@snovon/solast 0.2.0

package/dist/detectors/insufficient-dvn-threshold.js

@@ -0,0 +1,585 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsufficientDvnThresholdDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'insufficient-dvn-threshold';
+const CLASS_ID = 'LAYERZERO-DVN-THRESHOLD';
+const CONFIG_STRUCT_NAMES = new Set(['UlnConfig', 'ULNConfig']);
+const SET_CONFIG_PARAM_STRUCT_NAMES = new Set(['SetConfigParam']);
+const SETUP_METHODS = new Set(['setConfig', 'setSendLibrary', 'setReceiveLibrary']);
+const ULN_CONFIRMATIONS_IDX = 0;
+const ULN_REQUIRED_DVN_COUNT_IDX = 1;
+const ULN_OPTIONAL_DVN_COUNT_IDX = 2;
+const ULN_OPTIONAL_DVN_THRESHOLD_IDX = 3;
+const ULN_REQUIRED_DVNS_IDX = 4;
+const ULN_OPTIONAL_DVNS_IDX = 5;
+const REAL_ULN_CONFIG_POSITIONAL_ARITY = ULN_OPTIONAL_DVNS_IDX - ULN_CONFIRMATIONS_IDX + 1;
+const SHORT_ULN_REQUIRED_DVN_COUNT_IDX = 0;
+const SHORT_ULN_OPTIONAL_DVN_COUNT_IDX = 1;
+const SHORT_ULN_OPTIONAL_DVN_THRESHOLD_IDX = 2;
+const SHORT_ULN_REQUIRED_DVNS_IDX = 3;
+const SHORT_ULN_OPTIONAL_DVNS_IDX = 4;
+const SHORT_ULN_POSITIONAL_ARITY = 5;
+class InsufficientDvnThresholdDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'LayerZero DVN configuration permits 1-of-1 verifier authorization.',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'high',
+        help: 'Configure LayerZero ULN/OApp/OFT paths with at least two required DVNs, or combine a required DVN with an enforceable optional DVN threshold so message authorization cannot depend on one verifier.',
+    };
+    currentFile = '';
+    currentContract = '';
+    findings = [];
+    stateConstants = new Map();
+    ulnStructFields = new Map();
+    fn = null;
+    setFile(file) {
+        this.currentFile = file;
+        this.currentContract = '';
+        this.findings = [];
+        this.stateConstants.clear();
+        this.ulnStructFields.clear();
+        this.fn = null;
+    }
+    getFindings() {
+        return this.findings;
+    }
+    ContractDefinition(node) {
+        if (node?.kind === 'interface' || node?.kind === 'library') {
+            this.currentContract = '';
+            return;
+        }
+        this.currentContract = node?.name || '<anonymous>';
+    }
+    ContractDefinition_post(_node) {
+        this.currentContract = '';
+        this.fn = null;
+    }
+    ['ContractDefinition:exit'](node) {
+        this.ContractDefinition_post(node);
+    }
+    StateVariableDeclaration(node) {
+        if (!node?.variables)
+            return;
+        for (const variable of node.variables) {
+            const name = getName(variable);
+            const value = resolveNumber(variable?.expression ?? variable?.initialValue, this.stateConstants);
+            if (name && value !== undefined && isConstantVariable(variable)) {
+                this.stateConstants.set(name, value);
+            }
+        }
+    }
+    StructDefinition(node) {
+        const name = getName(node);
+        if (!CONFIG_STRUCT_NAMES.has(name))
+            return;
+        const fields = (node.members || [])
+            .map((member) => getName(member))
+            .filter((field) => field.length > 0);
+        if (fields.length > 0) {
+            this.ulnStructFields.set(name, fields);
+        }
+    }
+    FunctionDefinition(node) {
+        this.fn = null;
+        if (!this.currentContract || !node?.body)
+            return;
+        this.fn = {
+            name: node.name || (node.isConstructor ? '<constructor>' : '<fallback>'),
+            node,
+            constants: new Map(this.stateConstants),
+            arrays: new Map(),
+            configs: new Map(),
+            ulnStructFields: this.ulnStructFields,
+            setConfigParams: new Map(),
