@snovon/solast 0.2.0

package/dist/detectors/erc777-callback-reentrancy.js

@@ -0,0 +1,439 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Erc777CallbackReentrancyDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'erc777-callback-reentrancy';
+const ASSIGNMENT_OPERATORS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=']);
+const ERC777_TRANSFER_MEMBERS = new Set(['send', 'operatorSend']);
+const ERC20_TRANSFER_MEMBERS = new Set(['transfer', 'transferFrom']);
+const REENTRANCY_GUARD_RE = /^(nonreentrant|nonreentrantview)$|reentrancyguard/i;
+const BUILTINS = new Set(['msg', 'block', 'tx', 'abi', 'type', 'address', 'payable', 'keccak256', 'require', 'assert']);
+class Erc777CallbackReentrancyDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser', 'solc'];
+    scanAst(ast, file, sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        const lineOffsets = buildLineOffsets(sourceText);
+        const typeInfo = collectTypeInfo(ast);
+        for (const contract of getContracts(ast)) {
+            const kind = String(contract.kind || contract.contractKind || '').toLowerCase();
+            if (kind === 'interface' || kind === 'library')
+                continue;
+            const contractCtx = {
+                contractName: getName(contract) || '<anonymous>',
+                stateVars: collectStateVars(contract),
+                stateVarTypes: collectStateVarTypes(contract),
+            };
+            for (const fn of getFunctions(contract)) {
+                if (!getFunctionBody(fn) || isGuarded(fn))
+                    continue;
+                const functionName = getName(fn) || '<anonymous>';
+                const ctx = {
+                    ...contractCtx,
+                    functionName,
+                    locals: collectLocals(fn),
+                    localAliases: new Map(),
+                    erc1820Evidence: containsErc1820Evidence(fn),
+                    sawCallback: false,
+                    preCallbackStateReads: new Set(),
+                    findingNode: null,
+                };
+                walkInSourceOrder(getFunctionBody(fn), node => this.observeNode(node, ctx, typeInfo));
+                if (ctx.findingNode) {
+                    findings.push(buildFinding(file, contractCtx.contractName, functionName, ctx.findingNode, lineOffsets));
+                }
+            }
+        }
+        return findings;
+    }
+    observeNode(node, ctx, typeInfo) {
+        if (ctx.findingNode)
+            return;
+        if (isVariableDeclarationStatement(node)) {
+            const init = getInitialValue(node);
+            if (!ctx.sawCallback && init) {
+                addAll(ctx.preCallbackStateReads, collectStateReads(init, ctx.stateVars, ctx.locals));
+            }
+            for (const name of getVariableDeclarationNames(node)) {
+                if (!name)
+                    continue;
+                ctx.locals.add(name);
+                if (!ctx.sawCallback && init) {
+                    const aliases = collectStateReads(init, ctx.stateVars, ctx.locals);
+                    if (aliases.size)
+                        ctx.localAliases.set(name, aliases);
+                }
+            }
+            return 'skip-children';
+        }
+        if (isAssignment(node)) {
+            const left = getAssignmentLeft(node);
+            const right = getAssignmentRight(node);
+            const writeTarget = getStateRoot(left, ctx.stateVars, ctx.locals);
+            const rightReads = collectStateReads(right, ctx.stateVars, ctx.locals);
+            const rightAliases = collectLocalAliases(right, ctx.localAliases);
+            if (ctx.sawCallback && writeTarget) {
+                const dependsOnPreState = ctx.preCallbackStateReads.has(writeTarget) ||
+                    intersects(ctx.preCallbackStateReads, rightReads) ||
+                    intersects(ctx.preCallbackStateReads, rightAliases);
+                if (dependsOnPreState)
+                    ctx.findingNode = node;
+            }
+            else if (!ctx.sawCallback) {
+                addAll(ctx.preCallbackStateReads, rightReads);
