@prajwalghate/sourcetruth 0.1.0

package/examples/solidity-vault/src/Strategy.sol

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+interface IERC20 {
+    function transfer(address to, uint256 amount) external returns (bool);
+    function transferFrom(address from, address to, uint256 amount) external returns (bool);
+    function balanceOf(address who) external view returns (uint256);
+}
+
+interface IRouter {
+    function swap(address tokenIn, address tokenOut, uint256 amountIn) external returns (uint256);
+}
+
+interface IStrategy {
+    function invest(uint256 amount) external;
+    function withdraw(uint256 amount) external;
+    function harvest() external returns (uint256);
+}
+
+contract Strategy is IStrategy {
+    address public immutable vault;
+    IERC20 public immutable asset;
+    IERC20 public immutable reward;
+    IRouter public router;
+
+    constructor(address _vault, IERC20 _asset, IERC20 _reward, IRouter _router) {
+        vault = _vault; asset = _asset; reward = _reward; router = _router;
+    }
+
+    function invest(uint256) external { _onlyVault(); }
+
+    function withdraw(uint256 amount) external {
+        _onlyVault();
+        asset.transfer(vault, amount);
+    }
+
+    function harvest() external returns (uint256 gained) {
+        _onlyVault();
+        uint256 earned = reward.balanceOf(address(this));
+        gained = router.swap(address(reward), address(asset), earned);
+        asset.transfer(vault, gained);
+    }
+
+    function emergencyExit() external {
+        if (msg.sender != vault) revert();
+        asset.transfer(vault, asset.balanceOf(address(this)));
+    }
+
+    function _onlyVault() internal view {
+        require(msg.sender == vault, "not vault");
+    }
+}

package/examples/solidity-vault/src/Vault.sol

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: MIT
+// A small yield vault, written to show what sourcetruth draws. Not production code.
+pragma solidity ^0.8.20;
+
+import "./Strategy.sol";
+
+abstract contract Owned {
+    address public owner;
+    modifier onlyOwner() { require(msg.sender == owner, "not owner"); _; }
+    function transferOwnership(address to) external onlyOwner { owner = to; }
+}
+
+contract Vault is Owned {
+    IERC20 public immutable asset;
+    IStrategy public strategy;
+    mapping(address => uint256) public shares;
+    mapping(address => bool) public keepers;
+    uint256 public feeBps = 100;
+
+    constructor(IERC20 _asset) { asset = _asset; owner = msg.sender; }
+
+    function deposit(uint256 amount) external {
+        asset.transferFrom(msg.sender, address(this), amount);
+        shares[msg.sender] += amount;
+        _invest();
+    }
+
+    function withdraw(uint256 amount) external {
+        shares[msg.sender] -= amount;
+        strategy.withdraw(amount);
+        asset.transfer(msg.sender, amount);
+    }
+
+    function harvest() external {
+        _onlyKeeper();
+        uint256 profit = strategy.harvest();
+        _takeFee(profit);
+        _invest();
+    }
+
+    function takeFee(uint256 amount) external { _takeFee(amount); }
+
+    function setStrategy(IStrategy next) external onlyOwner { strategy = next; }
+    function setKeeper(address keeper, bool allowed) external onlyOwner { keepers[keeper] = allowed; }
+
+    function execute(address target, bytes calldata data) external onlyOwner returns (bytes memory) {
+        (bool ok, bytes memory out) = target.delegatecall(data);
+        require(ok, "call failed");
+        return out;
+    }
+
+    function _onlyKeeper() internal view {
+        require(keepers[msg.sender], "not keeper");
+    }
+
+    function _invest() internal {
+        uint256 idle = asset.balanceOf(address(this));
+        if (idle > 0) {
+            asset.transfer(address(strategy), idle);
+            strategy.invest(idle);
+        }
+    }
+
+    function _takeFee(uint256 amount) internal {
+        asset.transfer(owner, amount * feeBps / 10_000);
+    }
+}

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@prajwalghate/sourcetruth",
+  "version": "0.1.0",
+  "description": "See what Daml and Solidity contract code does — who can act, what each action changes — from source, and what could not be traced.",
+  "type": "module",
+  "bin": { "sourcetruth": "./bin/sourcetruth.mjs" },
+  "files": ["bin/", "src/", "examples/", "README.md", "GUIDE.md", "CHANGELOG.md", "LICENSE"],
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "demo": "node bin/sourcetruth.mjs --demo -o demo.html"
+  },
+  "keywords": ["audit", "security", "smart-contracts", "daml", "canton", "solidity", "evm", "static-analysis", "access-control"],
+  "homepage": "https://prajwalghate.github.io/sourcetruth/",
+  "repository": { "type": "git", "url": "git+https://github.com/prajwalghate/sourcetruth.git" },
+  "bugs": { "url": "https://github.com/prajwalghate/sourcetruth/issues" },
+  "author": "Prajwal Ghate",
+  "license": "MIT",
+  "engines": { "node": ">=22" },
+  "publishConfig": { "access": "public" }
+}