Insecure Transaction Tracing
Description
Using built-in transaction tracers can be dangerous if measures are not taken to filter out reverted call frames. Review the related code to ensure that reverted call frames and their associated subtraces are filtered out from any analysis and the transaction being traced is from a finalized block.
Examples
Insecure Code
go
RECEIVER.TraceTransaction(CTX, FILTER, TRACECONF)Secure Code
go
RECEIVER.TraceTransaction(CTX, FILTER, TRACECONF) with reverted call frames filtered outRemediation
Implement logic to filter out reverted call frames and ensure the transaction is from a finalized block.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0190 |
| Category | Blockchain |
| Severity | HIGH |
| CWE | CWE-1284 |
| Confidence | LOW |
| Impact | HIGH |
| Likelihood | MEDIUM |
| Exploitability | MODERATE |
| Tags | security, audit |
| OWASP | N/A |