@snovon/solast 0.2.0

package/dist/detectors/front-running-shared-collateral-write.js

@@ -0,0 +1,508 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FrontRunningSharedCollateralWriteDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'front-running-shared-collateral-write';
+const PATTERN = `${RULE_ID}/write-before-linked-external-call`;
+const LOW_LEVEL_CALLS = new Set(['call', 'delegatecall', 'staticcall']);
+const SAFE_RECEIVERS = new Set(['this', 'super']);
+const ASSIGNMENT_OPERATORS = new Set([
+    '=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=',
+]);
+const BALANCE_LIKE_STATE_NAMES = [
+    'balance', 'balances', 'collateral', 'debt', 'liquidity', 'reserve', 'reserves',
+    'share', 'shares', 'stake', 'stakes', 'supply', 'totalcollateral', 'totalbalance',
+];
+const REGISTRY_LIKE_STATE_NAMES = [
+    'asset', 'assets', 'listing', 'listings', 'pool', 'pools', 'registry', 'registries',
+    'token', 'tokens',
+];
+class FrontRunningSharedCollateralWriteDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'Shared collateral state is written before a linked external interaction.',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'medium',
+        help: 'Move the external interaction after independent checks and avoid passing freshly written shared collateral state into call data, targets, receivers, or call value.',
+    };
+    currentFile = '';
+    currentContract = '';
+    inExecutableContract = false;
+    stateVars = new Map();
+    sharedStateVars = new Set();
+    hasUnresolvedBase = false;
+    externalTypeNames = new Set();
+    contractIndex = new Map();
+    fn = null;
+    findings = [];
+    setFile(file) {
+        this.currentFile = file;
+        this.currentContract = '';
+        this.inExecutableContract = false;
+        this.stateVars = new Map();
+        this.sharedStateVars = new Set();
+        this.hasUnresolvedBase = false;
+        this.externalTypeNames = new Set();
+        this.contractIndex = new Map();
+        this.fn = null;
+        this.findings = [];
+    }
+    getFindings() {
+        return this.findings;
+    }
+    SourceUnit(node) {
+        this.contractIndex = new Map();
+        this.externalTypeNames = new Set();
+        for (const child of node?.children || []) {
+            if (!(0, ast_1.isNode)(child, 'ContractDefinition'))
+                continue;
+            const name = child?.name;
+            if (typeof name !== 'string' || !name)
+                continue;
+            if (child?.kind === 'contract' || child?.kind === 'interface')
+                this.externalTypeNames.add(name);
+            const info = {
+                bases: extractBaseContractNames(child),
+                sharedVars: new Set(),
+                allVars: new Map(),
+            };
+            for (const sub of child?.subNodes || []) {
+                if (!(0, ast_1.isNode)(sub, 'StateVariableDeclaration'))
+                    continue;
+                for (const variable of sub?.variables || []) {
+                    const vname = variable?.name;
+                    if (typeof vname !== 'string' || !vname)
+                        continue;
+                    info.allVars.set(vname, variable);
+                    if (isSharedCollateralState(variable))
+                        info.sharedVars.add(vname);
+                }
+            }
+            this.contractIndex.set(name, info);
+        }
+    }
+    ContractDefinition(node) {
+        this.currentContract = node?.name || '<anonymous>';
+        this.inExecutableContract = node?.kind !== 'interface' && node?.kind !== 'library';
+        this.stateVars = new Map();
+        this.sharedStateVars = new Set();
+        this.hasUnresolvedBase = false;
+        this.fn = null;
+        if (!this.inExecutableContract)
+            return;
+        const directBases = extractBaseContractNames(node);
+        const visited = new Set();
+        const queue = [...directBases];
+        while (queue.length > 0) {
+            const baseName = queue.shift();
+            if (visited.has(baseName))
+                continue;
+            visited.add(baseName);
+            const info = this.contractIndex.get(baseName);
+            if (!info) {
