@snovon/solast 0.2.0

package/dist/detectors/erc7683-intent-resolution.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class Erc7683IntentResolutionDetector {
+    readonly id = "erc7683-intent-resolution";
+    readonly patternKey = "erc7683-intent-resolution";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string): ScanResult[];
+}

package/dist/detectors/erc7683-intent-resolution.js

@@ -0,0 +1,457 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Erc7683IntentResolutionDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'erc7683-intent-resolution';
+const LOW_LEVEL_CALL_MEMBERS = new Set(['call', 'delegatecall']);
+const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=']);
+const SETTLEMENT_RE = /(settle|escrow|markfilled|transferfrom|release)/i;
+const TRUST_RE = /(trusted|allow|whitelist|approved|valid)/i;
+const INTENT_RE = /(resolvedcrosschainorder|fillinstruction|fillinstructions|orderdata|fillerdata)/i;
+const FILL_VALIDATION_FIELD_RE = /(fillinstructions?|destinationsettler|origindata|fillerdata|output|settler)/i;
+const FILL_VALIDATION_HELPER_RE = /(validatefill|verifyfill|checkfill|validateoutput|verifyoutput|checkoutput|checksettlement)/i;
+const DECODED_OUTPUT_VAR_RE = /(token|recipient|amount|target|calldata|payload|output|settler)/i;
+const NON_FILL_DECODED_VAR_RE = /^(orderid|id|originchainid|destinationchainid|sourcechainid|chainid|nonce|deadline|expiry)$/i;
+class Erc7683IntentResolutionDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || ast.type !== 'SourceUnit')
+            return [];
+        const findings = [];
+        for (const contract of ast.children || []) {
+            if (contract?.type !== 'ContractDefinition')
+                continue;
+            if (contract.kind === 'interface' || contract.kind === 'library')
+                continue;
+            const stateVars = collectStateVars(contract);
+            for (const fn of contract.subNodes || []) {
+                if (fn?.type !== 'FunctionDefinition')
+                    continue;
+                if (!fn.body)
+                    continue;
+                if (!isResolverEntry(fn))
+                    continue;
+                if (!isResolverShape(fn))
+                    continue;
+                const ctx = {
+                    file,
+                    contractName: String(contract.name || '<anonymous>'),
+                    functionName: String(fn.name || '<fallback>'),
+                    stateVars,
+                    localVars: collectFunctionLocals(fn),
+                    sawSettlement: false,
+                    sawStateWrite: false,
+                    sawMeaningfulValidation: false,
+                    sawWeakValidation: false,
+                    sawIntentDecode: hasIntentShapedSignature(fn),
+                    decodedOutputVars: new Set(),
+                    trustedNames: new Set(),
+                    preSettlementCall: null,
+                    firstStateWrite: null,
+                };
+                analyzeNode(fn.body, ctx);
+                const finding = summarizeFunction(ctx);
+                if (finding)
+                    findings.push(finding);
+            }
+        }
+        return findings;
+    }
+}
+exports.Erc7683IntentResolutionDetector = Erc7683IntentResolutionDetector;
+function isResolverEntry(fn) {
+    return fn.name === 'resolve' || fn.name === 'resolveV3';
+}
+function isResolverShape(fn) {
+    return hasResolverSignatureShape(fn) || hasResolverBodyShape(fn.body);
+}
+function hasResolverSignatureShape(fn) {
+    for (const parameter of fn.parameters || []) {
+        if (hasIntentType(parameter?.typeName))
+            return true;
+    }
+    return false;
+}
+function hasResolverBodyShape(node) {
+    return INTENT_RE.test(sourceText(node));
+}
+function collectStateVars(contract) {
+    const vars = new Set();
+    for (const sub of contract.subNodes || []) {
+        if (sub?.type !== 'StateVariableDeclaration')
+            continue;
+        for (const variable of sub.variables || []) {
+            if (variable?.name)
+                vars.add(String(variable.name));
+        }
+    }
+    return vars;
+}
+function collectFunctionLocals(fn) {
+    const vars = new Set();
