Self Destruct Module: A Bug or Need for Improvement?

Reading up more on Mythril and I am just wondering on the validity of some of the vulnerabilities Mythril finds. For example, I have run into multiple cases where Mythril may find a Unprotected Self Destruct and have it even produce a function call to exploit the function (e.g., Caller: [ATTACKER], function: kill(), txdata: 0x41c0e1b5, value: 0x0), but actually never be able to be exploit this vulnerability.

Address 0x1A8d01E90F6A6681D822eb16077F27A5027ab362 is one concrete example which has an unprotected Self Destruct. When reading the decompiled bytecode of the above contract, there is a call to a function or external contract (reading decompiled source code isn’t easy for me) in the kill() function that checks if the caller is the owner before proceeding to the self destruct instruction. If the check does not pass, the instruction is not executed. I’ve tested attempting to destruct the contract as well (feeling it would be safe to do so) and it did not self destruct.

Shouldn’t this call to an external contract be realized by Mythril as a path constraint and the contract not be labeled as having a Self Destruct? Or is it not that fine grained? ~Is this a case of the limitaitons of Mythril as it does not have the capability to handle multi-transactional output?~ (Old article I read)

[muellerberndt]

It’s fixed again in develop 😉

[muellerberndt]

@Danc2050 the issues should all be solved with v0.22.0, plus you don’t need the -l flag anymore as loading is enabled by default. Can you check if you’re still getting the false positives?