@snovon/solast 0.2.0

package/dist/detectors/erc7683-fill-validation.js

@@ -0,0 +1,758 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Erc7683FillValidationDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'erc7683-fill-validation';
+const FILL_ENTRY_RE = /^(fill|fillorder|executefill|settle|fulfill|fillordervrf|settleorder)$/i;
+const FILL_SIGNATURE_RE = /(fillinstruction|resolvedcrosschainorder|orderdata|fillerdata|fillparams|execfill)/i;
+const OUTPUT_FIELD_RE = /^(token|recipient|amount|value|output|outputs)$/i;
+const AUTHORIZATION_NAME_RE = /(solver|filler|trusted|allow|whitelist|approved|authorized|operator)/i;
+const AUTH_MODIFIER_RE = /^(only|require|when|has|is|enforce)/i;
+const AUTH_MODIFIER_NAME_RE = /(role|owner|admin|guard|authenticated|solver|filler|trusted|whitelist|approved|authorized|operator|allowlist|allowed|permission|gated|restricted)/i;
+const CALLER_IDENTITY_NAME_RE = /^(filler|solver|executor|caller)$/i;
+const REPLAY_NAME_RE = /(filled|used|consumed|nullifier|nonce|deadline|expiry|expires|seen|claimed|processed)/i;
+const CUSTODY_TRANSFER_RE = /^(transfer|transferfrom|safetransfer|safetransferfrom|release|mint|push|safepush)$/i;
+const CUSTODY_TRANSFER_PARTIAL_RE = /(transfer|release|mint|push)/i;
+const VALIDATION_HELPER_RE = /(validatefill|verifyfill|checkfill|validateoutput|verifyoutput|checkoutput|checksettlement|satisfyorder|enforcefill|assertfill)/i;
+class Erc7683FillValidationDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || ast.type !== 'SourceUnit')
+            return [];
+        const findings = [];
+        for (const contract of ast.children || []) {
+            if (contract?.type !== 'ContractDefinition')
+                continue;
+            if (contract.kind === 'interface' || contract.kind === 'library')
+                continue;
+            const stateVars = this.collectStateVars(contract);
+            const internalFunctions = this.collectInternalFunctions(contract);
+            for (const fn of contract.subNodes || []) {
+                if (fn?.type !== 'FunctionDefinition')
+                    continue;
+                if (!fn.body)
+                    continue;
+                const ctx = this.initContext(file, contract, fn, stateVars, internalFunctions);
+                if (!ctx)
+                    continue;
+                this.applyModifierAuth(fn, ctx);
+                this.analyzeBody(fn.body, ctx);
+                const finding = this.summarize(ctx);
+                if (finding)
+                    findings.push(finding);
+            }
+        }
+        return findings;
+    }
+    collectStateVars(contract) {
+        const vars = new Set();
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'StateVariableDeclaration')
+                continue;
+            for (const variable of sub.variables || []) {
+                if (variable?.name)
+                    vars.add(String(variable.name));
+            }
+        }
+        return vars;
+    }
+    collectInternalFunctions(contract) {
+        const fns = new Map();
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'FunctionDefinition')
+                continue;
+            if (!sub.body)
+                continue;
+            const name = String(sub.name || '');
+            if (name)
+                fns.set(name, sub);
+        }
+        return fns;
+    }
+    initContext(file, contract, fn, stateVars, internalFunctions) {
+        const fnName = String(fn.name || '');
+        const params = (fn.parameters || []).map((p) => String(p?.name || ''));
+        const paramTypes = (fn.parameters || []).map((p) => this.sourceText(p?.typeName || ''));
+        const isFillEntry = FILL_ENTRY_RE.test(fnName);
+        if (!isFillEntry)
+            return null;
+        const isFillSignature = params.some((p) => FILL_SIGNATURE_RE.test(p))
+            || paramTypes.some((t) => FILL_SIGNATURE_RE.test(t));
+        const hasFillBody = FILL_SIGNATURE_RE.test(this.sourceText(fn.body));
+        if (!isFillSignature && !hasFillBody)
+            return null;
+        const localVars = this.collectLocalVars(fn);
+        return {
+            file,
+            contractName: String(contract.name || '<anon>'),
+            functionName: fnName,
+            stateVars,
+            localVars,
+            params,
+            paramTypes,
+            sawCustodyTransfer: false,
+            custodyTransferLoc: null,
+            validatedOutputFields: new Set(),
+            sawMeaningfulOutputValidation: false,
+            sawWeakValidation: false,
+            sawFillerAuthorization: false,
+            sawReplayGuard: false,
+            sawOriginBinding: false,
+            sawOrderHashBinding: false,
+            sawLowLevelCallWithFillData: false,
+            internalFunctions,
+            visitedHelpers: new Set(),
+            callerParamNames: new Set(params.filter((p) => CALLER_IDENTITY_NAME_RE.test(p))),