+    for (const parameter of fn.parameters || []) {
+        if (parameter?.name)
+            vars.add(String(parameter.name));
+    }
+    for (const parameter of fn.returnParameters || []) {
+        if (parameter?.name)
+            vars.add(String(parameter.name));
+    }
+    collectDeclaredLocals(fn.body, vars);
+    return vars;
+}
+function collectDeclaredLocals(node, vars) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (node.type === 'VariableDeclarationStatement') {
+        for (const variable of node.variables || []) {
+            if (variable?.name)
+                vars.add(String(variable.name));
+        }
+    }
+    for (const child of childNodes(node))
+        collectDeclaredLocals(child, vars);
+}
+function analyzeNode(node, ctx) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (node.type === 'EmitStatement')
+        return;
+    if (node.type === 'Block') {
+        for (const stmt of node.statements || [])
+            analyzeNode(stmt, ctx);
+        return;
+    }
+    if (node.type === 'IfStatement') {
+        analyzeNode(node.condition, ctx);
+        analyzeNode(node.trueBody, ctx);
+        analyzeNode(node.falseBody, ctx);
+        return;
+    }
+    if (node.type === 'VariableDeclarationStatement') {
+        if (isAbiDecode(node.initialValue) || hasIntentType(node)) {
+            ctx.sawIntentDecode = true;
+            recordDecodedOutputVars(node, ctx);
+        }
+        analyzeNode(node.initialValue, ctx);
+        return;
+    }
+    if (node.type === 'ExpressionStatement') {
+        analyzeNode(node.expression, ctx);
+        return;
+    }
+    if (node.type === 'FunctionCall') {
+        handleFunctionCall(node, ctx);
+        for (const arg of node.arguments || [])
+            analyzeNode(arg, ctx);
+        return;
+    }
+    if (node.type === 'BinaryOperation') {
+        if (ASSIGN_OPS.has(String(node.operator)) && refersToState(node.left, ctx)) {
+            ctx.sawStateWrite = true;
+            if (!ctx.firstStateWrite)
+                ctx.firstStateWrite = { loc: locOf(node), node };
+        }
+        analyzeNode(node.left, ctx);
+        analyzeNode(node.right, ctx);
+        return;
+    }
+    if (node.type === 'UnaryOperation') {
+        if ((node.operator === '++' || node.operator === '--' || node.operator === 'delete') && refersToState(node.subExpression, ctx)) {
+            ctx.sawStateWrite = true;
+            if (!ctx.firstStateWrite)
+                ctx.firstStateWrite = { loc: locOf(node), node };
+        }
+        analyzeNode(node.subExpression, ctx);
+        return;
+    }
+    if (hasIntentType(node))
+        ctx.sawIntentDecode = true;
+    for (const child of childNodes(node))
+        analyzeNode(child, ctx);
+}
+function handleFunctionCall(node, ctx) {
+    const name = String(callName(node) || '');
+    const lowerName = name.toLowerCase();
+    if (lowerName === 'require' || lowerName === 'assert') {
+        const condition = node.arguments?.[0];
+        if (isWeakValidation(condition))
+            ctx.sawWeakValidation = true;
+        if (isMeaningfulFillValidation(condition, ctx))
+            ctx.sawMeaningfulValidation = true;
+        recordTrustedGuards(condition, ctx.trustedNames);
+        return;
+    }
+    if (lowerName === 'revert')
+        return;
+    if (SETTLEMENT_RE.test(name)) {
+        ctx.sawSettlement = true;
+    }
+    if (isAbiDecode(node) || hasIntentType(node)) {
+        ctx.sawIntentDecode = true;
+    }
+    if (isLowLevelCall(node) && !ctx.sawSettlement && !isTrustedCallTarget(node, ctx) && !ctx.preSettlementCall) {
+        ctx.preSettlementCall = { loc: locOf(node), node };
+    }
+}
+function summarizeFunction(ctx) {
+    if (ctx.preSettlementCall) {
+        return makeFinding(ctx, ctx.preSettlementCall.loc, 'pre-settlement-call', 'high', `ERC-7683 resolver '${ctx.functionName}' performs an untrusted low-level call before an escrow settlement marker.`);
+    }
+    if (ctx.sawStateWrite && !ctx.sawSettlement && ctx.firstStateWrite) {
+        return makeFinding(ctx, ctx.firstStateWrite.loc, 'escrow-bypass-state-write', 'high', `ERC-7683 resolver '${ctx.functionName}' mutates resolution state without an escrow settlement marker.`);
+    }
