@snovon/solast 0.2.0

package/dist/detectors/any-token-is-destroyed.js

@@ -0,0 +1,527 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AnyTokenIsDestroyedDetector = void 0;
+const ast_1 = require("./_common/ast");
+const access_control_1 = require("./_common/access-control");
+const RULE_ID = 'any-token-is-destroyed';
+const ALLOWANCE_HELPERS = new Set(['_spendallowance', 'spendallowance', '_approve']);
+class AnyTokenIsDestroyedDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    scanAst(ast, file) {
+        if (!ast || ast.type !== 'SourceUnit')
+            return [];
+        const findings = [];
+        for (const contract of ast.children || []) {
+            if (contract?.type !== 'ContractDefinition')
+                continue;
+            const contractName = contract.name || '<anonymous>';
+            for (const fn of contract.subNodes || []) {
+                if (fn?.type !== 'FunctionDefinition')
+                    continue;
+                const functionName = fn.name || '';
+                if (!fn.body)
+                    continue;
+                if (!this.isExternallyCallable(fn))
+                    continue;
+                if (!this.isEligibleBurnFunction(fn, functionName))
+                    continue;
+                if (this.hasAccessControlModifier(fn) || this.hasInlineAccessControlGuard(fn) || this.hasReentrancyGuard(fn))
+                    continue;
+                const fromParam = this.findFromParameter(fn);
+                if (!fromParam)
+                    continue;
+                const aliases = this.collectAliases(fn.body);
+                const burnInfo = this.findBurnOfFromParam(fn.body, fromParam, aliases);
+                if (!burnInfo)
+                    continue;
+                const vuln = this.checkVulnerability(fn.body, fromParam, burnInfo, fn.body);
+                if (!vuln)
+                    continue;
+                findings.push({
+                    file,
+                    contract: contractName,
+                    'function': functionName,
+                    line: vuln.line,
+                    endLine: vuln.endLine,
+                    column: vuln.column,
+                    pattern: RULE_ID,
+                    confidence: 'high',
+                    ruleId: RULE_ID,
+                    severity: 'high',
+                    message: vuln.message,
+                    contractName,
+                    functionName,
+                    sourceLocation: { line: vuln.line, column: vuln.column },
+                    findingId: '',
+                    contractHash: '',
+                });
+            }
+        }
+        return findings;
+    }
+    findFromParameter(fn) {
+        for (const param of fn.parameters || []) {
+            if (param?.name && /from|account|target|user/i.test(param.name)) {
+                return param.name;
+            }
+        }
+        return null;
+    }
+    isEligibleBurnFunction(fn, functionName) {
+        if (functionName === 'burn') {
+            return this.isExactAccountBurn(fn);
+        }
+        return /burnFrom|destroy|liquidate/i.test(functionName);
+    }
+    isExactAccountBurn(fn) {
+        const params = fn.parameters || [];
+        if (params.length !== 2)
+            return false;
+        const [accountParam] = params;
+        if (!accountParam?.name || !/^(account|user)$/i.test(accountParam.name))
+            return false;
+        const typeName = this.getTypeName(accountParam.typeName);
+        return typeName === 'address';
+    }
+    getTypeName(typeNode) {
+        if (!typeNode)
+            return '';
+        if (typeof typeNode.name === 'string')
+            return typeNode.name;
+        if (typeof typeNode.type === 'string' && typeNode.type === 'ElementaryTypeName') {
+            return typeNode.name || '';
+        }
+        if (typeof typeNode.namePath === 'string')
+            return typeNode.namePath;
+        return '';
+    }
+    isExternallyCallable(fn) {
+        return fn.visibility !== 'internal' && fn.visibility !== 'private';
+    }
+    findBurnOfFromParam(body, fromParam, aliases) {
+        let result = null;
+        this.walk(body, node => {
+            if (result)
+                return;
+            if (this.isBalanceDecrementOf(node, fromParam, aliases)) {
+                result = node;
+            }
+        });
+        return result;
+    }