+            setConfigParamArrays: new Map(),
+            sawLayerZeroLibrarySetup: false,
+            reported: new Set(),
+        };
+    }
+    FunctionDefinition_post(_node) {
+        this.fn = null;
+    }
+    ['FunctionDefinition:exit'](node) {
+        this.FunctionDefinition_post(node);
+    }
+    VariableDeclarationStatement(node) {
+        if (!this.fn)
+            return;
+        const initial = node?.initialValue;
+        for (const variable of node.variables || []) {
+            const name = getName(variable);
+            if (!name)
+                continue;
+            const numeric = resolveNumber(initial, this.fn.constants);
+            if (numeric !== undefined && isConstantVariable(variable)) {
+                this.fn.constants.set(name, numeric);
+            }
+            const arrayLength = arrayLengthFromExpression(initial, this.fn.constants);
+            if (arrayLength !== undefined) {
+                this.fn.arrays.set(name, arrayLength);
+            }
+            const config = configFromExpression(initial, this.fn);
+            if (config) {
+                this.fn.configs.set(name, config);
+            }
+            const setConfigParam = configFromSetConfigParam(initial, this.fn);
+            if (setConfigParam) {
+                this.fn.setConfigParams.set(name, setConfigParam);
+            }
+            const setConfigParamArray = setConfigParamArrayFromExpression(initial, this.fn);
+            if (setConfigParamArray || isSetConfigParamArrayVariable(variable)) {
+                this.fn.setConfigParamArrays.set(name, setConfigParamArray ?? makeSetConfigParamArrayInfo());
+            }
+        }
+    }
+    ExpressionStatement(node) {
+        if (!this.fn)
+            return;
+        const expr = node?.expression;
+        if (!(0, ast_1.isNode)(expr, 'BinaryOperation') || expr.operator !== '=')
+            return;
+        const left = expr.left;
+        const right = expr.right;
+        if ((0, ast_1.isNode)(left, 'Identifier')) {
+            const name = getName(left);
+            const numeric = resolveNumber(right, this.fn.constants);
+            if (name && numeric !== undefined)
+                this.fn.constants.set(name, numeric);
+            const arrayLength = arrayLengthFromExpression(right, this.fn.constants);
+            if (name && arrayLength !== undefined)
+                this.fn.arrays.set(name, arrayLength);
+            const config = configFromExpression(right, this.fn);
+            if (name && config)
+                this.fn.configs.set(name, config);
+            const setConfigParam = configFromSetConfigParam(right, this.fn);
+            if (name && setConfigParam)
+                this.fn.setConfigParams.set(name, setConfigParam);
+            const setConfigParamArray = setConfigParamArrayFromExpression(right, this.fn);
+            if (name && setConfigParamArray)
+                this.fn.setConfigParamArrays.set(name, setConfigParamArray);
+            return;
+        }
+        if ((0, ast_1.isNode)(left, 'IndexAccess') && (0, ast_1.isNode)(left.base, 'Identifier')) {
+            const arrayName = getName(left.base);
+            const setConfigParam = configFromSetConfigParam(right, this.fn);
+            if (!arrayName || !setConfigParam)
+                return;
+            let arrayInfo = this.fn.setConfigParamArrays.get(arrayName);
+            if (!arrayInfo) {
+                arrayInfo = makeSetConfigParamArrayInfo();
+                this.fn.setConfigParamArrays.set(arrayName, arrayInfo);
+            }
+            addSetConfigParamArrayEntry(arrayInfo, setConfigParam, indexKey(left.index, this.fn));
+            return;
