Skip to content

Commit 9f1890d

Browse files
malaverdiereclaude
andcommitted
fix(solidity): move basic-oracle-manipulation ruleid annotation to the matching line
The `pattern: $X.div($Y)` match for `underlyingUnit.mul(balanceWithInvested()).div(totalSupply())` is textually on the line with the `:` (else) branch of the ternary, not the line where the enclosing assignment starts. Confirmed by parsing this snippet directly: the `.div(...)` call_expression's span is entirely on that line. The `// ruleid:` annotation was one line above the wrong branch, which happened to line up with a less precise (pre-tree-sitter-solidity v1.2.13) parse of this multi-line ternary. Move the annotation immediately above the branch actually being matched. Surfaced by semgrep/ocaml-tree-sitter-semgrep#626 (tree-sitter-solidity bump to v1.2.13), which produces the correct AST here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1 parent 81634cf commit 9f1890d

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

solidity/security/basic-oracle-manipulation.sol

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,9 @@ contract OneRingVault is ERC20Upgradeable, OwnableUpgradeable {
9797
balance = IStrategy(activeStrategy).investedBalanceInUSD();
9898
}
9999
function getSharePrice() public view returns (uint256 _sharePrice) {
100-
// ruleid: basic-oracle-manipulation
101100
_sharePrice = totalSupply() == 0
102101
? underlyingUnit
102+
// ruleid: basic-oracle-manipulation
103103
: underlyingUnit.mul(balanceWithInvested()).div(totalSupply());
104104

105105
if (_sharePrice < underlyingUnit) {

0 commit comments

Comments
 (0)