+                this.hasUnresolvedBase = true;
+                continue;
+            }
+            for (const [vname, variable] of info.allVars) {
+                if (!this.stateVars.has(vname))
+                    this.stateVars.set(vname, variable);
+            }
+            for (const shared of info.sharedVars)
+                this.sharedStateVars.add(shared);
+            for (const next of info.bases)
+                queue.push(next);
+        }
+    }
+    ContractDefinition_post(_node) {
+        this.currentContract = '';
+        this.inExecutableContract = false;
+        this.stateVars = new Map();
+        this.sharedStateVars = new Set();
+        this.hasUnresolvedBase = false;
+        this.fn = null;
+    }
+    ['ContractDefinition:exit'](node) {
+        this.ContractDefinition_post(node);
+    }
+    StateVariableDeclaration(node) {
+        if (!this.inExecutableContract)
+            return;
+        for (const variable of node?.variables || []) {
+            const name = variable?.name;
+            if (typeof name !== 'string' || !name)
+                continue;
+            this.stateVars.set(name, variable);
+            if (isSharedCollateralState(variable))
+                this.sharedStateVars.add(name);
+        }
+    }
+    FunctionDefinition(node) {
+        this.fn = null;
+        if (!this.inExecutableContract || !node?.body)
+            return;
+        const mutability = String(node.stateMutability || '').toLowerCase();
+        if (mutability === 'view' || mutability === 'pure')
+            return;
+        this.fn = {
+            name: node.name || (node.isConstructor ? '<constructor>' : '<fallback>'),
+            node,
+            localNames: collectFunctionParameterNames(node),
+            taintedLocals: new Set(),
+            externalReceiverLocals: collectContractTypedParameterNames(node, this.externalTypeNames),
+            writtenSharedState: new Set(),
+            linkedWriteLocals: new Set(),
+            emitted: new Set(),
+        };
+    }
+    FunctionDefinition_post(_node) {
+        this.fn = null;
+    }
+    ['FunctionDefinition:exit'](node) {
+        this.FunctionDefinition_post(node);
+    }
+    VariableDeclarationStatement(node) {
+        if (!this.fn)
+            return;
+        const externalCall = this.asExternalCall(node.initialValue);
+        if (externalCall)
+            this.maybeEmit(externalCall.node, externalCall.callName);
+        const isTainted = this.expressionContainsWrittenStateOrTaintedLocal(node.initialValue);
+        for (const variable of node.variables || []) {
+            const name = variable?.name;
+            if (typeof name !== 'string' || !name)
+                continue;
+            this.fn.localNames.add(name);
+            if (isTainted)
+                this.fn.taintedLocals.add(name);
+            else
+                this.fn.taintedLocals.delete(name);
+            if (isKnownExternalType(variable?.typeName, this.externalTypeNames)) {
+                this.fn.externalReceiverLocals.add(name);
+            }
+            else {
+                this.fn.externalReceiverLocals.delete(name);
+            }
+        }
+    }
+    ExpressionStatement(node) {
+        if (!this.fn)
+            return;
+        const expr = node.expression;
+        if (!(0, ast_1.isNode)(expr, 'BinaryOperation'))
+            return;
+        const externalCall = this.asExternalCall(expr.right);
+        if (externalCall)
+            this.maybeEmit(externalCall.node, externalCall.callName);
+        if (ASSIGNMENT_OPERATORS.has(String(expr.operator || ''))) {
+            this.handleAssignment(expr.left, expr.right, String(expr.operator || ''));
+        }
+    }
+    FunctionCall(node) {
+        if (!this.fn)
+            return;
+        const externalCall = this.asExternalCall(node);
+        if (externalCall)
+            this.maybeEmit(externalCall.node, externalCall.callName);
+    }
+    handleAssignment(left, right, operator) {
+        if (!this.fn)
+            return;
+        const stateName = stateRootName(left);
+        if (stateName && !this.fn.localNames.has(stateName)) {
+            if (this.sharedStateVars.has(stateName)) {
