Merge pull request #3099 from ethereum/develop

Merge develop into release for 0.4.18.

13 files changed, 103 insertions, 22 deletions

diff --git a/docs/abi-spec.rst b/docs/abi-spec.rst
index 29d98645..43757d24 100644
--- a/docs/abi-spec.rst
+++ b/docs/abi-spec.rst
@@ -279,7 +279,7 @@ Events
 
 Events are an abstraction of the Ethereum logging/event-watching protocol. Log entries provide the contract's address, a series of up to four topics and some arbitrary length binary data. Events leverage the existing function ABI in order to interpret this (together with an interface spec) as a properly typed structure.
 
-Given an event name and series of event parameters, we split them into two sub-series: those which are indexed and those which are not. Those which are indexed, which may number up to 3, are used alongside the Keccak hash of the event signature to form the topics of the log entry. Those which as not indexed form the byte array of the event.
+Given an event name and series of event parameters, we split them into two sub-series: those which are indexed and those which are not. Those which are indexed, which may number up to 3, are used alongside the Keccak hash of the event signature to form the topics of the log entry. Those which are not indexed form the byte array of the event.
 
 In effect, a log entry using this ABI is described as:
 
@@ -442,3 +442,22 @@ would result in the JSON:
       "outputs": []
     }
   ]
+
+.. _abi_packed_mode:
+
+Non-standard Packed Mode
+========================
+
+Solidity supports a non-standard packed mode where:
+
+- no :ref:`function selector <abi_function_selector>` is encoded,
+- short types are not zero padded and
+- dynamic types are encoded in-place and without the length.
+
+As an example encoding ``uint1, bytes1, uint8, string`` with values ``1, 0x42, 0x2424, "Hello, world!"`` results in ::
+
+    0x0142242448656c6c6f2c20776f726c6421
+      ^^                                 uint1(1)
+        ^^                               bytes1(0x42)
+          ^^^^                           uint8(0x2424)
+              ^^^^^^^^^^^^^^^^^^^^^^^^^^ string("Hello, world!") without a length field
diff --git a/docs/bugs.json b/docs/bugs.json
index ac322a48..c642793a 100644
--- a/docs/bugs.json
+++ b/docs/bugs.json
@@ -1,5 +1,12 @@
 [
     {
+        "name": "ZeroFunctionSelector",
+        "summary": "It is possible to craft the name of a function such that it is executed instead of the fallback function in very specific circumstances.",
+        "description": "If a function has a selector consisting only of zeros, is payable and part of a contract that does not have a fallback function and at most five external functions in total, this function is called instead of the fallback function if Ether is sent to the contract without data.",
+        "fixed": "0.4.18",
+        "severity": "very low"
+    },
+    {
         "name": "DelegateCallReturnValue",
         "summary": "The low-level .delegatecall() does not return the execution outcome, but converts the value returned by the functioned called to a boolean instead.",
         "description": "The return value of the low-level .delegatecall() function is taken from a position in memory, where the call data or the return data resides. This value is interpreted as a boolean and put onto the stack. This means if the called function returns at least 32 zero bytes, .delegatecall() returns false even if the call was successuful.",
diff --git a/docs/bugs.rst b/docs/bugs.rst
index 55771a35..7629830d 100644
--- a/docs/bugs.rst
+++ b/docs/bugs.rst
@@ -48,7 +48,7 @@ fixed
 publish
     The date at which the bug became known publicly, optional
 severity
-    Severity of the bug: low, medium, high. Takes into account
+    Severity of the bug: very low, low, medium, high. Takes into account
     discoverability in contract tests, likelihood of occurrence and
     potential damage by exploits.
 conditions
diff --git a/docs/bugs_by_version.json b/docs/bugs_by_version.json
index c3686ebf..cca45428 100644
--- a/docs/bugs_by_version.json
+++ b/docs/bugs_by_version.json
@@ -1,6 +1,7 @@
 {
     "0.1.0": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -17,6 +18,7 @@
     }, 
     "0.1.1": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -33,6 +35,7 @@
     }, 
     "0.1.2": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -49,6 +52,7 @@
     }, 
     "0.1.3": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -65,6 +69,7 @@
     }, 
     "0.1.4": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -81,6 +86,7 @@
     }, 
     "0.1.5": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -97,6 +103,7 @@
     }, 
     "0.1.6": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -114,6 +121,7 @@
     }, 
     "0.1.7": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -131,6 +139,7 @@
     }, 
     "0.2.0": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -148,6 +157,7 @@
     }, 
     "0.2.1": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -165,6 +175,7 @@
     }, 
     "0.2.2": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
             "ConstantOptimizerSubtraction", 
