Merge branch 'dev' of github.com:crytic/slither into dev

CONTRIBUTING.md

@@ -32,10 +32,10 @@ To run the unit tests, you need
 
 Several linters and security checkers are run on the PRs.
 
-To run them locally:
+To run them locally in the root dir of the repository:
 
-- `pylint slither --rcfile pyproject.toml`
-- `black slither --config pyproject.toml`
+- `pylint slither tests --rcfile pyproject.toml`
+- `black . --config pyproject.toml`
 
 We use black `19.10b0`.
 ### Detectors tests

slither/core/declarations/function.py

@@ -43,7 +43,6 @@
     from slither.core.expressions.expression import Expression
     from slither.slithir.operations import Operation
     from slither.slither import Slither
-    from slither.core.cfg.node import NodeType
     from slither.core.slither_core import SlitherCore
 
 LOGGER = logging.getLogger("Function")
@@ -299,17 +298,18 @@ def can_reenter(self, callstack=None) -> bool:
 
     def can_send_eth(self) -> bool:
         """
-        Check if the function can send eth
+        Check if the function or any internal (not external) functions called by it can send eth
         :return bool:
         """
         from slither.slithir.operations import Call
 
         if self._can_send_eth is None:
+            self._can_send_eth = False
             for ir in self.all_slithir_operations():
                 if isinstance(ir, Call) and ir.can_send_eth():
                     self._can_send_eth = True
                     return True
-        return self._can_reenter
+        return self._can_send_eth
 
     @property
     def slither(self) -> "SlitherCore":

tests/detectors/reentrancy-benign/reentrancy-benign.sol

@@ -0,0 +1,61 @@
+pragma solidity ^0.4.0;
+
+contract ReentrancyBenign {
+    uint8 anotherVariableToChange;
+    uint8 counter = 0;
+
+    function bad0() public {
+        if (!(msg.sender.call())) {
+            revert();
+        }
+        counter += 1;
+    }
+
+    function bad1(address target) public {
+        (bool success) = target.call();
+        require(success);
+        counter += 1;
+    }
+
+    function bad2(address target) public {
+        (bool success) = target.call();
+        if (success) {
+            address(target).call.value(1000)();
+            counter += 1;
+        }
+        else {
+            revert();
+        }
+    }
+
+    function bad3(address target) public {
+        externalCaller(target);
+        varChanger();
+        ethSender(target);
+    }
+
+    function bad4(address target) public {
+        externalCaller(target);
+        ethSender(address(0));
+        varChanger();
+        address(target).call.value(2)();
+    }
+
+    function bad5(address target) public {
+        ethSender(address(0));
+        varChanger();
+        ethSender(address(0));
+    }
+
+    function externalCaller(address target) private {
+        address(target).call();
+    }
+
+    function ethSender(address target) private {
+        address(target).call.value(1)();
+    }
+
+    function varChanger() private {
+        anotherVariableToChange++;
+    }
+}