+        }
+        if (!(0, ast_1.isNode)(left, 'MemberAccess') || !(0, ast_1.isNode)(left.expression, 'Identifier'))
+            return;
+        const configName = getName(left.expression);
+        const field = getMemberName(left);
+        if (!configName || !field)
+            return;
+        let config = this.fn.configs.get(configName);
+        if (!config) {
+            config = { locNode: node };
+            this.fn.configs.set(configName, config);
+        }
+        applyConfigField(config, field, right, this.fn);
+    }
+    FunctionCall(node) {
+        if (!this.fn)
+            return;
+        const member = memberCallName(node);
+        if (!member || !SETUP_METHODS.has(member))
+            return;
+        if ((member === 'setSendLibrary' || member === 'setReceiveLibrary') && isLayerZeroEndpointCall(node)) {
+            this.fn.sawLayerZeroLibrarySetup = true;
+            return;
+        }
+        if (member !== 'setConfig')
+            return;
+        if (!isLayerZeroEndpointCall(node) && !this.fn.sawLayerZeroLibrarySetup)
+            return;
+        for (const candidate of configCandidatesFromSetConfig(node, this.fn)) {
+            if (!isUnsafeConfig(candidate.config))
+                continue;
+            if (this.fn.reported.has(candidate.key))
+                continue;
+            this.fn.reported.add(candidate.key);
+            this.findings.push(makeFinding(this.currentFile, this.currentContract, this.fn.name, node, candidate.config.locNode || this.fn.node));
+        }
+    }
+}
+exports.InsufficientDvnThresholdDetector = InsufficientDvnThresholdDetector;
+function makeFinding(file, contractName, functionName, node, fallbackNode) {
+    const loc = (0, ast_1.assertLoc)(node, fallbackNode);
+    return {
+        file,
+        contract: contractName,
+        'function': functionName,
+        line: loc.line,
+        endLine: loc.endLine,
+        column: loc.column,
+        endColumn: loc.endColumn,
+        pattern: RULE_ID,
+        confidence: 'medium',
+        category: CLASS_ID,
+        ruleId: RULE_ID,
+        severity: 'high',
+        message: `LayerZero DVN config in '${functionName}' resolves to single-verifier authorization. ` +
+            `Use a multi-DVN required threshold or an enforceable optional DVN threshold before calling setConfig.`,
+        contractName,
+        functionName,
+        sourceLocation: { line: loc.line, column: loc.column },
+        suggestedFix: 'Set requiredDVNCount >= 2, or configure optionalDVNCount > 0 with optionalDVNThreshold > 0.',
+        findingId: '',
+        contractHash: '',
+    };
+}
+function configFromExpression(expr, fn) {
+    if (!(0, ast_1.isNode)(expr, 'FunctionCall'))
+        return null;
+    const callee = expr.expression;
+    const structName = (0, ast_1.isNode)(callee, 'Identifier') ? getName(callee) : '';
+    if (!CONFIG_STRUCT_NAMES.has(structName))
+        return null;
+    const config = { locNode: expr };
+    const args = expr.arguments || [];
+    const names = expr.names || expr.argumentNames || [];
+    if (Array.isArray(names) && names.length > 0) {
+        for (let i = 0; i < args.length; i++) {
+            const name = typeof names[i] === 'string' ? names[i] : getName(names[i]);
+            if (name)
+                applyConfigField(config, name, args[i], fn);
+        }
+        return config;
+    }
+    const declaredFields = fn.ulnStructFields.get(structName);
+    if (declaredFields && declaredFields.length >= args.length) {
+        for (let i = 0; i < args.length; i++) {
+            applyConfigField(config, declaredFields[i], args[i], fn);
+        }
+        return config;
+    }