+        };
+    }
+    collectLocalVars(fn) {
+        const vars = new Set();
+        for (const p of fn.parameters || []) {
+            if (p?.name)
+                vars.add(String(p.name));
+        }
+        for (const p of fn.returnParameters || []) {
+            if (p?.name)
+                vars.add(String(p.name));
+        }
+        this.harvestLocals(fn.body, vars);
+        return vars;
+    }
+    harvestLocals(node, vars) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            for (const v of node.variables || []) {
+                if (v?.name)
+                    vars.add(String(v.name));
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.harvestLocals(child, vars);
+        }
+    }
+    applyModifierAuth(fn, ctx) {
+        for (const mod of fn.modifiers || []) {
+            const name = String(mod?.name || '');
+            if (!name)
+                continue;
+            if (AUTH_MODIFIER_NAME_RE.test(name)) {
+                ctx.sawFillerAuthorization = true;
+            }
+        }
+    }
+    analyzeBody(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'Block') {
+            for (const stmt of node.statements || [])
+                this.analyzeStmt(stmt, ctx);
+            return;
+        }
+        this.analyzeStmt(node, ctx);
+    }
+    analyzeStmt(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'EmitStatement')
+            return;
+        if (node.type === 'IfStatement') {
+            const trueAborts = this.bodyAborts(node.trueBody);
+            const falseAborts = this.bodyAborts(node.falseBody);
+            if (node.condition && (trueAborts || falseAborts)) {
+                this.applyGuardCondition(node.condition, ctx, trueAborts);
+            }
+            this.analyzeNode(node.condition, ctx);
+            this.analyzeBody(node.trueBody, ctx);
+            this.analyzeBody(node.falseBody, ctx);
+            return;
+        }
+        if (node.type === 'VariableDeclarationStatement') {
+            this.analyzeNode(node.initialValue, ctx);
+            return;
+        }
+        if (node.type === 'ExpressionStatement') {
+            this.analyzeNode(node.expression, ctx);
+            return;
+        }
+        if (node.type === 'RevertStatement') {
+            return;
+        }
+        if (node.type === 'FunctionCall') {
+            this.handleFunctionCall(node, ctx);
+            for (const arg of node.arguments || [])
+                this.analyzeNode(arg, ctx);
+            return;
+        }
+        if (node.type === 'BinaryOperation') {
+            if (node.operator === '=' || node.operator === '+=' || node.operator === '-=') {
+                if (this.isStateRef(node.left, ctx)) {
+                    if (node.right)
+                        this.analyzeNode(node.right, ctx);
+                    return;
+                }
+            }
+            this.analyzeNode(node.left, ctx);
+            this.analyzeNode(node.right, ctx);
+            return;
+        }
+        if (node.type === 'UnaryOperation') {
+            this.analyzeNode(node.subExpression, ctx);
+            return;
+        }
+        for (const child of this.childNodes(node)) {
+            this.analyzeNode(child, ctx);
+        }
+    }
+    analyzeNode(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'FunctionCall') {
+            this.handleFunctionCall(node, ctx);
+            for (const arg of node.arguments || [])
+                this.analyzeNode(arg, ctx);
+            return;
+        }
+        for (const child of this.childNodes(node)) {
+            this.analyzeNode(child, ctx);
+        }
+    }
+    bodyAborts(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'RevertStatement')
+            return true;
+        if (node.type === 'ReturnStatement')
+            return true;
+        if (node.type === 'Break' || node.type === 'BreakStatement')
+            return false;
+        if (node.type === 'ExpressionStatement' && node.expression?.type === 'FunctionCall') {
+            const name = this.callName(node.expression);
+            if (name === 'revert')
+                return true;
+        }
+        if (node.type === 'Block') {
+            for (const stmt of node.statements || []) {
+                if (this.bodyAborts(stmt))
+                    return true;
+            }
+            return false;
+        }
+        return false;
+    }
+    applyGuardCondition(cond, ctx, rejectsOnTrue = false) {
+        this.detectOutputValidationFields(cond, ctx);
+        if (this.isWeakValidation(cond))
+            ctx.sawWeakValidation = true;
+        if (this.isMeaningfulOutputValidation(cond, ctx))
+            ctx.sawMeaningfulOutputValidation = true;
+        this.detectAuthorizationGuard(cond, ctx);
+        this.detectBindingGuard(cond, ctx, rejectsOnTrue);
+    }
+    handleFunctionCall(node, ctx) {