@@ -182,6 +193,7 @@
     }, 
     "0.3.0": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -199,6 +211,7 @@
     }, 
     "0.3.1": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -215,6 +228,7 @@
     }, 
     "0.3.2": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -231,6 +245,7 @@
     }, 
     "0.3.3": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -246,6 +261,7 @@
     }, 
     "0.3.4": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -261,6 +277,7 @@
     }, 
     "0.3.5": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -276,6 +293,7 @@
     }, 
     "0.3.6": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -289,6 +307,7 @@
     }, 
     "0.4.0": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -302,6 +321,7 @@
     }, 
     "0.4.1": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -315,6 +335,7 @@
     }, 
     "0.4.10": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -324,6 +345,7 @@
     }, 
     "0.4.11": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral"
@@ -332,6 +354,7 @@
     }, 
     "0.4.12": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput"
         ], 
@@ -339,6 +362,7 @@
     }, 
     "0.4.13": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput"
         ], 
@@ -346,24 +370,36 @@
     }, 
     "0.4.14": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue"
         ], 
         "released": "2017-07-31"
     }, 
     "0.4.15": {
-        "bugs": [], 
+        "bugs": [
+            "ZeroFunctionSelector"
+        ], 
         "released": "2017-08-08"
     }, 
     "0.4.16": {
-        "bugs": [], 
+        "bugs": [
+            "ZeroFunctionSelector"
+        ], 
         "released": "2017-08-24"
     }, 
     "0.4.17": {
-        "bugs": [], 
+        "bugs": [
+            "ZeroFunctionSelector"
+        ], 
         "released": "2017-09-21"
     }, 
+    "0.4.18": {
+        "bugs": [], 
+        "released": "2017-10-18"
+    }, 
     "0.4.2": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -376,6 +412,7 @@
     }, 
     "0.4.3": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -387,6 +424,7 @@
     }, 
     "0.4.4": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -397,6 +435,7 @@
     }, 
     "0.4.5": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -408,6 +447,7 @@
     }, 
     "0.4.6": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -418,6 +458,7 @@
     }, 
     "0.4.7": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -427,6 +468,7 @@
     }, 
     "0.4.8": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
@@ -436,6 +478,7 @@
     }, 
     "0.4.9": {
         "bugs": [
+            "ZeroFunctionSelector", 
             "DelegateCallReturnValue", 
             "ECRecoverMalformedInput", 
             "SkipEmptyStringLiteral", 
diff --git a/docs/common-patterns.rst b/docs/common-patterns.rst
index acef13b7..52319be0 100644
--- a/docs/common-patterns.rst
+++ b/docs/common-patterns.rst
@@ -93,7 +93,7 @@ Notice that, in this example, an attacker could trap the
 contract into an unusable state by causing ``richest`` to be
 the address of a contract that has a fallback function
 which fails (e.g. by using ``revert()`` or by just
-conssuming more than the 2300 gas stipend). That way,
+consuming more than the 2300 gas stipend). That way,
 whenever ``transfer`` is called to deliver funds to the
 "poisoned" contract, it will fail and thus also ``becomeRichest``
 will fail, with the contract being stuck forever.
@@ -121,7 +121,7 @@ unless you declare make your state variables ``public``.
 
 Furthermore, you can restrict who can make modifications
 to your contract's state or call your contract's
-functions and this is what this page is about.
+functions and this is what this section is about.
 
 .. index:: function;modifier
 
diff --git a/docs/contracts.rst b/docs/contracts.rst
index 69600fc1..cdc92315 100644
--- a/docs/contracts.rst
+++ b/docs/contracts.rst
@@ -20,7 +20,7 @@ Contracts can be created "from outside" via Ethereum transactions or from within
 
 IDEs, such as `Remix <https://remix.ethereum.org/>`_, make the creation process seamless using UI elements.
 
-Creating contracts programatically on Ethereum is best done via using the JavaScript API `web3.js <https://github.com/etherem/web3.js>`_.
+Creating contracts programatically on Ethereum is best done via using the JavaScript API `web3.js <https://github.com/ethereum/web3.js>`_.
 As of today it has a method called `web3.eth.Contract <https://web3js.readthedocs.io/en/1.0/web3-eth-contract.html#new-contract>`_
 to facilitate contract creation.
 
diff --git a/docs/contributing.rst b/docs/contributing.rst
index 01caa5b1..0f7c3e72 100644
--- a/docs/contributing.rst
+++ b/docs/contributing.rst
@@ -64,9 +64,11 @@ Running the compiler tests
 ==========================
 
 Solidity includes different types of tests. They are included in the application
-called ``soltest``. Some of them require the ``cpp-ethereum`` client in testing mode.
+called ``soltest``. Some of them require the ``cpp-ethereum`` client in testing mode,
+some others require ``libz3`` to be installed.
 
