@snovon/solast 0.2.0

package/dist/detectors/l1-to-l2-message-reentrancy.js

@@ -0,0 +1,545 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.L1ToL2MessageReentrancyDetector = void 0;
+const RULE_ID = 'l1-to-l2-message-reentrancy';
+const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=']);
+const LOW_LEVEL_OR_VALUE_METHODS = new Set(['call', 'delegatecall', 'staticcall', 'send', 'transfer']);
+const TOKEN_OR_HOOK_METHODS = new Set(['transfer', 'transferfrom', 'safetransfer', 'safetransferfrom', 'approve', 'onmessage']);
+const GUARD_READ_METHODS = new Set([
+    'xdomainmessagesender', 'crossdomainsender', 'messagesender', 'l1messagesender', 'l2messagesender',
+    'sender', 'origin', 'source', 'sourceaddress', 'remotesender', 'remotemessengersender',
+]);
+const GUARD_READ_BASE = /(?:messenger|bridge|gateway|relay|relayer|inbox|portal)/i;
+const GUARD_READ_MEMBER = /(?:sender|origin|source|message|remote|crossdomain|xdomain)/i;
+const BUILTINS = new Set([
+    'msg', 'block', 'tx', 'abi', 'super', 'this', 'address', 'payable', 'type',
+    'bytes', 'string', 'require', 'assert', 'revert', 'keccak256',
+]);
+const TRUSTED_MODIFIERS = new Set([
+    'onlymessenger', 'onlyl2messenger', 'onlybridge', 'onlygateway', 'onlyrelay',
+    'onlyrelayer', 'onlyinbox', 'onlycrosschain', 'onlytrusted',
+]);
+const REPLAY_NAMES = /(?:processed|consumed|used|seen|replay|nonce|messagehash|msgHash|hash)/i;
+const FINALITY_NAMES = /(?:finaliz|settled|root|checkpoint|accounting|canonical|proven|verified)/i;
+const ACCOUNTING_NAMES = /(?:balance|credit|mint|account|deposit|withdraw|claim|supply|reserve|amount|debt|share|asset|token|vault)/i;
+class L1ToL2MessageReentrancyDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser', 'solc'];
+    scanAst(ast, file, sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        const lineOffsets = buildLineOffsets(sourceText);
+        for (const contract of collectContracts(ast)) {
+            if (isInterfaceLike(contract))
+                continue;
+            const contractName = getName(contract);
+            const stateVars = collectStateVariables(contract);
+            for (const fn of contractMembers(contract)) {
+                if (!isNode(fn, 'FunctionDefinition'))
+                    continue;
+                if (!getBody(fn))
+                    continue;
+                if (!isExternallyCallable(fn))
+                    continue;
+                if (!isHandlerLike(fn))
+                    continue;
+                const finding = analyzeFunction(file, contractName, fn, stateVars, lineOffsets);
+                if (finding)
+                    findings.push(finding);
+            }
+        }
+        return findings;
+    }
+}
+exports.L1ToL2MessageReentrancyDetector = L1ToL2MessageReentrancyDetector;
+function analyzeFunction(file, contractName, fn, stateVars, lineOffsets) {
+    const functionName = getName(fn) || '<anonymous>';
+    const localVars = collectFunctionLocals(fn);
+    const originParams = collectParamNames(fn, /(?:origin|l1|sender|from|source)/i);
+    const messageKeys = collectParamNames(fn, /(?:nonce|id|hash|root|message|msg)/i);
+    const guards = {
+        sender: hasTrustedModifier(fn),
+        origin: false,
+        replayChecked: false,
+        replayMarked: false,
+        finality: false,
+    };
+    for (const stmt of getStatements(getBody(fn))) {
+        const sink = findPrematureSink(stmt, guards, stateVars, localVars, lineOffsets);
+        if (sink) {
+            return makeFinding(file, contractName, functionName, sink.loc, sink.kind);
+        }
+        observeGuards(stmt, guards, stateVars, originParams, messageKeys);
+    }
+    return null;
+}
+function findPrematureSink(node, guards, stateVars, localVars, lineOffsets, ancestors = []) {
+    if (!node || typeof node !== 'object')
+        return null;
+    if (isNode(node, 'EmitStatement'))
+        return null;
+    if (isRevertCall(node))
+        return null;
+    if (isFunctionCall(node) && isSensitiveExternalCall(node)) {
+        if (!isSkippableGuardPredicateRead(node, ancestors) && !allGuardsEstablished(guards)) {
+            return { loc: locOf(node, lineOffsets), kind: missingGuardTrace(guards, 'external-call-before-guards') };
+        }
+    }