+        const name = this.callName(node);
+        const lowerName = name.toLowerCase();
+        if (lowerName === 'require' || lowerName === 'assert') {
+            const cond = node.arguments?.[0];
+            if (cond) {
+                this.applyGuardCondition(cond, ctx);
+            }
+            return;
+        }
+        if (lowerName === 'revert')
+            return;
+        const finalMember = this.finalMemberName(node);
+        if (finalMember && CUSTODY_TRANSFER_RE.test(finalMember)) {
+            ctx.sawCustodyTransfer = true;
+            ctx.custodyTransferLoc = ctx.custodyTransferLoc || this.locOf(node);
+        }
+        else if (CUSTODY_TRANSFER_PARTIAL_RE.test(name)) {
+            ctx.sawCustodyTransfer = true;
+            ctx.custodyTransferLoc = ctx.custodyTransferLoc || this.locOf(node);
+        }
+        if (VALIDATION_HELPER_RE.test(name)) {
+            const helperName = this.directIdentifierCallName(node);
+            if (helperName && ctx.internalFunctions.has(helperName) && !ctx.visitedHelpers.has(helperName)) {
+                ctx.visitedHelpers.add(helperName);
+                const helper = ctx.internalFunctions.get(helperName);
+                if (helper?.body)
+                    this.analyzeBody(helper.body, ctx);
+            }
+        }
+        if (this.isLowLevelCall(node)) {
+            ctx.sawCustodyTransfer = true;
+            ctx.custodyTransferLoc = ctx.custodyTransferLoc || this.locOf(node);
+            if (this.callUsesFillInstructionData(node, ctx)) {
+                ctx.sawLowLevelCallWithFillData = true;
+            }
+        }
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    isLowLevelCall(node) {
+        const member = this.finalMemberName(node);
+        if (!member)
+            return false;
+        const lower = member.toLowerCase();
+        return lower === 'call' || lower === 'delegatecall';
+    }
+    callUsesFillInstructionData(node, ctx) {
+        const text = this.sourceText(node);
+        return /(callData|target|destination|payload|data)/i.test(text)
+            || (ctx.params.length > 0 && ctx.params.some(p => p && new RegExp(`\\b${p}\\b`).test(text)));
+    }
+    detectAuthorizationGuard(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        this.recordCallerBoundComparison(node, ctx);
+        if (node.type === 'BinaryOperation' && (node.operator === '==' || node.operator === '!=')) {
+            if ((this.isCallerBoundExpression(node.left, ctx.callerParamNames) && this.isCallerIdentityName(node.right))
+                || (this.isCallerBoundExpression(node.right, ctx.callerParamNames) && this.isCallerIdentityName(node.left))) {
+                ctx.sawFillerAuthorization = true;
+            }
+        }
+        if (node.type === 'IndexAccess') {
+            const baseName = this.identifierName(node.base);
+            if (baseName
+                && AUTHORIZATION_NAME_RE.test(baseName)
+                && (ctx.stateVars.has(baseName) || ctx.localVars.has(baseName))
+                && this.isCallerBoundExpression(node.index || node.indexExpression, ctx.callerParamNames)) {
+                ctx.sawFillerAuthorization = true;
+            }
+        }
+        if (node.type === 'FunctionCall') {
+            const callName = this.callName(node);
+            if (AUTHORIZATION_NAME_RE.test(callName) || /(hasrole|requirerole|requireauth|requireallowed|onlyrole|enforce)/i.test(callName)) {
+                if ((node.arguments || []).some((arg) => this.isCallerBoundExpression(arg, ctx.callerParamNames))) {
+                    ctx.sawFillerAuthorization = true;
+                }
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.detectAuthorizationGuard(child, ctx);
+        }
+    }
+    recordCallerBoundComparison(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type !== 'BinaryOperation')
+            return;
+        if (node.operator !== '==' && node.operator !== '!=')
+            return;
+        const leftName = this.directIdentifierName(node.left);
+        const rightName = this.directIdentifierName(node.right);
+        if (leftName && ctx.localVars.has(leftName) && this.containsMsgSender(node.right)) {
+            ctx.callerParamNames.add(leftName);
+        }
+        if (rightName && ctx.localVars.has(rightName) && this.containsMsgSender(node.left)) {
+            ctx.callerParamNames.add(rightName);
+        }
+    }
+    isCallerBoundExpression(node, callerParamNames) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (this.containsMsgSender(node))
+            return true;
+        if (node.type === 'Identifier' && callerParamNames.has(String(node.name || '')))
+            return true;
+        for (const child of this.childNodes(node)) {
+            if (this.isCallerBoundExpression(child, callerParamNames))
+                return true;
+        }
+        return false;
+    }