+    if (args.length >= REAL_ULN_CONFIG_POSITIONAL_ARITY) {
+        applyConfigField(config, 'requiredDVNCount', args[ULN_REQUIRED_DVN_COUNT_IDX], fn);
+        applyConfigField(config, 'optionalDVNCount', args[ULN_OPTIONAL_DVN_COUNT_IDX], fn);
+        applyConfigField(config, 'optionalDVNThreshold', args[ULN_OPTIONAL_DVN_THRESHOLD_IDX], fn);
+        applyConfigField(config, 'requiredDVNs', args[ULN_REQUIRED_DVNS_IDX], fn);
+        applyConfigField(config, 'optionalDVNs', args[ULN_OPTIONAL_DVNS_IDX], fn);
+        return config;
+    }
+    if (args.length === SHORT_ULN_POSITIONAL_ARITY) {
+        applyConfigField(config, 'requiredDVNCount', args[SHORT_ULN_REQUIRED_DVN_COUNT_IDX], fn);
+        applyConfigField(config, 'optionalDVNCount', args[SHORT_ULN_OPTIONAL_DVN_COUNT_IDX], fn);
+        applyConfigField(config, 'optionalDVNThreshold', args[SHORT_ULN_OPTIONAL_DVN_THRESHOLD_IDX], fn);
+        applyConfigField(config, 'requiredDVNs', args[SHORT_ULN_REQUIRED_DVNS_IDX], fn);
+        applyConfigField(config, 'optionalDVNs', args[SHORT_ULN_OPTIONAL_DVNS_IDX], fn);
+    }
+    return config;
+}
+function applyConfigField(config, field, expr, fn) {
+    if (field === 'requiredDVNCount') {
+        config.requiredDVNCount = resolveNumber(expr, fn.constants);
+        return;
+    }
+    if (field === 'optionalDVNCount') {
+        config.optionalDVNCount = resolveNumber(expr, fn.constants);
+        return;
+    }
+    if (field === 'optionalDVNThreshold') {
+        config.optionalDVNThreshold = resolveNumber(expr, fn.constants);
+        return;
+    }
+    if (field === 'requiredDVNs') {
+        config.requiredDVNsLength = arrayLengthFromExpression(expr, fn.constants) ?? arrayLengthFromReference(expr, fn.arrays);
+        return;
+    }
+    if (field === 'optionalDVNs') {
+        config.optionalDVNsLength = arrayLengthFromExpression(expr, fn.constants) ?? arrayLengthFromReference(expr, fn.arrays);
+    }
+}
+function isUnsafeConfig(config) {
+    if (hasMultipleRequiredDVNs(config))
+        return false;
+    if (hasEnforceableOptionalThreshold(config))
+        return false;
+    if (config.requiredDVNCount === 1)
+        return true;
+    if (config.requiredDVNsLength === 1)
+        return true;
+    return authorizesSingleOptionalVerifier(config);
+}
+function hasMultipleRequiredDVNs(config) {
+    if (config.requiredDVNCount !== undefined && config.requiredDVNCount >= 2)
+        return true;
+    if (config.requiredDVNsLength !== undefined && config.requiredDVNsLength >= 2)
+        return true;
+    return false;
+}
+// An optional DVN threshold only compensates for a thin required path when the
+// statically inferred effective verifier requirement (required DVNs + optional
+// threshold) reaches two AND the threshold is backed by enough optional DVNs.
+// A `requiredDVNCount: 0, optionalDVNThreshold: 1` config is NOT enforceable:
+// it still authorizes messages with one verifier.
+function hasEnforceableOptionalThreshold(config) {
+    const threshold = config.optionalDVNThreshold;
+    if (threshold === undefined || threshold <= 0)
+        return false;
+    const optionalCardinality = optionalDVNCardinality(config);
+    if (optionalCardinality === undefined || optionalCardinality < threshold)
+        return false;
+    const required = config.requiredDVNCount ?? config.requiredDVNsLength ?? 0;
+    return required + threshold >= 2;
+}
+// The optional-only 1-of-1 anti-pattern: no required DVNs and an optional
+// threshold of one, so any single optional verifier authorizes a message.
+// Stays conservative — only fires when the required path is statically known
+// to contribute nothing and the optional path has at least one verifier.