-To run a subset of the tests that do not require ``cpp-ethereum``, use ``./build/test/soltest -- --no-ipc``.
+To disable the z3 tests, use ``./build/test/soltest -- --no-smt`` and
+to run a subset of the tests that do not require ``cpp-ethereum``, use ``./build/test/soltest -- --no-ipc``.
 
 For all other tests, you need to install `cpp-ethereum <https://github.com/ethereum/cpp-ethereum/releases/download/solidityTester/eth>`_ and run it in testing mode: ``eth --test -d /tmp/testeth``.
 
diff --git a/docs/frequently-asked-questions.rst b/docs/frequently-asked-questions.rst
index f59d86e7..5c427c69 100644
--- a/docs/frequently-asked-questions.rst
+++ b/docs/frequently-asked-questions.rst
@@ -304,8 +304,9 @@ There are defaults for the storage location depending on which type
 of variable it concerns:
 
 * state variables are always in storage
-* function arguments are always in memory
-* local variables always reference storage
+* function arguments are in memory by default
+* local variables of struct, array or mapping type reference storage by default
+* local variables of value type (i.e. neither array, nor struct nor mapping) are stored in the stack
 
 Example::
 
@@ -431,12 +432,12 @@ What happens to a ``struct``'s mapping when copying over a ``struct``?
 This is a very interesting question. Suppose that we have a contract field set up like such::
 
     struct user {
-        mapping(string => address) usedContracts;
+        mapping(string => string) comments;
     }
 
     function somefunction {
        user user1;
-       user1.usedContracts["Hello"] = "World";
+       user1.comments["Hello"] = "World";
        user user2 = user1;
     }
 
diff --git a/docs/grammar.txt b/docs/grammar.txt
index 041728c5..72364b7c 100644
--- a/docs/grammar.txt
+++ b/docs/grammar.txt
@@ -145,7 +145,7 @@ Byte = 'byte' | 'bytes' | 'bytes1' | 'bytes2' | 'bytes3' | 'bytes4' | 'bytes5' |
 
 Fixed = 'fixed' | ( 'fixed' DecimalNumber 'x' DecimalNumber )
 
-Uixed = 'ufixed' | ( 'ufixed' DecimalNumber 'x' DecimalNumber )
+Ufixed = 'ufixed' | ( 'ufixed' DecimalNumber 'x' DecimalNumber )
 
 InlineAssemblyBlock = '{' AssemblyItem* '}'
 
diff --git a/docs/index.rst b/docs/index.rst
index cb093bd6..351f8ad7 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -61,6 +61,9 @@ Available Solidity Integrations
 
 * `Solium <https://github.com/duaraghav8/Solium/>`_
     A commandline linter for Solidity which strictly follows the rules prescribed by the `Solidity Style Guide <http://solidity.readthedocs.io/en/latest/style-guide.html>`_.
+    
+* `Solhint <https://github.com/protofire/solhint>`_
+    Solidity linter that provides security, style guide and best practice rules for smart contract validation.
 