+    containsMsgSender(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess'
+            && String(node.memberName || '') === 'sender'
+            && this.directIdentifierName(node.expression) === 'msg') {
+            return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsMsgSender(child))
+                return true;
+        }
+        return false;
+    }
+    isCallerIdentityName(node) {
+        const name = this.directIdentifierName(node);
+        return !!name && CALLER_IDENTITY_NAME_RE.test(name);
+    }
+    detectBindingGuard(node, ctx, rejectsOnTrue = false) {
+        if (this.containsOrderHashEquality(node, rejectsOnTrue))
+            ctx.sawOrderHashBinding = true;
+        if (this.containsOriginEquality(node))
+            ctx.sawOriginBinding = true;
+        if (this.containsReplayPattern(node, ctx))
+            ctx.sawReplayGuard = true;
+    }
+    containsOrderHashEquality(node, rejectsOnTrue = false) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'BinaryOperation' && (node.operator === '==' || node.operator === '!=')) {
+            const leftFill = this.referencesFillOrderHash(node.left);
+            const rightFill = this.referencesFillOrderHash(node.right);
+            const leftOrder = this.referencesResolvedOrderHash(node.left);
+            const rightOrder = this.referencesResolvedOrderHash(node.right);
+            if ((leftFill && rightOrder) || (leftOrder && rightFill)) {
+                if (node.operator === '!=')
+                    return rejectsOnTrue;
+                return true;
+            }
+        }
+        if (node.type === 'BinaryOperation' && (node.operator === '&&' || node.operator === '||')) {
+            if (this.containsOrderHashEquality(node.left, rejectsOnTrue) || this.containsOrderHashEquality(node.right, rejectsOnTrue))
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsOrderHashEquality(child, rejectsOnTrue))
+                return true;
+        }
+        return false;
+    }
+    referencesFillOrderHash(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess') {
+            const member = String(node.memberName || '');
+            if (/(orderhash|orderid)/i.test(member)) {
+                const baseName = this.identifierName(node.expression);
+                if (baseName && /(fi|fill|instruction|instr|cmd)/i.test(baseName))
+                    return true;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.referencesFillOrderHash(child))
+                return true;
+        }
+        return false;
+    }
+    referencesResolvedOrderHash(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess') {
+            const member = String(node.memberName || '');
+            if (/(orderhash|orderid)/i.test(member)) {
+                const baseName = this.identifierName(node.expression);
+                if (baseName && /(order|resolved)/i.test(baseName))
+                    return true;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.referencesResolvedOrderHash(child))
+                return true;
+        }
+        return false;
+    }
+    containsOriginEquality(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'BinaryOperation' && (node.operator === '==' || node.operator === '!=' || node.operator === '&&' || node.operator === '||')) {
+            if (this.referencesNamedMember(node.left, /(origindomain|sourcechain|sourcechainid|chainid|sourcedomain)/i)
+                || this.referencesNamedMember(node.right, /(origindomain|sourcechain|sourcechainid|chainid|sourcedomain)/i)) {
+                return true;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsOriginEquality(child))
+                return true;
+        }
+        return false;
+    }
+    containsReplayPattern(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'Identifier') {
+            const name = String(node.name || '');
+            if (REPLAY_NAME_RE.test(name) && (ctx.stateVars.has(name) || ctx.localVars.has(name)))
+                return true;
+        }
+        if (node.type === 'MemberAccess') {
+            const member = String(node.memberName || '');
+            if (REPLAY_NAME_RE.test(member))
+                return true;
+        }
+        if (node.type === 'IndexAccess') {
+            const baseName = this.identifierName(node.base);
+            if (baseName && REPLAY_NAME_RE.test(baseName) && (ctx.stateVars.has(baseName) || ctx.localVars.has(baseName)))
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsReplayPattern(child, ctx))
+                return true;
+        }
+        return false;
+    }
+    referencesNamedMember(node, pattern) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess') {
+            if (pattern.test(String(node.memberName || '')))
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.referencesNamedMember(child, pattern))
+                return true;
+        }
+        return false;
+    }