+                addAll(ctx.preCallbackStateReads, collectStateReads(left, ctx.stateVars, ctx.locals));
+            }
+            const assignedLocal = getIdentifierName(left);
+            if (assignedLocal && ctx.locals.has(assignedLocal)) {
+                const aliases = new Set();
+                addAll(aliases, rightReads);
+                addAll(aliases, rightAliases);
+                if (aliases.size)
+                    ctx.localAliases.set(assignedLocal, aliases);
+                else
+                    ctx.localAliases.delete(assignedLocal);
+            }
+            return 'skip-children';
+        }
+        if (isFunctionCall(node)) {
+            if (isErc777CallbackCall(node, ctx, typeInfo)) {
+                if (!ctx.sawCallback) {
+                    for (const arg of getCallArguments(node)) {
+                        addAll(ctx.preCallbackStateReads, collectStateReads(arg, ctx.stateVars, ctx.locals));
+                        addAll(ctx.preCallbackStateReads, collectLocalAliases(arg, ctx.localAliases));
+                    }
+                }
+                ctx.sawCallback = true;
+                return 'skip-children';
+            }
+            if (!ctx.sawCallback) {
+                addAll(ctx.preCallbackStateReads, collectStateReads(node, ctx.stateVars, ctx.locals));
+                addAll(ctx.preCallbackStateReads, collectLocalAliases(node, ctx.localAliases));
+            }
+        }
+    }
+}
+exports.Erc777CallbackReentrancyDetector = Erc777CallbackReentrancyDetector;
+function collectTypeInfo(ast) {
+    const erc777LikeTypes = new Set();
+    for (const contract of getContracts(ast)) {
+        const name = getName(contract);
+        if (!name)
+            continue;
+        if (/erc777/i.test(name)) {
+            erc777LikeTypes.add(name);
+            continue;
+        }
+        const functionNames = getFunctions(contract).map(fn => getName(fn));
+        if (functionNames.includes('granularity') || functionNames.includes('operatorSend')) {
+            erc777LikeTypes.add(name);
+        }
+    }
+    return { erc777LikeTypes };
+}
+function isErc777CallbackCall(call, ctx, typeInfo) {
+    const callee = unwrapCallOptions(getCallExpression(call));
+    if (!isNode(callee, 'MemberAccess'))
+        return false;
+    const member = getMemberName(callee);
+    const baseName = getIdentifierName(callee.expression);
+    const baseType = baseName ? (ctx.stateVarTypes.get(baseName) || '') : '';
+    const erc777Typed = isErc777LikeType(baseType, typeInfo);
+    if (ERC777_TRANSFER_MEMBERS.has(member))
+        return erc777Typed;
+    if (ERC20_TRANSFER_MEMBERS.has(member))
+        return erc777Typed || ctx.erc1820Evidence;
+    return false;
+}
+function isErc777LikeType(typeName, typeInfo) {
+    if (!typeName)
+        return false;
+    return /erc777/i.test(typeName) || typeInfo.erc777LikeTypes.has(typeName);
+}
+function containsErc1820Evidence(node) {
+    let found = false;
+    walkInSourceOrder(node, child => {
+        if (found)
+            return 'skip-children';
+        if (isNode(child, 'FunctionCall')) {
+            const callee = unwrapCallOptions(getCallExpression(child));
+            if (isNode(callee, 'MemberAccess') && getMemberName(callee) === 'getInterfaceImplementer') {
+                if (childrenOf(child).some(containsErc777TokenLiteral))
+                    found = true;
+            }
+        }
+    });
+    return found;
+}
+function containsErc777TokenLiteral(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    const value = String(node.value ?? node.hexValue ?? '');
+    if (value.includes('ERC777Token'))
+        return true;
+    return childrenOf(node).some(containsErc777TokenLiteral);
+}
+function collectStateVars(contract) {
+    const vars = new Set();
+    for (const child of childrenOf(contract)) {
+        if (!isStateVariableDeclaration(child))
+            continue;
+        for (const decl of getDeclarationVariables(child)) {
+            const name = getName(decl);
+            if (name)
+                vars.add(name);
+        }
+    }
+    return vars;
+}
+function collectStateVarTypes(contract) {
+    const types = new Map();
