@snovon/solast 0.2.0

package/dist/detectors/flashloan-reentrancy.js

@@ -0,0 +1,383 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FlashloanReentrancyDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'flashloan-reentrancy';
+const PATTERN_PARALUNI = `${RULE_ID}/paraluni-flashloan-callback`;
+const SOURCE = 'x-2026-05-04-paraluni-flashloan-reentrancy';
+const REENTRANCY_GUARD_MODIFIER = /^(nonreentrant|noreentrant|reentrancyguard|noreentry|nonreentrantcall)$/i;
+const ACCESS_CONTROL_MODIFIER_PREFIX = /^(only|require|restricted)/i;
+const ACCESS_CONTROL_MODIFIER_NAMES = new Set([
+    'auth', 'authorized', 'whenauthorized', 'whitelisted',
+]);
+const FLASHLOAN_CALLBACK_NAMES = new Set([
+    'pancakecall',
+    'uniswapv2call',
+    'onflashloan',
+    'executeoperation',
+    'flashloancallback',
+    'receiveflashloan',
+    'depositbyaddliquidity',
+]);
+const ERC3156_CALLBACK_INTERFACES = new Set([
+    'ierc3156flashborrower',
+    'iflashloanreceiver',
+]);
+const MUTATION_OPS = new Set([
+    '=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=',
+]);
+function isNode(node, kind) {
+    return node?.type === kind;
+}
+function getContractMembers(contract) {
+    if (!contract || typeof contract !== 'object')
+        return [];
+    if (Array.isArray(contract.subNodes))
+        return contract.subNodes;
+    return [];
+}
+function collectContracts(ast) {
+    const out = [];
+    if (Array.isArray(ast?.children)) {
+        for (const child of ast.children) {
+            if (isNode(child, 'ContractDefinition'))
+                out.push(child);
+        }
+    }
+    return out;
+}
+function isInterfaceLike(contract) {
+    const kind = String(contract?.kind || '').toLowerCase();
+    return kind === 'interface' || kind === 'library';
+}
+function isExternallyReachable(fn) {
+    if (!fn)
+        return false;
+    if (fn.isConstructor === true)
+        return false;
+    const visibility = String(fn.visibility || '').toLowerCase();
+    return visibility === 'public' || visibility === 'external' || visibility === 'default';
+}
+function getModifierName(modifier) {
+    if (!modifier)
+        return '';
+    if (typeof modifier === 'string')
+        return modifier;
+    if (typeof modifier.name === 'string')
+        return modifier.name;
+    return '';
+}
+function hasReentrancyGuard(fn) {
+    for (const m of fn?.modifiers || []) {
+        const name = getModifierName(m);
+        if (REENTRANCY_GUARD_MODIFIER.test(name))
+            return true;
+    }
+    return false;
+}
+function hasAccessControl(fn) {
+    for (const m of fn?.modifiers || []) {
+        const name = getModifierName(m);
+        const lower = name.toLowerCase();
+        if (ACCESS_CONTROL_MODIFIER_PREFIX.test(name))
+            return true;
+        if (ACCESS_CONTROL_MODIFIER_NAMES.has(lower))
+            return true;
+    }
+    return false;
+}
+function getContractFunctions(contract) {
+    return getContractMembers(contract).filter(node => isNode(node, 'FunctionDefinition'));
+}
+function buildInternalFunctionMap(contract) {
+    const out = new Map();
+    for (const fn of getContractFunctions(contract)) {
+        const name = String(fn.name || '');
+        if (!name)
+            continue;
+        const visibility = String(fn.visibility || '').toLowerCase();
+        if (visibility === 'internal' || visibility === 'private' || visibility === 'default') {
+            out.set(name, fn);
+        }
+        else if (visibility === 'public') {
+            out.set(name, fn);
+        }
+    }
+    return out;
+}
+function locOf(node) {
+    const { line, column } = (0, ast_1.assertLoc)(node);
+    return { line, column };
+}
+function isFlashloanCallbackName(name) {
+    return FLASHLOAN_CALLBACK_NAMES.has(name.toLowerCase());
+}
+function inheritsErc3156(contract) {
+    for (const base of contract.baseContracts || []) {
+        const baseNode = base?.baseName;
+        const namePath = String(baseNode?.namePath || baseNode?.name || '');
+        const last = namePath.split('.').pop() || '';
+        if (ERC3156_CALLBACK_INTERFACES.has(last.toLowerCase()))
+            return true;
+    }
+    return false;
+}
+function isFlashloanEntryPoint(fn, contract) {
+    const name = String(fn.name || '');
+    if (!name)
+        return false;
+    if (isFlashloanCallbackName(name))
+        return true;
+    // Recognize ERC3156-shaped callbacks via interface inheritance.