+    detectOutputValidationFields(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'BinaryOperation') {
+            const op = String(node.operator || '');
+            if (op === '==' || op === '!=' || op === '<' || op === '>' || op === '<=' || op === '>=') {
+                const leftHasOutput = this.referencesOutputFields(node.left);
+                const rightHasOutput = this.referencesOutputFields(node.right);
+                if (leftHasOutput && rightHasOutput && !this.isWeakValidation(node)) {
+                    this.collectOutputFieldNames(node.left, ctx.validatedOutputFields);
+                    this.collectOutputFieldNames(node.right, ctx.validatedOutputFields);
+                }
+                return;
+            }
+            if (op === '&&' || op === '||') {
+                this.detectOutputValidationFields(node.left, ctx);
+                this.detectOutputValidationFields(node.right, ctx);
+                return;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.detectOutputValidationFields(child, ctx);
+        }
+    }
+    collectOutputFieldNames(node, target) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'MemberAccess') {
+            const member = String(node.memberName || '');
+            if (OUTPUT_FIELD_RE.test(member))
+                target.add(member);
+        }
+        if (node.type === 'Identifier') {
+            const name = String(node.name || '');
+            if (OUTPUT_FIELD_RE.test(name))
+                target.add(name);
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectOutputFieldNames(child, target);
+        }
+    }
+    isWeakValidation(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'BinaryOperation') {
+            const op = String(node.operator || '');
+            if ((op === '>=' || op === '<=' || op === '>' || op === '<') && (this.isZeroLiteral(node.right) || this.isZeroLiteral(node.left))) {
+                const left = node.left;
+                const right = node.right;
+                const refs = (this.referencesOutputFields(left) ? 1 : 0) + (this.referencesOutputFields(right) ? 1 : 0);
+                if (refs === 1)
+                    return true;
+            }
+        }
+        return false;
+    }
+    isZeroLiteral(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'NumberLiteral')
+            return String(node.number || '') === '0';
+        if (node.type === 'Identifier')
+            return String(node.name || '').toLowerCase() === 'zero';
+        return false;
+    }
+    isMeaningfulOutputValidation(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return false;
+        return this.findOutputEqualityWithBothSides(node, ctx);
+    }
+    findOutputEqualityWithBothSides(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'BinaryOperation') {
+            const op = String(node.operator || '');
+            if (op === '==' || op === '!=' || op === '<' || op === '>' || op === '<=' || op === '>=') {
+                const leftHasOutput = this.referencesOutputFields(node.left);
+                const rightHasOutput = this.referencesOutputFields(node.right);
+                if (leftHasOutput && rightHasOutput) {
+                    if (!this.isWeakValidation(node))
+                        return true;
+                }
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.findOutputEqualityWithBothSides(child, ctx))
+                return true;
+        }
+        return false;
+    }
+    referencesOutputFields(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess') {
+            const member = String(node.memberName || '');
+            if (OUTPUT_FIELD_RE.test(member))
+                return true;
+        }
+        if (node.type === 'Identifier') {
+            const name = String(node.name || '');
+            if (OUTPUT_FIELD_RE.test(name))
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.referencesOutputFields(child))
+                return true;
+        }
+        return false;
+    }
+    hasAllRequiredOutputFields(ctx) {
+        return ctx.validatedOutputFields.has('token')
+            && ctx.validatedOutputFields.has('recipient')
+            && (ctx.validatedOutputFields.has('amount') || ctx.validatedOutputFields.has('value'));
+    }
+    summarize(ctx) {
+        if (!ctx.sawCustodyTransfer)
+            return null;
+        const loc = ctx.custodyTransferLoc || { line: 1, column: 0 };
+        if (ctx.sawLowLevelCallWithFillData && !ctx.sawOrderHashBinding) {
+            return this.makeFinding(ctx, loc, 'fill-instruction-divergence', 'high', `Fill function '${ctx.functionName}' executes caller-supplied fill-instruction call data without binding the instruction to the resolved order hash.`);
+        }
+        if (!ctx.sawMeaningfulOutputValidation || ctx.sawWeakValidation || !this.hasAllRequiredOutputFields(ctx)) {