+    isBalanceDecrementOf(node, param, aliases) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'BinaryOperation' && (node.operator === '-=' || node.operator === '=')) {
+            const left = node.left;
+            if (left?.type === 'IndexAccess') {
+                const base = left.base;
+                if (base?.type === 'Identifier' && /balance/i.test(base.name)) {
+                    const index = left.index;
+                    if (index?.type === 'Identifier' && this.identifierResolvesTo(index.name, param, aliases))
+                        return true;
+                }
+            }
+        }
+        if (node.type === 'FunctionCall') {
+            const callee = this.getCalleeName(node.expression);
+            if (callee === '_burn' || callee === 'burn') {
+                const firstArg = node.arguments?.[0];
+                if (firstArg?.type === 'Identifier' && this.identifierResolvesTo(firstArg.name, param, aliases))
+                    return true;
+            }
+        }
+        return false;
+    }
+    identifierResolvesTo(name, target, aliases) {
+        if (name === target)
+            return true;
+        const seen = new Set();
+        let cur = name;
+        while (cur && !seen.has(cur)) {
+            seen.add(cur);
+            const next = aliases.get(cur);
+            if (!next)
+                return false;
+            if (next === target)
+                return true;
+            if (next === '__indexAccess' || next === '__other')
+                return false;
+            cur = next;
+        }
+        return false;
+    }
+    collectAliases(body) {
+        const aliases = new Map();
+        this.walk(body, node => {
+            if (node.type === 'VariableDeclarationStatement') {
+                const initialValue = node.initialValue;
+                for (const variable of node.variables || []) {
+                    if (variable?.name) {
+                        if (initialValue?.type === 'Identifier') {
+                            aliases.set(variable.name, initialValue.name);
+                        }
+                        else if (initialValue?.type === 'IndexAccess') {
+                            aliases.set(variable.name, '__indexAccess');
+                        }
+                        else if (initialValue) {
+                            aliases.set(variable.name, '__other');
+                        }
+                    }
+                }
+            }
+            else if (node.type === 'Assignment' && node.operator === '=') {
+                const left = node.left;
+                if (left?.type === 'Identifier' && node.right) {
+                    if (node.right.type === 'Identifier') {
+                        aliases.set(left.name, node.right.name);
+                    }
+                    else if (node.right.type === 'IndexAccess') {
+                        aliases.set(left.name, '__indexAccess');
+                    }
+                    else {
+                        aliases.set(left.name, '__other');
+                    }
+                }
+            }
+        });
+        return aliases;
+    }
+    checkVulnerability(body, fromParam, burnNode, rootBody) {
+        const analysis = this.analyzeFunctionBody(rootBody, fromParam);
+        if (analysis.reversedAllowanceLookups.length > 0) {
+            const node = analysis.reversedAllowanceLookups[0].node;
+            const { line, endLine, column } = (0, ast_1.assertLoc)(node);
+            return {
+                line, endLine, column,
+                message: 'Reversed allowance indices: allowances[msg.sender][from] instead of allowances[from][msg.sender] allows attacker to self-approve and burn arbitrary holder tokens.',
+            };
+        }
+        const safeHelperCall = analysis.callsSafeAllowanceHelper;
+        if (safeHelperCall)
+            return null;
+        const hasCorrectCheck = analysis.correctAllowanceLookups.length > 0;
+        if (hasCorrectCheck)
+            return null;
+        if (analysis.allowanceLookups.length > 0) {
+            return null;
+        }
+        if (this.hasMsgSenderEqualityGuard(rootBody, fromParam)) {
+            return null;
+        }
+        const { line, endLine, column } = (0, ast_1.assertLoc)(burnNode);
+        return {
+            line, endLine, column,
+            message: 'Unguarded third-party burn: externally callable function burns tokens of a caller-supplied address with no allowance check or access control.',
+        };
+    }