+    if (inheritsErc3156(contract) && /^onflashloan$/i.test(name))
+        return true;
+    return false;
+}
+// External call = FunctionCall whose callee is a MemberAccess. This catches:
+//   - low-level: x.call{value:n}(""), x.transfer(...), x.send(...)
+//   - typed: IERC20(token).transferFrom(...), router.swap(...), msg.sender.pull(...)
+// Internal helper invocations are plain Identifier callees and are NOT external.
+function isExternalCallExpression(node) {
+    if (!isNode(node, 'FunctionCall'))
+        return false;
+    let expr = node.expression;
+    // Unwrap call-options: foo{value: x}(args)
+    if (isNode(expr, 'NameValueExpression') || isNode(expr, 'FunctionCallOptions')) {
+        expr = expr.expression;
+    }
+    return isNode(expr, 'MemberAccess');
+}
+// Match identifier-style internal call: foo(args) where callee is a bare Identifier.
+function getInternalCallTarget(node) {
+    if (!isNode(node, 'FunctionCall'))
+        return null;
+    const expr = node.expression;
+    if (isNode(expr, 'Identifier')) {
+        return String(expr.name || '');
+    }
+    return null;
+}
+// A "user-accounting" mutation: state write whose LHS subtree contains an
+// IndexAccess (mapping/array indexing). This filters out incidental writes to
+// flat state vars (e.g. `lastProfit = ...`) on legitimate flashloan callbacks.
+function containsIndexAccess(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (isNode(node, 'IndexAccess'))
+        return true;
+    for (const child of childrenOf(node)) {
+        if (containsIndexAccess(child))
+            return true;
+    }
+    return false;
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const out = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'range')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                if (item && typeof item === 'object')
+                    out.push(item);
+        }
+        else if (value && typeof value === 'object') {
+            out.push(value);
+        }
+    }
+    return out;
+}
+function isInterestingMutation(node) {
+    if (isNode(node, 'BinaryOperation') && MUTATION_OPS.has(String(node.operator))) {
+        return containsIndexAccess(node.left);
+    }
+    if (isNode(node, 'UnaryOperation')) {
+        const op = String(node.operator || '');
+        if (op === 'delete')
+            return containsIndexAccess(node.subExpression);
+        if (op === '++' || op === '--')
+            return containsIndexAccess(node.subExpression);
+    }
+    return false;
+}
+// Walk source-ordered. `afterCall` is in-flow only — we never write back to
+// state.externalCall after the first hit, so once it is set in any branch the
+// rest of the traversal sees afterCall=true via the boolean argument we thread.