+                this.fn.writtenSharedState.add(stateName);
+                this.markLinkedWriteLocals(left, right, operator, stateName);
+                return;
+            }
+            if (this.hasUnresolvedBase &&
+                !(0, ast_1.isNode)(left, 'Identifier') &&
+                !this.stateVars.has(stateName) &&
+                matchesBalanceLikeName(stateName)) {
+                this.sharedStateVars.add(stateName);
+                this.fn.writtenSharedState.add(stateName);
+                this.markLinkedWriteLocals(left, right, operator, stateName);
+                return;
+            }
+        }
+        const localName = assignedLocalName(left);
+        if (!localName)
+            return;
+        if (this.expressionContainsWrittenStateOrTaintedLocal(right))
+            this.fn.taintedLocals.add(localName);
+        else
+            this.fn.taintedLocals.delete(localName);
+    }
+    markLinkedWriteLocals(left, right, operator, stateName) {
+        if (!this.fn)
+            return;
+        for (const name of collectLocalIdentifiers(indexExpressions(left), this.fn.localNames)) {
+            this.fn.linkedWriteLocals.add(name);
+            this.fn.taintedLocals.add(name);
+        }
+        if (operator === '=' && matchesRegistryLikeName(stateName)) {
+            for (const name of collectLocalIdentifiers(right, this.fn.localNames)) {
+                this.fn.linkedWriteLocals.add(name);
+                this.fn.taintedLocals.add(name);
+            }
+        }
+    }
+    maybeEmit(callNode, callName) {
+        if (!this.fn || this.fn.writtenSharedState.size === 0)
+            return;
+        if (!this.expressionContainsWrittenStateOrTaintedLocal(callNode))
+            return;
+        const loc = (0, ast_1.assertLoc)(callNode, this.fn.node);
+        const key = `${loc.line}:${loc.column}`;
+        if (this.fn.emitted.has(key))
+            return;
+        this.fn.emitted.add(key);
+        this.findings.push({
+            file: this.currentFile,
+            contract: this.currentContract,
+            'function': this.fn.name,
+            line: loc.line,
+            endLine: loc.endLine,
+            column: loc.column,
+            endColumn: loc.endColumn,
+            ruleId: RULE_ID,
+            pattern: PATTERN,
+            severity: 'medium',
+            confidence: 'medium',
+            category: 'front-running',
+            message: `Shared collateral state is written before linked ${callName} interaction in ` +
+                `${this.currentContract}.${this.fn.name}.`,
+            rationale: 'A contract-level mapping, array, or balance-like ledger is updated and the updated value, key, or recorded address flows into a later external call context in the same function.',
+            suggestedFix: 'Avoid feeding freshly written shared collateral state into external call data, target, receiver, or value; use a checked snapshot or reorder the interaction and accounting.',
+            findingId: '',
+            contractHash: '',
+            contractName: this.currentContract,
+            functionName: this.fn.name,
+            sourceLocation: { line: loc.line, column: loc.column },
+        });
+    }
+    expressionContainsWrittenStateOrTaintedLocal(node) {
+        if (!this.fn || !node || typeof node !== 'object')
+            return false;
+        if ((0, ast_1.isNode)(node, 'Identifier')) {
+            const name = node.name;
+            if (this.fn.taintedLocals.has(name))
+                return true;
+            if (this.fn.linkedWriteLocals.has(name))
+                return true;
+            return this.fn.writtenSharedState.has(name) && !this.fn.localNames.has(name);
+        }
+        if ((0, ast_1.isNode)(node, 'IndexAccess')) {
+            const root = stateRootName(node);
+            if (root && this.fn.writtenSharedState.has(root) && !this.fn.localNames.has(root))
+                return true;
+        }
+        if ((0, ast_1.isNode)(node, 'MemberAccess')) {
+            const root = stateRootName(node);
+            if (root && this.fn.writtenSharedState.has(root) && !this.fn.localNames.has(root))
+                return true;
+        }
+        for (const value of Object.values(node)) {