+    for (const child of childrenOf(contract)) {
+        if (!isStateVariableDeclaration(child))
+            continue;
+        for (const decl of getDeclarationVariables(child)) {
+            const name = getName(decl);
+            if (name)
+                types.set(name, typeNameToString(decl.typeName));
+        }
+    }
+    return types;
+}
+function collectLocals(fn) {
+    const locals = new Set();
+    for (const p of getParameters(fn)) {
+        const name = getName(p);
+        if (name)
+            locals.add(name);
+    }
+    for (const p of getReturnParameters(fn)) {
+        const name = getName(p);
+        if (name)
+            locals.add(name);
+    }
+    return locals;
+}
+function collectStateReads(node, stateVars, locals) {
+    const reads = new Set();
+    walkInSourceOrder(node, child => {
+        if (isNode(child, 'Identifier')) {
+            const name = getName(child);
+            if (stateVars.has(name) && !locals.has(name) && !BUILTINS.has(name))
+                reads.add(name);
+        }
+    });
+    return reads;
+}
+function collectLocalAliases(node, aliases) {
+    const reads = new Set();
+    walkInSourceOrder(node, child => {
+        if (!isNode(child, 'Identifier'))
+            return;
+        const alias = aliases.get(getName(child));
+        if (alias)
+            addAll(reads, alias);
+    });
+    return reads;
+}
+function getStateRoot(node, stateVars, locals) {
+    if (!node || typeof node !== 'object')
+        return '';
+    if (isNode(node, 'Identifier')) {
+        const name = getName(node);
+        return stateVars.has(name) && !locals.has(name) ? name : '';
+    }
+    if (isNode(node, 'IndexAccess'))
+        return getStateRoot(node.base ?? node.baseExpression, stateVars, locals);
+    if (isNode(node, 'MemberAccess'))
+        return getStateRoot(node.expression, stateVars, locals);
+    return '';
+}
+function isGuarded(fn) {
+    for (const modifier of fn.modifiers || []) {
+        const name = getModifierName(modifier).toLowerCase();
+        if (REENTRANCY_GUARD_RE.test(name))
+            return true;
+    }
+    return false;
+}
+function buildFinding(file, contractName, functionName, node, lineOffsets) {
+    const loc = (0, ast_1.getLoc)(node, lineOffsets) || { line: 0, column: 0 };
+    return {
+        file,
+        contract: contractName,
+        'function': functionName,
+        line: loc.line,
+        endLine: loc.line,
+        column: loc.column,
+        pattern: RULE_ID,
+        confidence: 'high',
+        ruleId: RULE_ID,
+        severity: 'error',
+        message: `ERC777 callback reentrancy: '${functionName}' performs an ERC777 token transfer before dependent accounting is updated.`,
+        contractName,
+        functionName,
+        sourceLocation: loc,
+        trace: 'erc777-transfer-before-dependent-state-write',
+        findingId: '',
+        contractHash: '',
+    };
+}
+function getContracts(ast) {
+    return childrenOf(ast).filter(child => isNode(child, 'ContractDefinition'));
+}
+function getFunctions(contract) {
+    return childrenOf(contract).filter(child => isNode(child, 'FunctionDefinition'));
+}
+function isStateVariableDeclaration(node) {
+    if (isNode(node, 'StateVariableDeclaration'))
+        return true;
+    return isNode(node, 'VariableDeclaration') && node.stateVariable === true;
+}
+function getDeclarationVariables(node) {
+    if (Array.isArray(node.variables))
+        return node.variables;
+    if (isNode(node, 'VariableDeclaration'))
+        return [node];
+    return [];
+}
+function getParameters(fn) {
+    return fn.parameters?.parameters || fn.parameters || [];
+}
+function getReturnParameters(fn) {
+    return fn.returnParameters?.parameters || fn.returnParameters || [];
+}
+function getFunctionBody(fn) {
+    return fn.body || null;
+}
+function isVariableDeclarationStatement(node) {
+    return isNode(node, 'VariableDeclarationStatement');
+}
+function getInitialValue(node) {
+    return node.initialValue ?? null;
+}
+function getVariableDeclarationNames(node) {
+    const declarations = node.variables || node.declarations || [];