+function walk(node, state, afterCall) {
+    if (!node || typeof node !== 'object')
+        return afterCall;
+    if (state.externalCall && state.mutation)
+        return afterCall;
+    if (isNode(node, 'EmitStatement'))
+        return afterCall;
+    if (isNode(node, 'Block') || isNode(node, 'UncheckedBlock')) {
+        for (const stmt of node.statements || []) {
+            afterCall = walk(stmt, state, afterCall);
+        }
+        return afterCall;
+    }
+    if (isNode(node, 'ExpressionStatement')) {
+        return walk(node.expression, state, afterCall);
+    }
+    if (isNode(node, 'IfStatement')) {
+        afterCall = walk(node.condition, state, afterCall);
+        if (node.trueBody)
+            afterCall = walk(node.trueBody, state, afterCall);
+        if (node.falseBody)
+            afterCall = walk(node.falseBody, state, afterCall);
+        return afterCall;
+    }
+    if (isNode(node, 'ForStatement')) {
+        if (node.initExpression)
+            afterCall = walk(node.initExpression, state, afterCall);
+        if (node.conditionExpression)
+            afterCall = walk(node.conditionExpression, state, afterCall);
+        if (node.body)
+            afterCall = walk(node.body, state, afterCall);
+        if (node.loopExpression)
+            afterCall = walk(node.loopExpression, state, afterCall);
+        return afterCall;
+    }
+    if (isNode(node, 'WhileStatement') || isNode(node, 'DoWhileStatement')) {
+        if (node.condition)
+            afterCall = walk(node.condition, state, afterCall);
+        if (node.body)
+            afterCall = walk(node.body, state, afterCall);
+        return afterCall;
+    }
+    if (isNode(node, 'VariableDeclarationStatement')) {
+        if (node.initialValue)
+            afterCall = walk(node.initialValue, state, afterCall);
+        return afterCall;
+    }
+    if (isNode(node, 'ReturnStatement') || isNode(node, 'Return')) {
+        if (node.expression)
+            afterCall = walk(node.expression, state, afterCall);
+        return afterCall;
+    }
+    if (isNode(node, 'TryStatement')) {
+        if (node.expression)
+            afterCall = walk(node.expression, state, afterCall);
+        if (node.body)
+            afterCall = walk(node.body, state, afterCall);
+        for (const c of node.catchClauses || []) {
+            if (c.body)
+                afterCall = walk(c.body, state, afterCall);
+        }
+        return afterCall;
+    }
+    if (isNode(node, 'FunctionCall')) {
+        if (isExternalCallExpression(node)) {
+            if (!state.externalCall) {
+                state.externalCall = locOf(node);
+            }
+            // Walk arguments and callee subtree first; whether they themselves are
+            // external is unimportant — once we mark afterCall, any mutation seen
+            // after this node counts.
+            for (const arg of node.arguments || [])
+                walk(arg, state, true);
+            if (node.expression)
+                walk(node.expression, state, true);
+            return true;
+        }
+        // Internal call: descend into target body if we can resolve it.
+        const targetName = getInternalCallTarget(node);
+        if (targetName) {
+            const target = state.internalFns.get(targetName);
+            if (target && !state.visiting.has(target) && target.body) {
+                state.visiting.add(target);
+                try {
+                    afterCall = walk(target.body, state, afterCall);
+                }
+                finally {
+                    state.visiting.delete(target);
+                }
+            }
+        }
+        for (const arg of node.arguments || [])
+            afterCall = walk(arg, state, afterCall);
+        if (node.expression)
+            afterCall = walk(node.expression, state, afterCall);
+        return afterCall;
+    }
+    if (isInterestingMutation(node)) {
+        if (afterCall && !state.mutation) {
+            state.mutation = locOf(node);
+        }
+        return afterCall;
+    }
+    for (const child of childrenOf(node)) {
+        afterCall = walk(child, state, afterCall);
+    }
+    return afterCall;
+}
+class FlashloanReentrancyDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        for (const contract of collectContracts(ast)) {
+            if (isInterfaceLike(contract))
+                continue;
+            const contractName = contract.name || '<anonymous>';
+            const internalFns = buildInternalFunctionMap(contract);
+            for (const fn of getContractFunctions(contract)) {