+            if (!value)
+                continue;
+            if (Array.isArray(value)) {
+                if (value.some(item => this.expressionContainsWrittenStateOrTaintedLocal(item)))
+                    return true;
+            }
+            else if (typeof value === 'object') {
+                if (this.expressionContainsWrittenStateOrTaintedLocal(value))
+                    return true;
+            }
+        }
+        return false;
+    }
+    asExternalCall(node) {
+        if (!(0, ast_1.isNode)(node, 'FunctionCall'))
+            return null;
+        const callName = lowLevelMemberName(node.expression);
+        if (callName)
+            return { node, callName };
+        if ((0, ast_1.isNode)(node.expression, 'MemberAccess')) {
+            const receiver = node.expression.expression;
+            if (isExternalReceiver(receiver, this.fn, this.externalTypeNames)) {
+                return { node, callName: String(node.expression.memberName || 'external call') };
+            }
+        }
+        if (isKnownExternalTransferHelper(node.expression)) {
+            return { node, callName: String(node.expression.name || 'external helper') };
+        }
+        return null;
+    }
+}
+exports.FrontRunningSharedCollateralWriteDetector = FrontRunningSharedCollateralWriteDetector;
+function lowLevelMemberName(expr) {
+    if (!expr)
+        return null;
+    if ((0, ast_1.isNode)(expr, 'MemberAccess') && LOW_LEVEL_CALLS.has(expr.memberName))
+        return expr.memberName;
+    if ((0, ast_1.isNode)(expr, 'NameValueExpression'))
+        return lowLevelMemberName(expr.expression);
+    return null;
+}
+function collectFunctionParameterNames(fn) {
+    const names = new Set();
+    const collect = (params) => {
+        for (const param of params?.parameters || params || []) {
+            if (typeof param?.name === 'string' && param.name)
+                names.add(param.name);
+        }
+    };
+    collect(fn.parameters);
+    collect(fn.returnParameters);
+    return names;
+}
+function collectContractTypedParameterNames(fn, externalTypeNames) {
+    const names = new Set();
+    const collect = (params) => {
+        for (const param of params?.parameters || params || []) {
+            if (typeof param?.name === 'string' &&
+                param.name &&
+                isKnownExternalType(param.typeName, externalTypeNames)) {
+                names.add(param.name);
+            }
+        }
+    };
+    collect(fn.parameters);
+    collect(fn.returnParameters);
+    return names;
+}
+function assignedLocalName(node) {
+    if ((0, ast_1.isNode)(node, 'Identifier') && typeof node.name === 'string')
+        return node.name;
+    return null;
+}
+function stateRootName(node) {
+    if (!node || typeof node !== 'object')
+        return null;
+    if ((0, ast_1.isNode)(node, 'Identifier'))
+        return typeof node.name === 'string' ? node.name : null;
+    if ((0, ast_1.isNode)(node, 'IndexAccess'))
+        return stateRootName(node.base);
+    if ((0, ast_1.isNode)(node, 'MemberAccess'))
+        return stateRootName(node.expression);
+    return null;
+}
+function isExternalReceiver(receiver, fn, externalTypeNames) {
+    if (!receiver || typeof receiver !== 'object')
+        return false;
+    if ((0, ast_1.isNode)(receiver, 'Identifier')) {
+        const name = String(receiver.name || '');
+        if (SAFE_RECEIVERS.has(name))
+            return false;
+        return !!fn?.externalReceiverLocals.has(name);
+    }
+    if ((0, ast_1.isNode)(receiver, 'FunctionCall')) {
+        return isKnownExternalType(receiver.expression, externalTypeNames);
+    }
+    if ((0, ast_1.isNode)(receiver, 'MemberAccess')) {
+        const root = stateRootName(receiver);
+        if (root && SAFE_RECEIVERS.has(root))
+            return false;
+        return isExternalReceiver(receiver.expression, fn, externalTypeNames);
+    }
+    return false;
+}
+function isKnownExternalTransferHelper(expr) {
+    if (!(0, ast_1.isNode)(expr, 'Identifier'))
+        return false;
+    const name = String(expr.name || '');
+    return /^_?handleTransferIn$/i.test(name);
+}
+function isKnownExternalType(typeName, externalTypeNames) {