+    return declarations.map((decl) => getName(decl)).filter(Boolean);
+}
+function isAssignment(node) {
+    return (isNode(node, 'BinaryOperation') || isNode(node, 'Assignment')) && ASSIGNMENT_OPERATORS.has(getOperator(node));
+}
+function getAssignmentLeft(node) {
+    return node.left ?? node.leftHandSide;
+}
+function getAssignmentRight(node) {
+    return node.right ?? node.rightHandSide;
+}
+function getOperator(node) {
+    return node?.operator || '';
+}
+function isFunctionCall(node) {
+    return isNode(node, 'FunctionCall');
+}
+function getCallExpression(node) {
+    return node.expression;
+}
+function getCallArguments(node) {
+    return Array.isArray(node?.arguments) ? node.arguments : [];
+}
+function unwrapCallOptions(expr) {
+    if (isNode(expr, 'NameValueExpression') || isNode(expr, 'FunctionCallOptions'))
+        return expr.expression;
+    return expr;
+}
+function getMemberName(node) {
+    return String(node?.memberName || '');
+}
+function getIdentifierName(node) {
+    return isNode(node, 'Identifier') ? getName(node) : '';
+}
+function getModifierName(modifier) {
+    if (!modifier || typeof modifier !== 'object')
+        return '';
+    if (typeof modifier.name === 'string')
+        return modifier.name;
+    if (modifier.name)
+        return getName(modifier.name);
+    if (modifier.modifierName)
+        return getName(modifier.modifierName);
+    return '';
+}
+function typeNameToString(typeName) {
+    if (!typeName || typeof typeName !== 'object')
+        return '';
+    if (typeof typeName.namePath === 'string')
+        return typeName.namePath.split('.').pop() || '';
+    if (typeof typeName.name === 'string')
+        return typeName.name;
+    if (typeName.pathNode)
+        return typeNameToString(typeName.pathNode);
+    if (typeName.typeName)
+        return typeNameToString(typeName.typeName);
+    return '';
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function getName(node) {
+    return String(node?.name || '');
+}
+function walkInSourceOrder(node, visitor) {
+    if (!node || typeof node !== 'object')
+        return;
+    const result = visitor(node);
+    if (result === 'skip-children')
+        return;
+    for (const child of childrenOf(node))
+        walkInSourceOrder(child, visitor);
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const children = [];
+    for (const key of childKeys(node)) {
+        const value = node[key];
+        if (Array.isArray(value)) {
+            children.push(...value.filter(item => item && typeof item === 'object'));
+        }
+        else if (value && typeof value === 'object') {
+            children.push(value);
+        }
+    }
+    return children;
+}
+function childKeys(node) {
+    const preferred = [
+        'children', 'nodes', 'subNodes', 'statements', 'expression', 'body',
+        'initialValue', 'value', 'left', 'right', 'leftHandSide', 'rightHandSide',
+        'leftExpression', 'rightExpression', 'base', 'index', 'baseExpression',
+        'indexExpression', 'arguments', 'declarations', 'variables', 'components',
+        'subExpression', 'condition', 'trueBody', 'falseBody', 'catchClauses',
+    ];
+    return preferred.filter(key => Object.prototype.hasOwnProperty.call(node, key));
+}
+function addAll(target, source) {
+    for (const item of source)
+        target.add(item);
+}
+function intersects(a, b) {
+    for (const item of b)
+        if (a.has(item))
+            return true;
+    return false;
+}
+function buildLineOffsets(sourceText) {
+    if (sourceText === undefined)
+        return undefined;
+    const lineOffsets = [0];
+    let byteOffset = 0;
+    for (const char of sourceText) {
+        byteOffset += Buffer.byteLength(char, 'utf8');
+        if (char === '\n')
+            lineOffsets.push(byteOffset);
+    }
+    return lineOffsets;
+}
+//# sourceMappingURL=erc777-callback-reentrancy.js.map

package/dist/detectors/erc777-reentrancy.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class Erc777ReentrancyDetector {
+    readonly id = "erc777-reentrancy";
+    readonly patternKey = "erc777-reentrancy";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+}