+    if (ctx.sawIntentDecode && (!ctx.sawMeaningfulValidation || ctx.sawWeakValidation)) {
+        return makeFinding(ctx, locOf(ctx.firstStateWrite?.node) || { line: 1, column: 0 }, 'weak-fill-validation', 'medium', `ERC-7683 resolver '${ctx.functionName}' does not perform a meaningful require/assert validation of decoded fill output.`);
+    }
+    return null;
+}
+function makeFinding(ctx, loc, pattern, severity, message) {
+    return {
+        file: ctx.file,
+        contract: ctx.contractName,
+        'function': ctx.functionName,
+        line: loc.line,
+        column: loc.column,
+        pattern: `${RULE_ID}/${pattern}`,
+        confidence: 'medium',
+        ruleId: RULE_ID,
+        severity,
+        message,
+        contractName: ctx.contractName,
+        functionName: ctx.functionName,
+        sourceLocation: loc,
+        findingId: '',
+        contractHash: '',
+    };
+}
+function isAbiDecode(node) {
+    return node?.type === 'FunctionCall' && String(callName(node) || '').toLowerCase() === 'abi.decode';
+}
+function callName(node) {
+    if (!node || typeof node !== 'object')
+        return null;
+    if (node.type === 'FunctionCall' || node.type === 'FunctionCallOptions' || node.type === 'NameValueExpression') {
+        return callName(node.expression);
+    }
+    if (node.type === 'Identifier')
+        return String(node.name || '');
+    if (node.type === 'MemberAccess') {
+        const base = callName(node.expression);
+        return base ? `${base}.${node.memberName}` : String(node.memberName || '');
+    }
+    return null;
+}
+function isLowLevelCall(node) {
+    const member = finalMemberName(node);
+    return !!member && LOW_LEVEL_CALL_MEMBERS.has(member.toLowerCase());
+}
+function finalMemberName(node) {
+    if (!node || typeof node !== 'object')
+        return null;
+    if (node.type === 'FunctionCall' || node.type === 'FunctionCallOptions' || node.type === 'NameValueExpression') {
+        return finalMemberName(node.expression);
+    }
+    if (node.type === 'MemberAccess')
+        return String(node.memberName || '');
+    return null;
+}
+function isTrustedCallTarget(node, ctx) {
+    const target = lowLevelTarget(node);
+    const targetName = identifierName(target);
+    if (targetName && ctx.trustedNames.has(targetName))
+        return true;
+    return !!targetName && TRUST_RE.test(targetName);
+}
+function lowLevelTarget(node) {
+    let expr = node;
+    while (expr?.type === 'FunctionCall' || expr?.type === 'FunctionCallOptions' || expr?.type === 'NameValueExpression') {
+        expr = expr.expression;
+    }
+    if (expr?.type === 'MemberAccess')
+        return expr.expression;
+    return null;
+}
+function recordTrustedGuards(node, trustedNames) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (node.type === 'IndexAccess' && TRUST_RE.test(sourceText(node.base))) {
+        const name = identifierName(node.index);
+        if (name)
+            trustedNames.add(name);
+    }
+    for (const child of childNodes(node))
+        recordTrustedGuards(child, trustedNames);
+}
+function isWeakValidation(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (node.type === 'BinaryOperation') {
+        const operator = String(node.operator || '');
+        if ((operator === '>=' || operator === '<=') && isZeroLiteral(node.right))
+            return true;
+        if ((operator === '<=' || operator === '>=') && isZeroLiteral(node.left))
+            return true;
+    }
+    for (const child of childNodes(node)) {
+        if (isWeakValidation(child))
+            return true;
+    }
+    return false;
+}
+function isMeaningfulFillValidation(node, ctx) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (isWeakValidation(node))
+        return false;
+    if (hasFillValidationHelperCall(node))
+        return true;
+    return referencesFillValidationData(node, ctx) && hasValidationShape(node);
+}
+function hasValidationShape(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (node.type === 'BinaryOperation') {
+        const operator = String(node.operator || '');
+        if (['!=', '==', '>', '<', '>=', '<='].includes(operator))
+            return true;
+    }
+    if (node.type === 'UnaryOperation' && node.operator === '!')