+    const name = typeNameName(typeName);
+    if (!name)
+        return false;
+    const bare = name.split('.').pop() || name;
+    return externalTypeNames.has(bare);
+}
+function typeNameName(typeName) {
+    if (!typeName || typeof typeName !== 'object')
+        return '';
+    if ((0, ast_1.isNode)(typeName, 'UserDefinedTypeName'))
+        return String(typeName.namePath || typeName.name || '');
+    if ((0, ast_1.isNode)(typeName, 'Identifier'))
+        return String(typeName.name || '');
+    if ((0, ast_1.isNode)(typeName, 'ArrayTypeName'))
+        return typeNameName(typeName.baseTypeName);
+    return '';
+}
+function indexExpressions(node) {
+    const indexes = [];
+    let current = node;
+    while ((0, ast_1.isNode)(current, 'IndexAccess')) {
+        if (current.index)
+            indexes.push(current.index);
+        current = current.base;
+    }
+    return indexes;
+}
+function collectLocalIdentifiers(nodeOrNodes, localNames) {
+    const names = new Set();
+    const visit = (node) => {
+        if (!node || typeof node !== 'object')
+            return;
+        if (Array.isArray(node)) {
+            for (const item of node)
+                visit(item);
+            return;
+        }
+        if ((0, ast_1.isNode)(node, 'Identifier')) {
+            const name = String(node.name || '');
+            if (localNames.has(name))
+                names.add(name);
+            return;
+        }
+        for (const value of Object.values(node))
+            visit(value);
+    };
+    visit(nodeOrNodes);
+    return names;
+}
+function isSharedCollateralState(variable) {
+    if (isMappingOrArrayType(variable?.typeName))
+        return true;
+    return matchesBalanceLikeName(variable?.name);
+}
+function matchesBalanceLikeName(name) {
+    const normalized = String(name || '').toLowerCase().replace(/_/g, '');
+    if (!normalized)
+        return false;
+    return BALANCE_LIKE_STATE_NAMES.some(term => normalized.includes(term));
+}
+function matchesRegistryLikeName(name) {
+    const normalized = String(name || '').toLowerCase().replace(/_/g, '');
+    if (!normalized)
+        return false;
+    return REGISTRY_LIKE_STATE_NAMES.some(term => normalized.includes(term));
+}
+function extractBaseContractNames(contractNode) {
+    const names = [];
+    for (const base of contractNode?.baseContracts || []) {
+        const baseName = base?.baseName;
+        const path = baseName?.namePath || baseName?.name;
+        if (typeof path === 'string' && path)
+            names.push(path);
+    }
+    return names;
+}
+function isMappingOrArrayType(typeName) {
+    if (!typeName || typeof typeName !== 'object')
+        return false;
+    if ((0, ast_1.isNode)(typeName, 'Mapping') || (0, ast_1.isNode)(typeName, 'ArrayTypeName'))
+        return true;
+    return Object.values(typeName).some(value => {
+        if (!value)
+            return false;
+        if (Array.isArray(value))
+            return value.some(isMappingOrArrayType);
+        return typeof value === 'object' && isMappingOrArrayType(value);
+    });
+}
+//# sourceMappingURL=front-running-shared-collateral-write.js.map

package/dist/detectors/fusion-v1-settlement-arbitrary-yul-calld.d.ts

@@ -0,0 +1,30 @@
+import type { ScanResult } from '../index';
+export declare class FusionV1SettlementArbitraryYulCalldDetector {
+    readonly id = "fusion-v1-settlement-arbitrary-yul-calld";
+    readonly patternKey = "fusion-v1-settlement-arbitrary-yul-calld";
+    readonly supportedAstKinds: "parser"[];
+    readonly descriptor: {
+        id: string;
+        shortDescription: string;
+        helpUri: string;
+        defaultSeverity: "high";
+        help: string;
+    };
+    private currentFile;
+    private findings;
+    private contractStack;
+    private currentFunction;
+    private yulTainted;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(): void;
+    FunctionDefinition(node: any): void;
+    FunctionDefinition_post(node: any): void;
+    FunctionCall(node: any): void;
+    InlineAssemblyStatement(): void;
+    AssemblyLocalDefinition(node: any): void;
+    AssemblyAssignment(node: any): void;
+    AssemblyCall(node: any): void;
+    private addFinding;
+}