 * `Visual Studio Code extension <http://juan.blanco.ws/solidity-contracts-in-visual-studio-code/>`_
     Solidity plugin for Microsoft Visual Studio Code that includes syntax highlighting and the Solidity compiler.
diff --git a/docs/miscellaneous.rst b/docs/miscellaneous.rst
index 6d6c25ac..1c4f918c 100644
--- a/docs/miscellaneous.rst
+++ b/docs/miscellaneous.rst
@@ -322,17 +322,17 @@ Global Variables
 - ``assert(bool condition)``: abort execution and revert state changes if condition is ``false`` (use for internal error)
 - ``require(bool condition)``: abort execution and revert state changes if condition is ``false`` (use for malformed input or error in external component)
 - ``revert()``: abort execution and revert state changes
-- ``keccak256(...) returns (bytes32)``: compute the Ethereum-SHA-3 (Keccak-256) hash of the (tightly packed) arguments
+- ``keccak256(...) returns (bytes32)``: compute the Ethereum-SHA-3 (Keccak-256) hash of the :ref:`(tightly packed) arguments <abi_packed_mode>`
 - ``sha3(...) returns (bytes32)``: an alias to ``keccak256``
-- ``sha256(...) returns (bytes32)``: compute the SHA-256 hash of the (tightly packed) arguments
-- ``ripemd160(...) returns (bytes20)``: compute the RIPEMD-160 hash of the (tightly packed) arguments
+- ``sha256(...) returns (bytes32)``: compute the SHA-256 hash of the :ref:`(tightly packed) arguments <abi_packed_mode>`
+- ``ripemd160(...) returns (bytes20)``: compute the RIPEMD-160 hash of the :ref:`(tightly packed) arguments <abi_packed_mode>`
 - ``ecrecover(bytes32 hash, uint8 v, bytes32 r, bytes32 s) returns (address)``: recover address associated with the public key from elliptic curve signature, return zero on error
 - ``addmod(uint x, uint y, uint k) returns (uint)``: compute ``(x + y) % k`` where the addition is performed with arbitrary precision and does not wrap around at ``2**256``
 - ``mulmod(uint x, uint y, uint k) returns (uint)``: compute ``(x * y) % k`` where the multiplication is performed with arbitrary precision and does not wrap around at ``2**256``
 - ``this`` (current contract's type): the current contract, explicitly convertible to ``address``
 - ``super``: the contract one level higher in the inheritance hierarchy
 - ``selfdestruct(address recipient)``: destroy the current contract, sending its funds to the given address
-- ``suicide(address recipieint)``: an alias to ``selfdestruct``
+- ``suicide(address recipient)``: an alias to ``selfdestruct``
 - ``<address>.balance`` (``uint256``): balance of the :ref:`address` in Wei
 - ``<address>.send(uint256 amount) returns (bool)``: send given amount of Wei to :ref:`address`, returns ``false`` on failure
 - ``<address>.transfer(uint256 amount)``: send given amount of Wei to :ref:`address`, throws on failure
diff --git a/docs/types.rst b/docs/types.rst
index 5c291f35..774c1d04 100644
--- a/docs/types.rst
+++ b/docs/types.rst
@@ -107,6 +107,9 @@ Operators:
 
 * ``<=``, ``<``, ``==``, ``!=``, ``>=`` and ``>``
 
+.. note::
+    Starting with version 0.5.0 contracts do not derive from the address type, but can still be explicitly converted to address.
+
 .. _members-of-addresses:
 
 Members of Addresses
@@ -240,6 +243,9 @@ Hexadecimal literals that are between 39 and 41 digits
 long and do not pass the checksum test produce
 a warning and are treated as regular rational number literals.
 
+.. note::
+    The mixed-case address checksum format is defined in `EIP-55 <https://github.com/ethereum/EIPs/blob/master/EIPS/eip-55.md>`_.
+
 .. index:: literal, literal;rational
 
 .. _rational_literals:
diff --git a/docs/units-and-global-variables.rst b/docs/units-and-global-variables.rst
index 887535da..7af97376 100644
--- a/docs/units-and-global-variables.rst
+++ b/docs/units-and-global-variables.rst
@@ -116,13 +116,13 @@ Mathematical and Cryptographic Functions
 ``mulmod(uint x, uint y, uint k) returns (uint)``:
     compute ``(x * y) % k`` where the multiplication is performed with arbitrary precision and does not wrap around at ``2**256``.
 ``keccak256(...) returns (bytes32)``:
-    compute the Ethereum-SHA-3 (Keccak-256) hash of the (tightly packed) arguments
+    compute the Ethereum-SHA-3 (Keccak-256) hash of the :ref:`(tightly packed) arguments <abi_packed_mode>`
 ``sha256(...) returns (bytes32)``:
-    compute the SHA-256 hash of the (tightly packed) arguments
+    compute the SHA-256 hash of the :ref:`(tightly packed) arguments <abi_packed_mode>`
 ``sha3(...) returns (bytes32)``:
     alias to ``keccak256``
 ``ripemd160(...) returns (bytes20)``:
-    compute RIPEMD-160 hash of the (tightly packed) arguments
+    compute RIPEMD-160 hash of the :ref:`(tightly packed) arguments <abi_packed_mode>`
 ``ecrecover(bytes32 hash, uint8 v, bytes32 r, bytes32 s) returns (address)``:
     recover the address associated with the public key from elliptic curve signature or return zero on error
     (`example usage <https://ethereum.stackexchange.com/q/1777/222>`_)