+                if (!isExternallyReachable(fn))
+                    continue;
+                const mutability = String(fn.stateMutability || '').toLowerCase();
+                if (mutability === 'view' || mutability === 'pure')
+                    continue;
+                if (hasReentrancyGuard(fn))
+                    continue;
+                if (hasAccessControl(fn))
+                    continue;
+                if (!isFlashloanEntryPoint(fn, contract))
+                    continue;
+                const body = fn.body;
+                if (!body)
+                    continue;
+                const state = {
+                    externalCall: null,
+                    mutation: null,
+                    internalFns,
+                    visiting: new Set(),
+                };
+                walk(body, state, false);
+                if (!state.externalCall || !state.mutation)
+                    continue;
+                const fnName = String(fn.name || '');
+                findings.push({
+                    file,
+                    contract: contractName,
+                    'function': fnName,
+                    line: state.externalCall.line,
+                    endLine: state.mutation.line,
+                    column: state.externalCall.column,
+                    pattern: PATTERN_PARALUNI,
+                    confidence: 'high',
+                    category: 'vulnerability',
+                    ruleId: RULE_ID,
+                    severity: 'critical',
+                    message: `Flashloan reentrancy in '${contractName}.${fnName}': value-bearing external call precedes user/pool accounting. Matches the 2022-03-13 Paraluni flashloan-reentrancy pattern.`,
+                    rationale: 'The function is a recognized flashloan callback or Paraluni-style deposit entrypoint that performs an external call before finalizing per-user accounting (mapping/array writes). An attacker can re-enter through the callback with manipulated state and inflate balances.',
+                    suggestedFix: 'Reorder accounting to precede the external call (CEI), or wrap the entrypoint with a `nonReentrant` guard.',
+                    contractName,
+                    functionName: fnName,
+                    sourceLocation: { line: state.externalCall.line, column: state.externalCall.column },
+                    callbackEdge: 'flashloan-callback-external-call-before-accounting',
+                    findingId: '',
+                    contractHash: '',
+                    source: SOURCE,
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.FlashloanReentrancyDetector = FlashloanReentrancyDetector;
+//# sourceMappingURL=flashloan-reentrancy.js.map

package/dist/detectors/flashloan-token-migrate.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class FlashloanTokenMigrateDetector {
+    readonly id = "flashloan-token-migrate";
+    readonly patternKey = "flashloan-token-migrate";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string, _sourceText?: string): ScanResult[];
+}

package/dist/detectors/flashloan-token-migrate.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FlashloanTokenMigrateDetector = void 0;
+const RULE_ID = 'flashloan-token-migrate';
+const FLASHLOAN_CALL_NAMES = new Set([
+    'flashloan',
+    'flashloan',
+    'flashloanSimple'.toLowerCase(),
+    'executeflashloan',
+    'receiveflashloan',
+]);
+const FLASHLOAN_CALLBACK_NAMES = new Set([
+    'executeoperation',
+    'receiveflashloan',
+    'onflashloan',
+    'uniswapv3flashcallback',
+    'pancakecall',
+    'uniswapv2call',
+]);
+const MIGRATION_FUNCTION_HINTS = [
+    'migrate',
+    'migration',
+    'convert',
+    'conversion',
+    'redeem',
+    'redemption',
+    'swap',
+    'bridge',
+];
+class FlashloanTokenMigrateDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file, _sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const results = [];
+        for (const contractNode of collectContracts(ast)) {
+            const kind = String(contractNode.kind || '').toLowerCase();
+            if (kind === 'interface')
+                continue;
+            const contractName = contractNode.name || '<anonymous>';
+            for (const fn of collectFunctions(contractNode)) {
+                if (!fn.body)
+                    continue;
+                const functionName = fn.name || '<anonymous>';
+                const fnKey = functionName.toLowerCase();
+                const isCallback = FLASHLOAN_CALLBACK_NAMES.has(fnKey);
+                const isMigrationContext = isCallback || MIGRATION_FUNCTION_HINTS.some(hint => fnKey.includes(hint));
