@snovon/solast 0.2.0

package/dist/detectors/erc721-unchecked-transfer.js

@@ -0,0 +1,364 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Erc721UncheckedTransferDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'erc721-unchecked-transfer';
+const PATTERN = `${RULE_ID}/discarded-return-value`;
+const ERC721_METHODS = new Set(['transferFrom', 'safeTransferFrom']);
+class Erc721UncheckedTransferDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'ERC721 transfer return value is silently discarded.',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'medium',
+        help: 'Remediation: use standard void-returning IERC721 interfaces, or require/assert/branch on the returned boolean from custom ERC721 transfer wrappers and low-level calls.',
+    };
+    currentFile = '';
+    currentContract = null;
+    contractTypes = new Map();
+    interfaces = new Map();
+    fn = null;
+    findings = [];
+    setFile(file) {
+        this.currentFile = file;
+        this.currentContract = null;
+        this.contractTypes = new Map();
+        this.interfaces = new Map();
+        this.fn = null;
+        this.findings = [];
+    }
+    getFindings() {
+        return this.findings;
+    }
+    ContractDefinition(node) {
+        this.currentContract = null;
+        this.contractTypes = new Map();
+        this.fn = null;
+        if (node?.kind === 'interface') {
+            this.collectInterface(node);
+            return;
+        }
+        if (node?.kind === 'library')
+            return;
+        this.currentContract = node;
+        this.contractTypes = collectStateTypes(node);
+    }
+    ContractDefinition_post(_node) {
+        this.currentContract = null;
+        this.contractTypes = new Map();
+        this.fn = null;
+    }
+    ['ContractDefinition:exit'](node) {
+        this.ContractDefinition_post(node);
+    }
+    FunctionDefinition(node) {
+        this.fn = null;
+        if (!this.currentContract || !node?.body)
+            return;
+        const localTypes = new Map(this.contractTypes);
+        collectParameterTypes(node.parameters, localTypes);
+        this.fn = {
+            name: node.name || (node.isConstructor ? '<constructor>' : '<fallback>'),
+            node,
+            localTypes,
+            candidates: [],
+            validatedVariables: new Set(),
+        };
+    }
+    FunctionDefinition_post(_node) {
+        if (!this.currentContract || !this.fn) {
+            this.fn = null;
+            return;
+        }
+        for (const candidate of this.fn.candidates) {
+            if (candidate.checkedVar && this.fn.validatedVariables.has(candidate.checkedVar))
+                continue;
+            this.findings.push(this.makeFinding(candidate));
+        }
+        this.fn = null;
+    }
+    ['FunctionDefinition:exit'](node) {
+        this.FunctionDefinition_post(node);
+    }
+    VariableDeclarationStatement(node) {
+        if (!this.fn)
+            return;
+        registerDeclaredTypes(node.variables, this.fn.localTypes);
+        const lowLevel = this.asErc721LowLevelCall(node.initialValue);
+        if (!lowLevel)
+            return;
+        this.fn.candidates.push({
+            node: lowLevel.node,
+            method: lowLevel.method,
+            checkedVar: firstVariableName(node.variables),
+        });
+    }
+    ExpressionStatement(node) {
+        if (!this.fn)
+            return;
+        const expr = node?.expression;
+        const direct = this.asUncheckedDirectCall(expr);
+        if (direct) {
+            this.fn.candidates.push({ node: direct.node, method: direct.method, checkedVar: null });
+            return;
+        }
+        const lowLevel = this.asErc721LowLevelCall(expr);
+        if (lowLevel) {
+            this.fn.candidates.push({ node: lowLevel.node, method: lowLevel.method, checkedVar: null });
+            return;
+        }
+        if (expr?.type === 'BinaryOperation' && expr.operator === '=') {
+            const assigned = this.asErc721LowLevelCall(expr.right);
+            if (assigned) {
+                this.fn.candidates.push({
+                    node: assigned.node,
+                    method: assigned.method,
+                    checkedVar: assignedSuccessName(expr.left),
+                });
+            }
+        }
+    }
+    FunctionCall(node) {
+        if (!this.fn)
+            return;
+        const name = directCallName(node.expression);
+        if ((name === 'require' || name === 'assert') && node.arguments?.[0]) {
+            collectCheckedIdentifiers(node.arguments[0], this.fn.validatedVariables);
+        }
+    }
+    IfStatement(node) {
+        if (!this.fn)
+            return;
+        collectCheckedIdentifiers(node.condition, this.fn.validatedVariables);
+    }
+    ReturnStatement(node) {
+        if (!this.fn)
+            return;
+        collectCheckedIdentifiers(node.expression, this.fn.validatedVariables);
+    }