+function authorizesSingleOptionalVerifier(config) {
+    if (config.optionalDVNThreshold !== 1)
+        return false;
+    if (!requiredPathIsStaticallyEmpty(config))
+        return false;
+    const optionalCardinality = optionalDVNCardinality(config);
+    return optionalCardinality !== undefined && optionalCardinality >= 1;
+}
+function requiredPathIsStaticallyEmpty(config) {
+    const knownZero = config.requiredDVNCount === 0 || config.requiredDVNsLength === 0;
+    const knownPositive = (config.requiredDVNCount !== undefined && config.requiredDVNCount >= 1) ||
+        (config.requiredDVNsLength !== undefined && config.requiredDVNsLength >= 1);
+    return knownZero && !knownPositive;
+}
+function optionalDVNCardinality(config) {
+    const fromCount = config.optionalDVNCount;
+    const fromArray = config.optionalDVNsLength;
+    if (fromCount === undefined && fromArray === undefined)
+        return undefined;
+    return Math.max(fromCount ?? 0, fromArray ?? 0);
+}
+function configCandidatesFromSetConfig(call, fn) {
+    const candidates = [];
+    for (const arg of call.arguments || []) {
+        candidates.push(...configCandidatesFromAbiEncode(arg, fn, inlineConfigReportKey(arg)));
+        candidates.push(...configCandidatesFromSetConfigParamArray(arg, fn));
+    }
+    return candidates;
+}
+function configCandidatesFromAbiEncode(expr, fn, fallbackKey) {
+    if (!isAbiEncodeCall(expr))
+        return [];
+    const candidates = [];
+    for (const encodedArg of expr.arguments || []) {
+        if ((0, ast_1.isNode)(encodedArg, 'Identifier')) {
+            const configName = getName(encodedArg);
+            const config = fn.configs.get(configName);
+            if (config)
+                candidates.push({ key: configName, config });
+            continue;
+        }
+        const config = configFromExpression(encodedArg, fn);
+        if (config)
+            candidates.push({ key: fallbackKey, config });
+    }
+    return candidates;
+}
+function inlineConfigReportKey(call) {
+    const loc = call?.loc?.start;
+    return `inline:${loc?.line ?? 'unknown'}:${loc?.column ?? 'unknown'}`;
+}
+function configFromSetConfigParam(expr, fn) {
+    if ((0, ast_1.isNode)(expr, 'Identifier')) {
+        return fn.setConfigParams.get(getName(expr)) ?? null;
+    }
+    if (!(0, ast_1.isNode)(expr, 'FunctionCall'))
+        return null;
+    const callee = expr.expression;
+    const structName = (0, ast_1.isNode)(callee, 'Identifier') ? getName(callee) : '';
+    if (!SET_CONFIG_PARAM_STRUCT_NAMES.has(structName))
+        return null;
+    const args = expr.arguments || [];
+    const names = expr.names || expr.argumentNames || [];
+    if (Array.isArray(names) && names.length > 0) {
+        for (let i = 0; i < args.length; i++) {
+            const name = typeof names[i] === 'string' ? names[i] : getName(names[i]);
+            if (name !== 'config')
+                continue;
+            return firstConfigFromAbiEncode(args[i], fn);
+        }
+        return null;
+    }
+    return firstConfigFromAbiEncode(args[2], fn);
+}
+function firstConfigFromAbiEncode(expr, fn) {
+    return configCandidatesFromAbiEncode(expr, fn, inlineConfigReportKey(expr))[0]?.config ?? null;
+}
+function configCandidatesFromSetConfigParamArray(expr, fn) {
+    if ((0, ast_1.isNode)(expr, 'Identifier')) {
+        const arrayName = getName(expr);
+        const arrayInfo = fn.setConfigParamArrays.get(arrayName);
+        if (!arrayInfo)
+            return [];
+        return configsFromSetConfigParamArrayInfo(arrayInfo).map((config, index) => ({
+            key: `${arrayName}:${index}`,
+            config,
+        }));
+    }
+    const arrayInfo = setConfigParamArrayFromExpression(expr, fn);
