Interprocedural Taint Analysis

[jubnzv]

We should define a path-sensitive interprocedural analysis suitable to be used in all the detectors and store it to the IR:

• path-sensitivity is required since detectors like UnprotectedCall (New detector: UnprotectedCall #235) need access to paths in order to check if taints are guarded in conditions
• consider receivers and their arguments as entry points and taints
• track contract fields as a source of taint (without path sensitivity)
• to handle loops I would use limited unrolling and approximate results (accepting partial loss of path information)

The suitable approach seems to be using IFDS as described in the original paper which should be extended with path-sensitive tracking where required.