Callstack attack vulnerability about oyente HOT 4 CLOSED

Hey, oyente flags this as a bug because in theory beneficiary can call itself recursively to exceed the callstack limit, run out of gas etc. and throw an exception. The recommended way to handle this, is to refactor the code to as follows or use the more safer transfer function -

pragma solidity ^0.4.11;
contract Foo {
  address public beneficiary = msg.sender;

  function withdraw() public
  returns (bool success)
  {
    if (msg.sender != beneficiary) {
      throw;
    }
    if(!beneficiary.call.value(this.balance)()) {
        throw;
    }
    return true;
  }

  function ()
  payable
  {
  }
}

from oyente.

Well, it was the first thing I tried before open this issue, and it also causes Callstack Attack: True.

For sure I know that beneficiary could make recursive calls to exceed the callstack limit, but in this case it doesn’t affect anything, no?

from oyente.

Hey, can u try again with the latest version of the code? I modified the callstack detection logic in a recent commit :)

Yes, as you said it cannot be exploited in this case (since it is the last statement).

from oyente.

Sorry, can’t check. I use a web version (which is not the latest one, I suppose).
Docker container doesn‘t work for me:

# cd /oyente && python oyente.py -s foo.sol 
WARNING:root:You are using evm version 1.6.5. The supported version is 1.6.1
WARNING:root:You are using solc version 0.4.12, The supported version is 0.4.10
CRITICAL:root:Solidity compilation failed

from oyente.