智慧合約檢測工具Mythril掃描合約教學以及如何安裝到docker

安裝方式：

docker

docker pull mythril/myth

pip

pip3 install mythril

docker run -v $(pwd): (path) mythril/myth analyze /(path)/(contract name).sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;
contract EtherStore {
　　mapping(address => uint) public balances;
　　function deposit() public payable {
　　balances[msg.sender] += msg.value;
　　}　　
function withdraw() public {
　　uint bal = balances[msg.sender];
　　require(bal > 0);
　　(bool sent, ) = msg.sender.call{value: bal}("");
　　require(sent, "Failed to send Ether");
　　balances[msg.sender] = 0;
　　}
// Helper function to check the balance of this contract
function getBalance() public view returns (uint) {
　　return address(this).balance;
　　}
}

==== External Call To User-Supplied Address ====
SWC ID: 107
Severity: Low
Contract: EtherStore
Function name: withdraw()
PC address: 368
Estimated Gas Usage: 7278 - 62222
A call to a user-supplied address is executed.
An external message call to an address specified by the caller is executed. Note that the callee account might contain arbitrary code and could re-enter any function within this contract. Reentering the contract in an intermediate state may lead to unexpected behaviour. Make sure that no state modifications are executed after this call and/or reentrancy guards are in place.
--------------------
In file: /Downloads/reentrancy.sol:42
msg.sender.call{value: bal}("")
--------------------
Initial State:
Account: [CREATOR], balance: 0x21000537b4, nonce:0, storage:{}
Account: [ATTACKER], balance: 0x20200000000000000, nonce:0, storage:{}
Transaction Sequence:
Caller: [CREATOR], calldata: , value: 0x0
Caller: [ATTACKER], function: deposit(), txdata: 0xd0e30db0, value: 0x1
Caller: [ATTACKER], function: withdraw(), txdata: 0x3ccfd60b, value: 0x0
==== State access after external call ====
SWC ID: 107
Severity: Medium
Contract: EtherStore
Function name: withdraw()
PC address: 556
Estimated Gas Usage: 7278 - 62222
Write to persistent state following external call
The contract account state is accessed after an external call to a user defined address. To prevent reentrancy issues, consider accessing the state only before the call, especially if the callee is untrusted. Alternatively, a reentrancy lock can be used to prevent untrusted callees from re-entering the contract in an intermediate state.
--------------------
In file: /Downloads/reentrancy.sol:45
balances[msg.sender] = 0
--------------------
Initial State:
Account: [CREATOR], balance: 0x21200082d2d9, nonce:0, storage:{}
Account: [ATTACKER], balance: 0x4801000000228c000, nonce:0, storage:{}
Transaction Sequence:
Caller: [CREATOR], calldata: , value: 0x0
Caller: [ATTACKER], function: deposit(), txdata: 0xd0e30db0, value: 0x1
Caller: [ATTACKER], function: withdraw(), txdata: 0x3ccfd60b, value: 0x0

掃描鏈上合約：

掃描主網(mainnet)合約

docker run --rm mythril/myth analyze -a [contract address] --rpc infura-mainnet https://mainnet.infura.io/v3/0df6422189fd41f7bf22587cb3d9bda2 --rpctls True --infura-id [yourApiKey]

掃描BSC(Binance Smart Chain)合約

docker run --rm mythril/myth analyze -a [contract address] --rpc bsc-dataseed1.binance.org:443 --rpctls True --infura-id [yourApiKey]

掃描本地鏈上的合約 (以下以Ganache舉例)

docker run --rm mythril/myth analyze -a [contract address] --rpc host.docker.internal:[portNumber]

輸出格式

結論