) by an identity helper call id(x) / Lib.id(x).
index_is_static 🔒: True when an index expression only depends on literals and state: no locals, parameters, builtins (msg.sender) or non-cast calls.
invoked_function 🔒: The function invoked by a modifier or base-constructor invocation.
is_msg_sender_like 🔒: msg.sender modulo parens, casts, payable(..) and no-arg helpers such as _msgSender().
is_numeric_cast 🔒: uint<N>(..) / int<N>(..) cast head.
is_trusted_literal 🔒: An address literal or the integer literal 0.
lhs_root_var 🔒: Variable at the root of an lvalue, through member / index accesses and address casts.
match_eth_library_call 🔒: Destination of an OpenZeppelin Address / Solady SafeTransferLib ETH helper, called either statically (Lib.f(to, ...)) or via using ... for address (to.f(...)).
match_sink 🔒: Destination of an ETH-sending call: selfdestruct(x), x.{call,send,transfer}, f{value: v}(), IFoo(x).f{value: v}() and common OpenZeppelin/Solady helpers. Sends to address(this) or of a literal-zero amount are not sinks.
peel_casts 🔒: Looks through parens, payable(..), address-like casts and integer casts.
stmt_contains_return 🔒: True when any statement of a helper body is a return (bare or valued).