mcp-server-semgrep/semgrep-rules/solidity/security/arbitrary-send-erc20.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: arbitrary-send-erc20
  patterns:
  - pattern: $FUNC.transferFrom(...)
  - pattern-not: $FUNC.transferFrom(..., msg.sender, ...)
  message: msg.sender is not being used when calling erc20.transferFrom. Example -
    Alice approves this contract to spend her ERC20 tokens. Bob can call function
    'a' and specify Alice's address as the from parameter in transferFrom, allowing
    him to transfer Alice's tokens to himself.
  languages:
  - solidity
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: HIGH
    confidence: LOW
    subcategory:
      - audit
    category: security
    technology:
    - solidity
    cwe:
    - 'CWE-285: Improper Authorization'
    references:
    - https://github.com/crytic/slither/wiki/Detector-Documentation#arbitrary-from-in-transferfrom
    - https://cwe.mitre.org/data/definitions/285.html
    owasp:
    - A01:2021 - Broken Access Control