+    hasMsgSenderEqualityGuard(body, fromParam) {
+        let found = false;
+        this.walk(body, node => {
+            if (found)
+                return;
+            if (node.type === 'FunctionCall') {
+                const callee = this.getCalleeName(node.expression);
+                if ((callee === 'require' || callee === 'assert') && node.arguments?.length > 0) {
+                    const arg = node.arguments[0];
+                    if (this.isMsgSenderEqualsParamGuard(arg, fromParam)) {
+                        found = true;
+                    }
+                }
+            }
+        });
+        return found;
+    }
+    isMsgSenderEqualsParamGuard(node, param) {
+        if (!node || node.type !== 'BinaryOperation')
+            return false;
+        const op = node.operator;
+        if (op !== '==' && op !== '===' && op !== '!=' && op !== '!==')
+            return false;
+        const { left, right } = node;
+        const isLeftParam = left?.type === 'Identifier' && left.name === param;
+        const isRightParam = right?.type === 'Identifier' && right.name === param;
+        const isLeftMsgSender = this.isMsgSender(left);
+        const isRightMsgSender = this.isMsgSender(right);
+        return (isLeftParam && isRightMsgSender) || (isRightParam && isLeftMsgSender);
+    }
+    analyzeFunctionBody(body, fromParam) {
+        const allowanceLookups = [];
+        const reversedAllowanceLookups = [];
+        const correctAllowanceLookups = [];
+        let callsSafeAllowanceHelper = false;
+        const varAliases = new Map();
+        const addReversed = (node) => {
+            reversedAllowanceLookups.push({ node });
+            allowanceLookups.push(node);
+        };
+        const addCorrect = (node) => {
+            correctAllowanceLookups.push({ node });
+            allowanceLookups.push(node);
+        };
+        const addLookup = (node) => {
+            allowanceLookups.push(node);
+        };
+        const visitor = (node) => {
+            if (node.type === 'VariableDeclarationStatement') {
+                const initialValue = node.initialValue;
+                for (const variable of node.variables || []) {
+                    if (variable?.name) {
+                        if (initialValue?.type === 'Identifier') {
+                            varAliases.set(variable.name, initialValue.name);
+                        }
+                        else if (initialValue?.type === 'IndexAccess') {
+                            varAliases.set(variable.name, '__indexAccess');
+                        }
+                        else {
+                            varAliases.set(variable.name, '__other');
+                        }
+                    }
+                }
+                if (initialValue?.type === 'IndexAccess') {
+                    this.processAllowanceIndexAccess(initialValue, fromParam, addReversed, addCorrect, addLookup, varAliases);
+                }
+                return;
+            }
+            if (node.type === 'Assignment' && node.operator === '=') {
+                const left = node.left;
+                if (left?.type === 'Identifier' && node.right) {
+                    if (node.right.type === 'Identifier') {
+                        varAliases.set(left.name, node.right.name);
+                    }
+                    else if (node.right.type === 'IndexAccess') {
+                        varAliases.set(left.name, '__indexAccess');
+                    }
+                    else {
+                        varAliases.set(left.name, '__other');
+                    }
+                }
+                if (left?.type === 'IndexAccess') {
+                    this.processAllowanceIndexAccess(left, fromParam, addReversed, addCorrect, addLookup, varAliases);
+                }
+                return;
+            }
+            if (node.type === 'BinaryOperation' && (node.operator === '-=' || node.operator === '=')) {
+                const left = node.left;
+                if (left?.type === 'IndexAccess') {
+                    this.processAllowanceIndexAccess(left, fromParam, addReversed, addCorrect, addLookup, varAliases);
+                }
+                return;
+            }
+            if (node.type === 'FunctionCall') {
+                const callee = this.getCalleeName(node.expression);
+                if ((callee === 'require' || callee === 'assert') && node.arguments?.length > 0) {