+            return this.makeFinding(ctx, loc, 'missing-output-validation', 'high', `Fill function '${ctx.functionName}' releases custody without validating decoded output token, recipient, and amount against the resolved order.`);
+        }
+        if (!ctx.sawFillerAuthorization) {
+            return this.makeFinding(ctx, loc, 'missing-filler-auth', 'medium', `Fill function '${ctx.functionName}' is callable by any msg.sender with no filler/solver authorization check.`);
+        }
+        if (!ctx.sawReplayGuard || !ctx.sawOrderHashBinding) {
+            return this.makeFinding(ctx, loc, 'fill-instruction-divergence', 'high', `Fill function '${ctx.functionName}' settlement path can diverge: missing replay guard or order-hash binding allows stale or replayed intent data.`);
+        }
+        return null;
+    }
+    makeFinding(ctx, loc, pattern, severity, message) {
+        return {
+            file: ctx.file,
+            contract: ctx.contractName,
+            'function': ctx.functionName,
+            line: loc.line,
+            column: loc.column,
+            pattern: `${RULE_ID}/${pattern}`,
+            confidence: 'medium',
+            ruleId: RULE_ID,
+            severity,
+            message,
+            contractName: ctx.contractName,
+            functionName: ctx.functionName,
+            sourceLocation: loc,
+            findingId: '',
+            contractHash: '',
+        };
+    }
+    directIdentifierCallName(node) {
+        if (!node || typeof node !== 'object')
+            return null;
+        if (node.type !== 'FunctionCall')
+            return null;
+        const callee = node.expression;
+        if (!callee || typeof callee !== 'object')
+            return null;
+        if (callee.type !== 'Identifier')
+            return null;
+        return String(callee.name || '') || null;
+    }
+    callName(node) {
+        if (!node || typeof node !== 'object')
+            return '';
+        if (node.type === 'FunctionCall' || node.type === 'FunctionCallOptions' || node.type === 'NameValueExpression') {
+            return this.callName(node.expression);
+        }
+        if (node.type === 'Identifier')
+            return String(node.name || '');
+        if (node.type === 'MemberAccess') {
+            const base = this.callName(node.expression);
+            return base ? `${base}.${node.memberName}` : String(node.memberName || '');
+        }
+        return '';
+    }
+    finalMemberName(node) {
+        if (!node || typeof node !== 'object')
+            return null;
+        if (node.type === 'FunctionCall' || node.type === 'FunctionCallOptions' || node.type === 'NameValueExpression') {
+            return this.finalMemberName(node.expression);
+        }
+        if (node.type === 'MemberAccess')
+            return String(node.memberName || '');
+        return null;
+    }
+    isStateRef(expr, ctx) {
+        const name = this.identifierName(expr);
+        return !!name && ctx.stateVars.has(name) && !ctx.localVars.has(name);
+    }
+    identifierName(node) {
+        if (!node || typeof node !== 'object')
+            return null;
+        if (node.type === 'Identifier')
+            return String(node.name || '');
+        if (node.type === 'IndexAccess')
+            return this.identifierName(node.base);
+        if (node.type === 'MemberAccess')
+            return this.identifierName(node.expression);
+        return null;
+    }
+    directIdentifierName(node) {
+        if (!node || typeof node !== 'object')
+            return null;
+        if (node.type !== 'Identifier')
+            return null;
+        return String(node.name || '') || null;
+    }
+    sourceText(node) {
+        if (!node || typeof node !== 'object')
+            return '';
+        const parts = [];
+        this.collectText(node, parts);
+        return parts.join(' ');
+    }
+    collectText(node, parts) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.name)
+            parts.push(String(node.name));
+        if (node.memberName)
+            parts.push(String(node.memberName));
+        if (node.namePath)
+            parts.push(String(node.namePath));
+        if (node.typeName) {
+            const sub = [];
+            this.collectText(node.typeName, sub);
+            parts.push(...sub);
+        }
+        for (const child of this.childNodes(node))
+            this.collectText(child, parts);
+    }
+    childNodes(node) {
+        const children = [];
+        if (!node || typeof node !== 'object')
+            return children;
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range' || key === 'comments')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        children.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                children.push(value);
+            }
+        }
+        return children;
+    }
+}
+exports.Erc7683FillValidationDetector = Erc7683FillValidationDetector;
+//# sourceMappingURL=erc7683-fill-validation.js.map