+    collectInterface(node) {
+        const name = String(node?.name || '');
+        if (!isErc721TypeName(name))
+            return;
+        const methods = [];
+        for (const sub of node.subNodes || []) {
+            if (sub?.type !== 'FunctionDefinition')
+                continue;
+            if (!ERC721_METHODS.has(sub.name))
+                continue;
+            const arity = Array.isArray(sub.parameters) ? sub.parameters.length : 0;
+            if (!isErc721Arity(sub.name, arity))
+                continue;
+            methods.push({
+                name: sub.name,
+                arity,
+                returnsBool: returnsBool(sub),
+            });
+        }
+        if (methods.length > 0)
+            this.interfaces.set(name, methods);
+    }
+    asUncheckedDirectCall(node) {
+        if (!node || node.type !== 'FunctionCall')
+            return null;
+        const expr = unwrapCallOptions(node.expression);
+        if (expr?.type !== 'MemberAccess')
+            return null;
+        const method = expr.memberName;
+        if (!ERC721_METHODS.has(method))
+            return null;
+        const arity = Array.isArray(node.arguments) ? node.arguments.length : 0;
+        if (!isErc721Arity(method, arity))
+            return null;
+        const receiverType = this.receiverInterfaceName(expr.expression);
+        if (!receiverType || !this.interfaceMethodReturnsBool(receiverType, method, arity))
+            return null;
+        return { node, method };
+    }
+    asErc721LowLevelCall(node) {
+        if (!node || node.type !== 'FunctionCall')
+            return null;
+        const expr = unwrapCallOptions(node.expression);
+        if (expr?.type !== 'MemberAccess' || expr.memberName !== 'call')
+            return null;
+        const payload = node.arguments?.[0];
+        const selector = selectorFromAbiEncode(payload);
+        if (!selector)
+            return null;
+        if (!ERC721_METHODS.has(selector.method))
+            return null;
+        const payloadArity = Math.max(0, (payload.arguments?.length || 0) - 1);
+        if (!isErc721Arity(selector.method, payloadArity))
+            return null;
+        if (!this.interfaceMethodReturnsBool(selector.interfaceName, selector.method, payloadArity))
+            return null;
+        return { node, method: selector.method };
+    }
+    receiverInterfaceName(expr) {
+        if (!expr)
+            return null;
+        if (expr.type === 'Identifier') {
+            return this.fn?.localTypes.get(expr.name) || null;
+        }
+        if (expr.type === 'FunctionCall' && expr.expression?.type === 'Identifier') {
+            const castType = expr.expression.name;
+            return this.interfaces.has(castType) ? castType : null;
+        }
+        return null;
+    }
+    interfaceMethodReturnsBool(interfaceName, method, arity) {
+        if (!isErc721TypeName(interfaceName))
+            return false;
+        const methods = this.interfaces.get(interfaceName);
+        if (!methods)
+            return false;
+        return methods.some(entry => entry.name === method && entry.arity === arity && entry.returnsBool);
+    }
+    makeFinding(candidate) {
+        const loc = (0, ast_1.assertLoc)(candidate.node, this.fn?.node || this.currentContract);
+        const contractName = this.currentContract?.name || '<anonymous>';
+        const functionName = this.fn?.name || '<anonymous>';
+        return {
+            file: this.currentFile,
+            contract: contractName,
+            'function': functionName,
+            line: loc.line,
+            endLine: loc.endLine,
+            column: loc.column,
+            ruleId: RULE_ID,
+            pattern: PATTERN,
+            severity: 'medium',
+            confidence: 'medium',
+            category: 'unchecked-return-value',
+            message: `Unchecked ERC721 ${candidate.method} return value in '${contractName}.${functionName}': validate or propagate the boolean result before continuing.`,
+            contractName,
+            functionName,
+            sourceLocation: { line: loc.line, column: loc.column },
+            findingId: '',
+            contractHash: '',
+        };
+    }
+}
+exports.Erc721UncheckedTransferDetector = Erc721UncheckedTransferDetector;
+function collectStateTypes(contract) {
+    const types = new Map();
+    for (const sub of contract?.subNodes || []) {
+        if (sub?.type !== 'StateVariableDeclaration')
+            continue;
+        registerDeclaredTypes(sub.variables, types);
+    }
+    return types;
+}
+function collectParameterTypes(parameters, types) {
+    if (!Array.isArray(parameters))
+        return;
+    registerDeclaredTypes(parameters, types);
+}
+function registerDeclaredTypes(decls, types) {
+    if (!Array.isArray(decls))
+        return;
+    for (const decl of decls) {
+        const name = declaredName(decl);
