Skip to content

Commit

Permalink
Merge pull request #305 from CoinFabrik/migrate-avoid-core-mem-forget…
Browse files Browse the repository at this point in the history
…-documentation

New avoid-core-mem-forget documentation
  • Loading branch information
matiascabello authored Aug 14, 2024
2 parents 54a8017 + 0d35c6e commit f274b85
Showing 1 changed file with 33 additions and 19 deletions.
52 changes: 33 additions & 19 deletions docs/docs/detectors/7-avoid-core-mem-forget.md
Original file line number Diff line number Diff line change
@@ -1,31 +1,45 @@
# Avoid core mem forget usage
# Avoid core::mem::forget usage

### What it does
## Description

Checks for `core::mem::forget` usage.
- Category: `Best practices`
- Severity: `Enhancement`
- Detector: [`avoid-core-mem-forget`](https://github.com/CoinFabrik/scout-soroban/tree/main/detectors/avoid-core-mem-forget)
- Test Cases: [`avoid-core-mem-forget-1`](https://github.com/CoinFabrik/scout-soroban/tree/main/test-cases/avoid-core-mem-forget/avoid-core-mem-forget-1)

### Why is this bad?

This is a bad practice because it can lead to memory leaks, resource leaks and logic errors.
The `core::mem::forget` function is used to forget about a value without running its destructor.

### Example
## Why is this bad?

```rust
pub fn forget_something(n: WithoutCopy) -> u64 {
core::mem::forget(n);
0
}
```
Using this function is a bad practice because this can lead to memory leaks, resource leaks and logic errors.

## Issue example

Use instead:
Consider the following `Soroban` contract:

```rust
pub fn forget_something(n: WithoutCopy) -> u64 {
let _ = n;
0
}

pub fn forget_something(n: WithoutCopy) -> u64 {
core::mem::forget(n);
0
}
```

### Implementation
The problem arises from the use of the `core::mem::forget` function.

The code example can be found [here](https://github.com/CoinFabrik/scout-soroban/tree/main/test-cases/avoid-core-mem-forget/avoid-core-mem-forget-1/vulnerable-example).


## Remediated example

Use the pattern `let _ = n;` or the `.drop()` method instead of `core::mem::forget(n);`.

## How is it detected?

Checks for `core::mem::forget` usage.

## References

The detector's implementation can be found at [this link](https://github.com/CoinFabrik/scout-soroban/tree/main/detectors/avoid-core-mem-forget).
- [Memory Management](https://docs.alephzero.org/aleph-zero/security-course-by-kudelski-security/ink-developers-security-guideline#memory-management)

0 comments on commit f274b85

Please sign in to comment.