+                if (!isMigrationContext)
+                    continue;
+                const analysis = analyzeFunction(fn, isCallback);
+                if (!analysis)
+                    continue;
+                const loc = fn.loc?.start ? { line: fn.loc.start.line, column: fn.loc.start.column } : { line: 0, column: 0 };
+                results.push({
+                    file,
+                    contract: contractName,
+                    'function': functionName,
+                    line: loc.line,
+                    column: loc.column,
+                    pattern: RULE_ID,
+                    confidence: 'medium',
+                    ruleId: RULE_ID,
+                    severity: 'high',
+                    message: `Flashloan token migration flow in ${contractName}.${functionName} reads ${analysis.dependency} after flashloan context and uses the derived amount before approve + transferFrom finalization. Use a pre-flashloan snapshot, fixed rate, or delayed/oracle-bounded accounting for the migration conversion.`,
+                    contractName,
+                    functionName,
+                    sourceLocation: loc,
+                    findingId: '',
+                    contractHash: '',
+                });
+            }
+        }
+        return results;
+    }
+}
+exports.FlashloanTokenMigrateDetector = FlashloanTokenMigrateDetector;
+function analyzeFunction(fn, isCallback) {
+    const events = collectFlowEvents(fn.body);
+    if (isCallback) {
+        events.unshift({ index: -1, node: fn, kind: 'flashloan' });
+    }
+    const flashEvents = events.filter(event => event.kind === 'flashloan');
+    const balanceEvents = events.filter(event => event.kind === 'balanceOf');
+    const approveEvents = events.filter(event => event.kind === 'approve');
+    const transferFromEvents = events.filter(event => event.kind === 'transferFrom');
+    if (flashEvents.length === 0 || balanceEvents.length === 0 || approveEvents.length === 0 || transferFromEvents.length === 0) {
+        return null;
+    }
+    const tainted = computeBalanceDerivedLocals(fn.body);
+    for (const flash of flashEvents) {
+        for (const balance of balanceEvents) {
+            if (balance.index <= flash.index)
+                continue;
+            const approve = approveEvents.find(event => event.index > balance.index);
+            if (!approve)
+                continue;
+            const transferFrom = transferFromEvents.find(event => event.index > approve.index && callUsesTaintedAmount(event.node, tainted));
+            if (!transferFrom)
+                continue;
+            return { dependency: 'balanceOf' };
+        }
+    }
+    return null;
+}
+function collectFlowEvents(body) {
+    const events = [];
+    let index = 0;
+    walkBody(body, node => {
+        if (node?.type !== 'FunctionCall')
+            return;
+        const name = getCalleeName(node).toLowerCase();
+        if (FLASHLOAN_CALL_NAMES.has(name)) {
+            events.push({ index, node, kind: 'flashloan' });
+        }
+        else if (name === 'balanceof') {
+            events.push({ index, node, kind: 'balanceOf' });
+        }
+        else if (name === 'approve') {
+            events.push({ index, node, kind: 'approve' });
+        }
+        else if (name === 'transferfrom') {
+            events.push({ index, node, kind: 'transferFrom' });
+        }
+        index++;
+    });
+    return events;
+}
+function computeBalanceDerivedLocals(body) {
+    const tainted = new Set();
+    let changed = true;
+    let safety = 0;
+    while (changed && safety < 8) {
+        changed = false;
+        safety++;
+        walkBody(body, node => {
+            if (node?.type === 'VariableDeclarationStatement') {
+                const init = node.initialValue;
+                if (!init || (!containsCallNamed(init, 'balanceof') && !usesTaintedIdentifier(init, tainted)))
+                    return;
+                for (const variable of node.variables || []) {
+                    if (variable?.name && !tainted.has(variable.name)) {
+                        tainted.add(variable.name);
+                        changed = true;
+                    }
+                }
+            }
+            else if (isAssignment(node)) {
+                const rhs = getAssignmentRhs(node);
+                const lhs = getAssignmentLhs(node);
+                if (!rhs || (!containsCallNamed(rhs, 'balanceof') && !usesTaintedIdentifier(rhs, tainted)))
+                    return;
+                const name = getBaseIdentifierName(lhs);