+    if (isGuardCall(node) && !callContainsSensitiveExternalCall(node)) {
+        return null;
+    }
+    if (isAssignment(node)) {
+        const left = assignmentLeft(node);
+        const stateName = stateVarRoot(left, stateVars, localVars);
+        if (stateName && isSensitiveStateWriteName(stateName)) {
+            if (!allGuardsEstablished(guards))
+                return { loc: locOf(node, lineOffsets), kind: missingGuardTrace(guards, 'state-write-before-guards') };
+        }
+    }
+    if (isNode(node, 'UnaryOperation')) {
+        const stateName = stateVarRoot(node.subExpression, stateVars, localVars);
+        if (stateName && isSensitiveStateWriteName(stateName) && !allGuardsEstablished(guards)) {
+            return { loc: locOf(node, lineOffsets), kind: missingGuardTrace(guards, 'state-write-before-guards') };
+        }
+    }
+    for (const child of childNodes(node)) {
+        const sink = findPrematureSink(child, guards, stateVars, localVars, lineOffsets, [...ancestors, node]);
+        if (sink)
+            return sink;
+    }
+    return null;
+}
+function observeGuards(node, guards, stateVars, originParams, messageKeys) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (isGuardCall(node)) {
+        const condition = firstArg(node);
+        markConditionGuards(condition, guards, stateVars, originParams, messageKeys);
+        return;
+    }
+    if (isNode(node, 'IfStatement')) {
+        if (branchReverts(node.trueBody) || branchReverts(node.falseBody)) {
+            markConditionGuards(node.condition, guards, stateVars, originParams, messageKeys);
+        }
+        return;
+    }
+    if (isAssignment(node)) {
+        const left = assignmentLeft(node);
+        const stateName = stateVarRoot(left, stateVars, new Set());
+        if (stateName && REPLAY_NAMES.test(stateName) && expressionMentionsAny(left, messageKeys)) {
+            guards.replayMarked = true;
+        }
+    }
+    for (const child of childNodes(node)) {
+        observeGuards(child, guards, stateVars, originParams, messageKeys);
+    }
+}
+function markConditionGuards(condition, guards, stateVars, originParams, messageKeys) {
+    if (!condition || typeof condition !== 'object')
+        return;
+    const text = expressionText(condition).toLowerCase();
+    if (text.includes('msg.sender') && /(messenger|bridge|gateway|relay|relayer|inbox|portal|trusted)/i.test(text)) {
+        guards.sender = true;
+    }
+    if (mentionsAnyName(condition, originParams) && (isComparison(condition) || text.includes('address(0)'))) {
+        guards.origin = true;
+    }
+    if (mentionsStateName(condition, stateVars, REPLAY_NAMES) && (expressionMentionsAny(condition, messageKeys) || /nonce|hash|id/.test(text))) {
+        guards.replayChecked = true;
+    }
+    if (mentionsStateName(condition, stateVars, FINALITY_NAMES) && (expressionMentionsAny(condition, messageKeys) || /root|finaliz|settled|checkpoint/.test(text))) {
+        guards.finality = true;
+    }
+}
+function isHandlerLike(fn) {
+    const name = getName(fn).toLowerCase();
+    const params = getParameters(fn);
+    const paramNames = params.map((p) => getName(p).toLowerCase()).join(' ');
+    const text = `${name} ${paramNames}`;
+    const handlerName = /(l1|l2|message|bridge|deposit|relay|receive|finaliz|handle|execute|process)/.test(name);
+    const hasOrigin = /(?:origin|l1sender|sender|from|source)/.test(text);
+    const hasMessageKey = /(?:nonce|id|hash|root|message|msg)/.test(text);
+    const hasBridgeWord = /(?:l1|l2|bridge|message|relay|messenger|root|origin)/.test(text);
+    return handlerName && hasOrigin && hasMessageKey && hasBridgeWord;
+}
+function isSensitiveExternalCall(call) {
+    let callee = unwrapCallOptions(callExpression(call));
+    if (!isNode(callee, 'MemberAccess'))
+        return false;
+    const member = String(callee.memberName || '').toLowerCase();
+    if (LOW_LEVEL_OR_VALUE_METHODS.has(member) || TOKEN_OR_HOOK_METHODS.has(member))
+        return true;
+    const baseName = simpleIdentifierName(callee.expression);
+    if (baseName && BUILTINS.has(baseName.toLowerCase()))
+        return false;
+    return true;
+}
+function callContainsSensitiveExternalCall(call) {