+    if (!arrayInfo)
+        return [];
+    return configsFromSetConfigParamArrayInfo(arrayInfo).map((config, index) => ({
+        key: `${inlineConfigReportKey(expr)}:${index}`,
+        config,
+    }));
+}
+function setConfigParamArrayFromExpression(expr, fn) {
+    if ((0, ast_1.isNode)(expr, 'Identifier')) {
+        const arrayInfo = fn.setConfigParamArrays.get(getName(expr));
+        return arrayInfo ? cloneSetConfigParamArrayInfo(arrayInfo) : null;
+    }
+    if ((0, ast_1.isNode)(expr, 'TupleExpression') && expr.isArray === true) {
+        const arrayInfo = makeSetConfigParamArrayInfo();
+        for (const [index, component] of (expr.components || []).entries()) {
+            const config = configFromSetConfigParam(component, fn);
+            if (config)
+                addSetConfigParamArrayEntry(arrayInfo, config, String(index));
+        }
+        return arrayInfo;
+    }
+    if (isSetConfigParamArrayNewExpression(expr)) {
+        return makeSetConfigParamArrayInfo();
+    }
+    return null;
+}
+function makeSetConfigParamArrayInfo() {
+    return { entries: new Map(), nextSyntheticIndex: 0 };
+}
+function cloneSetConfigParamArrayInfo(info) {
+    return {
+        entries: new Map(info.entries),
+        nextSyntheticIndex: info.nextSyntheticIndex,
+    };
+}
+function addSetConfigParamArrayEntry(info, config, key) {
+    const entryKey = key ?? `synthetic:${info.nextSyntheticIndex++}`;
+    info.entries.set(entryKey, config);
+}
+function configsFromSetConfigParamArrayInfo(info) {
+    return Array.from(info.entries.values());
+}
+function indexKey(index, fn) {
+    const numeric = resolveNumber(index, fn.constants);
+    if (numeric !== undefined)
+        return String(numeric);
+    if ((0, ast_1.isNode)(index, 'Identifier'))
+        return getName(index);
+    return undefined;
+}
+function isAbiEncodeCall(expr) {
+    if (!(0, ast_1.isNode)(expr, 'FunctionCall'))
+        return false;
+    const name = callExpressionName(expr.expression).toLowerCase();
+    return name === 'abi.encode' || name === 'abi.encodepacked';
+}
+function isSetConfigParamArrayVariable(variable) {
+    return isSetConfigParamArrayType(variable?.typeName);
+}
+function isSetConfigParamArrayNewExpression(expr) {
+    if (!(0, ast_1.isNode)(expr, 'FunctionCall') || !(0, ast_1.isNode)(expr.expression, 'NewExpression'))
+        return false;
+    return isSetConfigParamArrayType(expr.expression.typeName);
+}
+function isSetConfigParamArrayType(typeName) {
+    if (!(0, ast_1.isNode)(typeName, 'ArrayTypeName'))
+        return false;
+    return SET_CONFIG_PARAM_STRUCT_NAMES.has(typeNameName(typeName.baseTypeName));
+}
+function typeNameName(typeName) {
+    if (!typeName)
+        return '';
+    if (typeof typeName.namePath === 'string')
+        return typeName.namePath;
+    if (typeof typeName.name === 'string')
+        return typeName.name;
+    return '';
+}
+function isLayerZeroEndpointCall(call) {
+    const expr = call?.expression;
+    if (!(0, ast_1.isNode)(expr, 'MemberAccess'))
+        return false;
+    const base = expr.expression;
+    if ((0, ast_1.isNode)(base, 'Identifier')) {
+        return /endpoint|layerzero|lz/i.test(getName(base));
+    }
+    if ((0, ast_1.isNode)(base, 'FunctionCall')) {
+        const callee = callExpressionName(base.expression);
+        return /endpoint|layerzero|lz/i.test(callee);
+    }
+    return false;
+}
+function memberCallName(call) {
+    const expr = call?.expression;
+    return (0, ast_1.isNode)(expr, 'MemberAccess') ? getMemberName(expr) : '';
+}
+function callExpressionName(expr) {
+    if ((0, ast_1.isNode)(expr, 'Identifier'))
+        return getName(expr);
+    if ((0, ast_1.isNode)(expr, 'MemberAccess')) {