+                    this.findAllowanceInRequireExpr(node.arguments[0], fromParam, varAliases, addReversed, addCorrect, addLookup);
+                }
+                if (ALLOWANCE_HELPERS.has(callee.toLowerCase())) {
+                    const args = node.arguments || [];
+                    if (args.length >= 2) {
+                        const firstArg = args[0];
+                        const secondArg = args[1];
+                        const firstIsFrom = this.exprIsParam(firstArg, fromParam, varAliases);
+                        const secondIsMsgSender = this.isMsgSenderOrEquivalent(secondArg);
+                        if (firstIsFrom && secondIsMsgSender) {
+                            callsSafeAllowanceHelper = true;
+                        }
+                    }
+                }
+                return;
+            }
+            if (node.type === 'IndexAccess') {
+                this.processAllowanceIndexAccess(node, fromParam, addReversed, addCorrect, addLookup, varAliases);
+                return;
+            }
+        };
+        this.walk(body, visitor);
+        return { allowanceLookups, reversedAllowanceLookups, correctAllowanceLookups, callsSafeAllowanceHelper };
+    }
+    exprIsParam(expr, param, aliases) {
+        if (!expr)
+            return false;
+        if (expr.type === 'Identifier') {
+            if (expr.name === param)
+                return true;
+            const alias = aliases.get(expr.name);
+            return alias === param;
+        }
+        return false;
+    }
+    processAllowanceIndexAccess(node, fromParam, onReversed, onCorrect, onLookup, aliases) {
+        if (!node || node.type !== 'IndexAccess')
+            return;
+        const base = node.base;
+        if (base?.type === 'Identifier' && /allowances?/i.test(base.name)) {
+            onLookup(node);
+            if (node.index?.type === 'MemberAccess' && this.isMsgSender(node.index)) {
+                onCorrect(node);
+            }
+            return;
+        }
+        if (base?.type === 'IndexAccess') {
+            const outerIndex = base.index;
+            const innerBase = base.base;
+            if (outerIndex?.type === 'MemberAccess' && this.isMsgSender(outerIndex) && innerBase?.type === 'Identifier' && /allowances?/i.test(innerBase.name)) {
+                const innerIndex = node.index;
+                const effectiveOwner = this.resolveParam(innerIndex, aliases);
+                if (effectiveOwner != null && effectiveOwner === fromParam) {
+                    onReversed(node);
+                    return;
+                }
+            }
+            if (innerBase?.type === 'Identifier' && /allowances?/i.test(innerBase.name)) {
+                if (outerIndex?.type === 'Identifier') {
+                    const effectiveOuter = this.resolveParam(outerIndex, aliases);
+                    if (effectiveOuter != null && effectiveOuter === fromParam) {
+                        if (node.index?.type === 'MemberAccess' && this.isMsgSender(node.index)) {
+                            onCorrect(node);
+                            return;
+                        }
+                    }
+                }
+                this.processAllowanceIndexAccess(base, fromParam, onReversed, onCorrect, onLookup, aliases);
+                return;
+            }
+            this.processAllowanceIndexAccess(base, fromParam, onReversed, onCorrect, onLookup, aliases);
+            return;
+        }
+    }
+    resolveParam(expr, aliases) {
+        if (!expr)
+            return null;
+        if (expr.type === 'Identifier') {
+            const alias = aliases.get(expr.name);
+            return alias || expr.name;
+        }
+        return null;
+    }
+    findAllowanceInRequireExpr(expr, fromParam, aliases, onReversed, onCorrect, onLookup) {
+        if (!expr || typeof expr !== 'object')
+            return;
+        if (expr.type === 'Identifier') {
+            const alias = aliases.get(expr.name);
+            if (alias === '__indexAccess') {
+                return;
+            }
+            return;
+        }
+        if (expr.type === 'IndexAccess') {
+            this.processAllowanceIndexAccess(expr, fromParam, onReversed, onCorrect, onLookup, aliases);
+            return;
+        }
+        if (expr.type === 'BinaryOperation') {
+            this.findAllowanceInRequireExpr(expr.left, fromParam, aliases, onReversed, onCorrect, onLookup);
+            this.findAllowanceInRequireExpr(expr.right, fromParam, aliases, onReversed, onCorrect, onLookup);