+    return (call.arguments || []).some((arg) => walkAny(arg, current => isFunctionCall(current) && isSensitiveExternalCall(current)));
+}
+function isSkippableGuardPredicateRead(call, ancestors) {
+    return isInsideGuardPredicate(call, ancestors) && isMessengerGuardReadCall(call);
+}
+function isInsideGuardPredicate(node, ancestors) {
+    for (let i = ancestors.length - 1; i >= 0; i--) {
+        const ancestor = ancestors[i];
+        if (isGuardCall(ancestor) && containsNode(firstArg(ancestor), node))
+            return true;
+        if (isNode(ancestor, 'IfStatement') && containsNode(ancestor.condition, node) && isRevertingGuardIf(ancestor))
+            return true;
+    }
+    return false;
+}
+function isRevertingGuardIf(node) {
+    return branchStopsWithoutMutation(node.trueBody) || branchStopsWithoutMutation(node.falseBody);
+}
+function branchStopsWithoutMutation(branch) {
+    if (!branch || typeof branch !== 'object')
+        return false;
+    if (isRevertCall(branch) || isReturnStatement(branch))
+        return true;
+    const statements = getStatements(branch);
+    if (statements.length === 0)
+        return isRevertCall(branch.expression) || isReturnStatement(branch.expression);
+    return statements.length > 0 && statements.every(stmt => isRevertCall(stmt) || isRevertCall(stmt.expression) || isReturnStatement(stmt));
+}
+function isReturnStatement(node) {
+    return isNode(node, 'ReturnStatement');
+}
+function isMessengerGuardReadCall(call) {
+    let callee = unwrapCallOptions(callExpression(call));
+    if (!isNode(callee, 'MemberAccess'))
+        return false;
+    const member = String(callee.memberName || '').toLowerCase();
+    if (LOW_LEVEL_OR_VALUE_METHODS.has(member) || TOKEN_OR_HOOK_METHODS.has(member))
+        return false;
+    if (!GUARD_READ_METHODS.has(member) && !GUARD_READ_MEMBER.test(member))
+        return false;
+    const baseText = expressionText(callee.expression);
+    return GUARD_READ_BASE.test(baseText);
+}
+function containsNode(root, target) {
+    if (!root || typeof root !== 'object')
+        return false;
+    if (root === target)
+        return true;
+    return childNodes(root).some(child => containsNode(child, target));
+}
+function isSensitiveStateWriteName(name) {
+    return !REPLAY_NAMES.test(name) && !FINALITY_NAMES.test(name) && ACCOUNTING_NAMES.test(name);
+}
+function allGuardsEstablished(guards) {
+    return guards.sender && guards.origin && guards.replayChecked && guards.replayMarked && guards.finality;
+}
+function missingGuardTrace(guards, prefix) {
+    const missing = [];
+    if (!guards.sender)
+        missing.push('sender');
+    if (!guards.origin)
+        missing.push('origin');
+    if (!guards.replayChecked)
+        missing.push('replay-check');
+    if (!guards.replayMarked)
+        missing.push('replay-mark');
+    if (!guards.finality)
+        missing.push('finality');
+    return `${prefix}:missing-${missing.join('-')}`;
+}
+function makeFinding(file, contractName, functionName, loc, trace) {
+    return {
+        file,
+        contract: contractName,
+        'function': functionName,
+        line: loc.line,
+        column: loc.column,
+        pattern: RULE_ID,
+        confidence: 'high',
+        ruleId: RULE_ID,
+        severity: 'high',
+        message: `L1-to-L2 message handler '${contractName}.${functionName}' performs a sensitive state change or external interaction before sender/origin validation, replay marking, and finality/accounting checks are established.`,
+        contractName,
+        functionName,
+        sourceLocation: { line: loc.line, column: loc.column },
+        trace,
+        suggestedFix: 'Validate the messenger and L1 origin first, check and mark replay state before any external interaction, then validate finalized accounting assumptions before applying balances or calling hooks.',
+        findingId: '',
+        contractHash: '',
+    };
+}
+function collectContracts(ast) {
+    if (!ast || typeof ast !== 'object')
+        return [];
+    const roots = Array.isArray(ast.children) ? ast.children : Array.isArray(ast.nodes) ? ast.nodes : [];
+    return roots.filter((node) => isNode(node, 'ContractDefinition'));
+}
+function contractMembers(contract) {
+    return Array.isArray(contract.subNodes) ? contract.subNodes : Array.isArray(contract.nodes) ? contract.nodes : [];