+        const base = callExpressionName(expr.expression);
+        const member = getMemberName(expr);
+        return base ? `${base}.${member}` : member;
+    }
+    return '';
+}
+function resolveNumber(expr, constants) {
+    if (!expr)
+        return undefined;
+    if ((0, ast_1.isNode)(expr, 'NumberLiteral'))
+        return parseNumeric(expr.number ?? expr.value);
+    if ((0, ast_1.isNode)(expr, 'Literal'))
+        return parseNumeric(expr.value);
+    if ((0, ast_1.isNode)(expr, 'Identifier'))
+        return constants.get(getName(expr));
+    return undefined;
+}
+function parseNumeric(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.replace(/_/g, '');
+    if (/^0x[0-9a-f]+$/i.test(normalized))
+        return Number.parseInt(normalized, 16);
+    if (/^[0-9]+$/.test(normalized))
+        return Number.parseInt(normalized, 10);
+    return undefined;
+}
+function arrayLengthFromExpression(expr, constants) {
+    if ((0, ast_1.isNode)(expr, 'FunctionCall') && (0, ast_1.isNode)(expr.expression, 'NewExpression')) {
+        return resolveNumber((expr.arguments || [])[0], constants);
+    }
+    if (!(0, ast_1.isNode)(expr, 'NewExpression'))
+        return undefined;
+    const typeName = expr.typeName;
+    const lengthExpr = typeName?.length || typeName?.baseTypeName?.length;
+    return resolveNumber(lengthExpr, constants);
+}
+function arrayLengthFromReference(expr, arrays) {
+    if ((0, ast_1.isNode)(expr, 'Identifier'))
+        return arrays.get(getName(expr));
+    return undefined;
+}
+function getName(node) {
+    return typeof node?.name === 'string' ? node.name : '';
+}
+function getMemberName(node) {
+    return typeof node?.memberName === 'string' ? node.memberName : '';
+}
+function isConstantVariable(variable) {
+    return variable?.isDeclaredConst === true || variable?.isImmutable === true || variable?.isStateVar === true || variable?.isStateVariable === true;
+}
+//# sourceMappingURL=insufficient-dvn-threshold.js.map

package/dist/detectors/integer-overflow-detector.d.ts

@@ -0,0 +1,45 @@
+import type { Detector } from './types';
+import { ScanResult } from '../index';
+export declare class IntegerOverflowDetector implements Detector {
+    readonly id = "integer-overflow-underflow";
+    readonly patternKey = "integer-overflow-underflow";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    findings: ScanResult[];
+    currentFile: string;
+    private currentContract;
+    private currentFunction;
+    private uncheckedDepth;
+    private inConditionalDepth;
+    private currentRequireSigStack;
+    private requireGuards;
+    private localSignedness;
+    private stateSignedness;
+    private currentLibraryIsSafeMath;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(_node: any): void;
+    StateVariableDeclaration(node: any): void;
+    FunctionDefinition(node: any): void;
+    FunctionDefinition_post(_node: any): void;
+    ModifierDefinition(node: any): void;
+    ModifierDefinition_post(_node: any): void;
+    VariableDeclarationStatement(node: any): void;
+    private recordVariableSignedness;
+    private isUnsignedOperand;
+    UncheckedStatement(_node: any): void;
+    UncheckedStatement_post(_node: any): void;
+    IfStatement(_node: any): void;
+    IfStatement_post(_node: any): void;
+    ForStatement(_node: any): void;
+    ForStatement_post(_node: any): void;
+    WhileStatement(_node: any): void;
+    WhileStatement_post(_node: any): void;
+    DoWhileStatement(_node: any): void;
+    DoWhileStatement_post(_node: any): void;
+    FunctionCall(node: any): void;
+    FunctionCall_post(node: any): void;
+    BinaryOperation(node: any): void;
+    UnaryOperation(node: any): void;
+    private emitFinding;
+}