+        const typeName = userDefinedTypeName(decl?.typeName);
+        if (name && typeName)
+            types.set(name, typeName);
+    }
+}
+function declaredName(decl) {
+    return decl?.name || decl?.identifier?.name || null;
+}
+function userDefinedTypeName(typeName) {
+    if (!typeName)
+        return null;
+    if (typeName.type === 'UserDefinedTypeName') {
+        return typeName.namePath || typeName.name || null;
+    }
+    return null;
+}
+function returnsBool(fn) {
+    const returns = fn?.returnParameters;
+    if (!Array.isArray(returns) || returns.length !== 1)
+        return false;
+    const typeName = returns[0]?.typeName;
+    return typeName?.type === 'ElementaryTypeName' && typeName.name === 'bool';
+}
+function isErc721TypeName(name) {
+    return /(?:^|[_.])I?ERC721(?:$|[A-Z0-9_.])|(?:^|[_.])I?NFT(?:$|[A-Z0-9_.])/u.test(name);
+}
+function isErc721Arity(method, arity) {
+    if (method === 'transferFrom')
+        return arity === 3;
+    if (method === 'safeTransferFrom')
+        return arity === 3 || arity === 4;
+    return false;
+}
+function unwrapCallOptions(expr) {
+    if (expr?.type === 'NameValueExpression')
+        return unwrapCallOptions(expr.expression);
+    if (expr?.type === 'FunctionCallOptions')
+        return unwrapCallOptions(expr.expression);
+    return expr;
+}
+function selectorFromAbiEncode(node) {
+    if (!node || node.type !== 'FunctionCall')
+        return null;
+    const expr = unwrapCallOptions(node.expression);
+    if (expr?.type !== 'MemberAccess' || expr.memberName !== 'encodeWithSelector')
+        return null;
+    if (expr.expression?.type !== 'Identifier' || expr.expression.name !== 'abi')
+        return null;
+    const selector = node.arguments?.[0];
+    if (selector?.type !== 'MemberAccess' || selector.memberName !== 'selector')
+        return null;
+    const methodAccess = selector.expression;
+    if (methodAccess?.type !== 'MemberAccess')
+        return null;
+    const method = methodAccess.memberName;
+    const iface = methodAccess.expression;
+    if (iface?.type !== 'Identifier')
+        return null;
+    return { interfaceName: iface.name, method };
+}
+function firstVariableName(variables) {
+    if (!Array.isArray(variables) || variables.length === 0)
+        return null;
+    return declaredName(variables[0]);
+}
+function assignedSuccessName(left) {
+    if (left?.type === 'TupleExpression')
+        return identifierName(left.components?.[0]);
+    return null;
+}
+function collectCheckedIdentifiers(expr, validations) {
+    const direct = checkedIdentifier(expr);
+    if (direct) {
+        validations.add(direct);
+        return;
+    }
+    if (expr?.type === 'BinaryOperation' && (expr.operator === '&&' || expr.operator === '||')) {
+        collectCheckedIdentifiers(expr.left, validations);
+        collectCheckedIdentifiers(expr.right, validations);
+    }
+}
+function checkedIdentifier(expr) {
+    const direct = identifierName(expr);
+    if (direct)
+        return direct;
+    if (expr?.type === 'UnaryOperation' && expr.operator === '!') {
+        return identifierName(expr.subExpression);
+    }
+    if (expr?.type === 'BinaryOperation' && (expr.operator === '==' || expr.operator === '!=')) {
+        return identifierName(expr.left) || identifierName(expr.right);
+    }
+    return null;
+}
+function directCallName(expr) {
+    return expr?.type === 'Identifier' ? expr.name : null;
+}
+function identifierName(expr) {
+    return expr?.type === 'Identifier' ? expr.name : null;
+}
+//# sourceMappingURL=erc721-unchecked-transfer.js.map

package/dist/detectors/erc7579-module-install-without-threshold.d.ts

@@ -0,0 +1,40 @@
+import type { ScanResult } from '../index';
+export declare class Erc7579ModuleInstallWithoutThresholdDetector {
+    readonly id = "erc7579-module-install-without-threshold";
+    readonly patternKey = "erc7579-module-install-without-threshold";
+    readonly supportedAstKinds: "parser"[];
+    readonly descriptor: {
+        id: string;
+        shortDescription: string;
+        helpUri: string;
+        defaultSeverity: "medium";
+        help: string;
+    };
+    private currentFile;
+    private findings;
+    private currentContractName;
+    private currentContractConcrete;
+    private stateVariables;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(): void;
+    FunctionDefinition(node: any): void;
+    private isConcreteContract;
+    private getInstallShape;
+    private sameTypes;
+    private typeName;
+    private analyzeBody;
+    private walkInSourceOrder;
+    private orderedChildren;
+    private isAccessControlRequire;
+    private isThresholdPolicyCheck;
+    private expressionContainsThresholdPolicy;
+    private hasPolicyTerm;
+    private isPolicyName;
+    private isModuleInstallMutation;
+    private isStateTarget;
+    private referencesInstallParam;
+    private rootIdentifier;
+    private makeFinding;
+}