+                if (name && !tainted.has(name)) {
+                    tainted.add(name);
+                    changed = true;
+                }
+            }
+        });
+    }
+    return tainted;
+}
+function callUsesTaintedAmount(call, tainted) {
+    if (tainted.size === 0)
+        return false;
+    for (const arg of call.arguments || []) {
+        if (usesTaintedIdentifier(arg, tainted))
+            return true;
+    }
+    return false;
+}
+function containsCallNamed(node, needle) {
+    let found = false;
+    walkBody(node, child => {
+        if (found || child?.type !== 'FunctionCall')
+            return;
+        if (getCalleeName(child).toLowerCase() === needle)
+            found = true;
+    });
+    return found;
+}
+function usesTaintedIdentifier(node, tainted) {
+    let found = false;
+    walkBody(node, child => {
+        if (found || !child)
+            return;
+        if (child.type === 'Identifier' && tainted.has(child.name))
+            found = true;
+    });
+    return found;
+}
+function getCalleeName(node) {
+    const expr = node?.expression;
+    if (!expr)
+        return '';
+    if (expr.type === 'Identifier')
+        return expr.name || '';
+    if (expr.type === 'MemberAccess')
+        return expr.memberName || '';
+    return '';
+}
+function getBaseIdentifierName(node) {
+    if (!node || typeof node !== 'object')
+        return '';
+    if (node.type === 'Identifier')
+        return node.name || '';
+    if (node.type === 'MemberAccess')
+        return getBaseIdentifierName(node.expression);
+    if (node.type === 'IndexAccess')
+        return getBaseIdentifierName(node.base || node.baseExpression);
+    return '';
+}
+function isAssignment(node) {
+    if (node?.type === 'Assignment')
+        return true;
+    if (node?.type === 'BinaryOperation') {
+        return ['=', '+=', '-=', '*=', '/=', '%='].includes(node.operator);
+    }
+    return false;
+}
+function getAssignmentLhs(node) {
+    if (node.type === 'Assignment')
+        return node.leftHandSide;
+    if (node.type === 'BinaryOperation')
+        return node.left;
+    return null;
+}
+function getAssignmentRhs(node) {
+    if (node.type === 'Assignment')
+        return node.rightHandSide;
+    if (node.type === 'BinaryOperation')
+        return node.right;
+    return null;
+}
+function collectContracts(ast) {
+    const out = [];
+    walkBody(ast, node => {
+        if (node?.type === 'ContractDefinition')
+            out.push(node);
+    });
+    return out;
+}
+function collectFunctions(contract) {
+    const subs = contract.subNodes || contract.nodes || [];
+    return subs.filter((node) => node?.type === 'FunctionDefinition');
+}
+function walkBody(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const child of childrenOf(node))
+        walkBody(child, visit);
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const out = [];
+    for (const [key, val] of Object.entries(node)) {
+        if (key === 'loc' || key === 'src' || key === 'range' || key === 'id' || key === 'typeName' || key === 'typeDescriptions')
+            continue;
+        if (Array.isArray(val)) {
+            for (const item of val) {
+                if (item && typeof item === 'object')
+                    out.push(item);
+            }
+        }
+        else if (val && typeof val === 'object') {
+            out.push(val);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=flashloan-token-migrate.js.map

package/dist/detectors/force-fed-eth-state-corruption.d.ts

@@ -0,0 +1,32 @@
+import type { ScanResult } from '../index';
+export declare class ForceFedEthStateCorruptionDetector {
+    readonly id = "force-fed-eth-state-corruption";
+    readonly patternKey = "force-fed-eth-state-corruption";
+    readonly supportedAstKinds: "parser"[];
+    readonly descriptor: {
+        id: string;
+        shortDescription: string;
+        helpUri: string;
+        defaultSeverity: "medium";
+        help: string;
+    };
+    private currentFile;
+    private currentContractName;
+    private currentContractIsConcrete;
+    private functionStack;
+    private findings;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    'ContractDefinition:exit'(): void;
+    FunctionDefinition(node: any): void;
+    'FunctionDefinition:exit'(node: any): void;
+    VariableDeclarationStatement(node: any): void;
+    ExpressionStatement(node: any): void;
+    FunctionCall(node: any): void;
+    IfStatement(node: any): void;
+    Conditional(node: any): void;
+    ReturnStatement(node: any): void;
+    private emitFinding;
+    private currentFunction;
+}