False positive on reentrancy detector when calling a view function

[ptare]

When a method calls a view function on an external contract and then modifies state, one of Slither's reentrancy detectors trigger. See this minimal example [1] and the error Slither produces [2].

A call to a view function should be safe against reentrancy bugs (as long as the Solidity version is ^0.5.0) because any calls back into the calling code will also be prevented from changing state, so this might be a false positive.

/*
  A self-contained example of false positive on calling view functions.
*/
pragma solidity ^0.5.0;

contract ViewOnly {
    uint public myVar = 0;
    function safeFunction() external view returns (uint) {
        return myVar;
    }

    function notCalled() external {
        myVar = 5;
    }
}

contract Main {
    uint public stateVariable;
    ViewOnly public viewOnly;

    function mainFunction() external {
        viewOnly.safeFunction();
        stateVariable = 0;
    }
}

Reentrancy in Main.mainFunction (MinimalViewExample.sol#21-24):
	External calls:
	- viewOnly.safeFunction() (MinimalViewExample.sol#22)
	External calls sending eth:
	State variables written after the call(s):
	- stateVariable (MinimalViewExample.sol#23)

[montyly]

Hi @ptare,

Thank you for your feedback, that's an interesting corner case!
We are going to update the reentrancy heuristic to take it into account