+            return;
+        }
+        if (expr.type === 'FunctionCall') {
+            for (const arg of expr.arguments || []) {
+                this.findAllowanceInRequireExpr(arg, fromParam, aliases, onReversed, onCorrect, onLookup);
+            }
+            return;
+        }
+    }
+    hasAccessControlModifier(fn) {
+        if ((0, access_control_1.hasRecognisedAccessControlModifier)(fn))
+            return true;
+        for (const modifier of fn.modifiers || []) {
+            const name = this.getModifierName(modifier).toLowerCase();
+            if (name === 'onlyowner' || name === 'onlyrole' || name.includes('admin'))
+                return true;
+        }
+        return false;
+    }
+    hasInlineAccessControlGuard(fn) {
+        let found = false;
+        this.walk(fn.body, node => {
+            if (found || node.type !== 'FunctionCall')
+                return;
+            const callee = this.getCalleeName(node.expression);
+            if ((callee !== 'require' && callee !== 'assert') || !node.arguments?.length)
+                return;
+            if ((0, access_control_1.requireExpressesAccessControl)(node.arguments[0], this.isPrivilegedBurnAuthorityName)) {
+                found = true;
+            }
+        });
+        return found;
+    }
+    isPrivilegedBurnAuthorityName(name) {
+        return (0, access_control_1.isPrivilegedIdentifier)(name, {
+            keywords: ['owner', 'admin', 'role', 'guardian', 'governor', 'operator', 'authority', 'authorized', 'controller'],
+        });
+    }
+    hasReentrancyGuard(fn) {
+        for (const modifier of fn.modifiers || []) {
+            const name = this.getModifierName(modifier).toLowerCase();
+            if (name === 'nonreentrant' || name.includes('reentrancyguard'))
+                return true;
+        }
+        return false;
+    }
+    getModifierName(modifier) {
+        if (!modifier)
+            return '';
+        if (typeof modifier === 'string')
+            return modifier;
+        if (typeof modifier.name === 'string')
+            return modifier.name;
+        if (modifier.name && typeof modifier.name === 'object') {
+            if (typeof modifier.name.name === 'string')
+                return modifier.name.name;
+            if (typeof modifier.name.namePath === 'string')
+                return modifier.name.namePath;
+        }
+        return '';
+    }
+    isMsgSender(node) {
+        return node?.type === 'MemberAccess' &&
+            node.memberName === 'sender' &&
+            node.expression?.type === 'Identifier' &&
+            node.expression.name === 'msg';
+    }
+    isMsgSenderOrEquivalent(node) {
+        if (this.isMsgSender(node))
+            return true;
+        if (node?.type === 'FunctionCall') {
+            const callee = this.getCalleeName(node.expression);
+            if (callee === '_msgSender')
+                return true;
+        }
+        return false;
+    }
+    getCalleeName(expr) {
+        if (!expr)
+            return '';
+        if (expr.type === 'Identifier')
+            return expr.name || '';
+        if (expr.type === 'MemberAccess')
+            return expr.memberName || '';
+        if (expr.type === 'NameValueExpression')
+            return this.getCalleeName(expr.expression);
+        return '';
+    }
+    walk(node, visitor) {
+        if (!node || typeof node !== 'object')
+            return;
+        visitor(node);
+        for (const child of this.childNodes(node))
+            this.walk(child, visitor);
+    }
+    childNodes(node) {
+        const children = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (typeof value === 'object' && value !== null) {
+                if (Array.isArray(value)) {
+                    children.push(...value.filter((item) => item && typeof item === 'object'));
+                }
+                else {
+                    children.push(value);
+                }
+            }
+        }
+        return children;
+    }
+}
+exports.AnyTokenIsDestroyedDetector = AnyTokenIsDestroyedDetector;
+//# sourceMappingURL=any-token-is-destroyed.js.map

package/dist/detectors/anyswap-anytoken-permit-allowance-drain.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class AnyswapAnytokenPermitAllowanceDrainDetector {
+    readonly id = "anyswap-anytoken-permit-allowance-drain";
+    readonly patternKey = "anyswap-anytoken-permit-allowance-drain";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+}