+        return true;
+    if (node.type === 'IndexAccess')
+        return true;
+    if (node.type === 'FunctionCall' && hasFillValidationHelperCall(node))
+        return true;
+    for (const child of childNodes(node)) {
+        if (hasValidationShape(child))
+            return true;
+    }
+    return false;
+}
+function referencesFillValidationData(node, ctx) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (node.type === 'Identifier') {
+        const name = String(node.name || '');
+        return ctx.decodedOutputVars.has(name) || FILL_VALIDATION_FIELD_RE.test(name);
+    }
+    if (node.type === 'MemberAccess') {
+        const member = String(node.memberName || '');
+        if (FILL_VALIDATION_FIELD_RE.test(member))
+            return true;
+    }
+    if (node.type === 'FunctionCall' && hasFillValidationHelperCall(node))
+        return true;
+    for (const child of childNodes(node)) {
+        if (referencesFillValidationData(child, ctx))
+            return true;
+    }
+    return false;
+}
+function hasFillValidationHelperCall(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (node.type === 'FunctionCall') {
+        const name = String(callName(node) || '');
+        if (FILL_VALIDATION_HELPER_RE.test(name))
+            return true;
+    }
+    for (const child of childNodes(node)) {
+        if (hasFillValidationHelperCall(child))
+            return true;
+    }
+    return false;
+}
+function recordDecodedOutputVars(node, ctx) {
+    for (const variable of node.variables || []) {
+        const name = String(variable?.name || '');
+        if (!name || NON_FILL_DECODED_VAR_RE.test(name))
+            continue;
+        if (FILL_VALIDATION_FIELD_RE.test(name) || DECODED_OUTPUT_VAR_RE.test(name)) {
+            ctx.decodedOutputVars.add(name);
+        }
+    }
+}
+function isZeroLiteral(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (node.type === 'NumberLiteral')
+        return String(node.number || '') === '0';
+    if (node.type === 'Identifier')
+        return String(node.name || '').toLowerCase() === 'zero';
+    return false;
+}
+function hasIntentShapedSignature(fn) {
+    for (const parameter of fn.parameters || []) {
+        if (INTENT_RE.test(String(parameter?.name || '')) || hasIntentType(parameter))
+            return true;
+    }
+    return false;
+}
+function hasIntentType(node) {
+    return INTENT_RE.test(sourceText(node));
+}
+function refersToState(node, ctx) {
+    const name = identifierName(baseExpression(node));
+    return !!name && ctx.stateVars.has(name) && !ctx.localVars.has(name);
+}
+function baseExpression(node) {
+    let expr = node;
+    while (expr?.type === 'IndexAccess' || expr?.type === 'MemberAccess')
+        expr = expr.base || expr.expression;
+    return expr;
+}
+function identifierName(node) {
+    if (!node || typeof node !== 'object')
+        return null;
+    if (node.type === 'Identifier')
+        return String(node.name || '');
+    return null;
+}
+function childNodes(node) {
+    const children = [];
+    if (!node || typeof node !== 'object')
+        return children;
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'range' || key === 'comments')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item && typeof item === 'object')
+                    children.push(item);
+            }
+        }
+        else if (value && typeof value === 'object') {
+            children.push(value);
+        }
+    }
+    return children;
+}
+function locOf(node) {
+    const loc = (0, ast_1.tryLoc)(node) ?? { line: 1, endLine: 1, column: 0 };
+    return { line: loc.line, column: loc.column };
+}
+function sourceText(node) {
+    if (!node || typeof node !== 'object')
+        return '';
+    const parts = [];
+    collectText(node, parts);
+    return parts.join('.');
+}
+function collectText(node, parts) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (node.name)
+        parts.push(String(node.name));
+    if (node.memberName)
+        parts.push(String(node.memberName));
+    if (node.typeName)
+        parts.push(sourceText(node.typeName));
+    if (node.namePath)
+        parts.push(String(node.namePath));
+    for (const child of childNodes(node))
+        collectText(child, parts);
+}
+//# sourceMappingURL=erc7683-intent-resolution.js.map

package/dist/detectors/erc777-callback-reentrancy.d.ts

@@ -0,0 +1,8 @@
+import type { ScanResult } from '../index';
+export declare class Erc777CallbackReentrancyDetector {
+    readonly id = "erc777-callback-reentrancy";
+    readonly patternKey = "erc777-callback-reentrancy";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+    private observeNode;
+}