+}
+function isInterfaceLike(contract) {
+    const kind = String(contract.kind || contract.contractKind || '').toLowerCase();
+    return kind === 'interface' || kind === 'library';
+}
+function collectStateVariables(contract) {
+    const names = new Set();
+    for (const member of contractMembers(contract)) {
+        if (isNode(member, 'StateVariableDeclaration')) {
+            for (const variable of member.variables || []) {
+                const name = getName(variable);
+                if (name)
+                    names.add(name);
+            }
+        }
+        else if (isNode(member, 'VariableDeclaration') && member.stateVariable) {
+            const name = getName(member);
+            if (name)
+                names.add(name);
+        }
+    }
+    return names;
+}
+function collectFunctionLocals(fn) {
+    const names = new Set();
+    for (const param of [...getParameters(fn), ...getReturnParameters(fn)]) {
+        const name = getName(param);
+        if (name)
+            names.add(name);
+    }
+    walk(fn.body, node => {
+        if (isNode(node, 'VariableDeclarationStatement')) {
+            for (const variable of node.variables || node.declarations || []) {
+                const name = getName(variable);
+                if (name)
+                    names.add(name);
+            }
+        }
+    });
+    return names;
+}
+function collectParamNames(fn, pattern) {
+    const names = new Set();
+    for (const param of getParameters(fn)) {
+        const name = getName(param);
+        if (name && pattern.test(name))
+            names.add(name);
+    }
+    return names;
+}
+function hasTrustedModifier(fn) {
+    for (const modifier of fn.modifiers || []) {
+        const name = modifierName(modifier).toLowerCase();
+        if (TRUSTED_MODIFIERS.has(name))
+            return true;
+    }
+    return false;
+}
+function modifierName(modifier) {
+    return modifier?.name?.name || modifier?.name || modifier?.modifierName?.name || modifier?.modifierName?.namePath || '';
+}
+function isExternallyCallable(fn) {
+    const visibility = String(fn.visibility || '').toLowerCase();
+    return visibility === 'external' || visibility === 'public';
+}
+function getBody(fn) {
+    return fn?.body || null;
+}
+function getStatements(body) {
+    if (!body || typeof body !== 'object')
+        return [];
+    return Array.isArray(body.statements) ? body.statements : [];
+}
+function getParameters(fn) {
+    if (Array.isArray(fn?.parameters))
+        return fn.parameters;
+    return fn?.parameters?.parameters || [];
+}
+function getReturnParameters(fn) {
+    if (Array.isArray(fn?.returnParameters))
+        return fn.returnParameters;
+    return fn?.returnParameters?.parameters || [];
+}
+function isGuardCall(node) {
+    if (!isFunctionCall(node))
+        return false;
+    const name = directCallName(callExpression(node));
+    return name === 'require' || name === 'assert';
+}
+function isRevertCall(node) {
+    if (isNode(node, 'RevertStatement'))
+        return true;
+    return isFunctionCall(node) && directCallName(callExpression(node)) === 'revert';
+}
+function firstArg(call) {
+    return (call.arguments || [])[0];
+}
+function branchReverts(branch) {
+    if (!branch || typeof branch !== 'object')
+        return false;
+    if (isRevertCall(branch))
+        return true;
+    const statements = getStatements(branch);
+    if (statements.length === 0)
+        return isRevertCall(branch.expression);
+    return statements.some(stmt => isRevertCall(stmt) || isRevertCall(stmt.expression));
+}
+function isAssignment(node) {
+    if (isNode(node, 'Assignment'))
+        return true;
+    return isNode(node, 'BinaryOperation') && ASSIGN_OPS.has(String(node.operator || ''));
+}
+function assignmentLeft(node) {
+    return node.left || node.leftHandSide;
+}
+function isFunctionCall(node) {
+    return isNode(node, 'FunctionCall');
+}
+function callExpression(call) {
+    return call?.expression;
+}
+function unwrapCallOptions(node) {
+    let current = node;
+    while (isNode(current, 'NameValueExpression') || isNode(current, 'FunctionCallOptions')) {
+        current = current.expression;
+    }
+    return current;
+}
+function stateVarRoot(expr, stateVars, localVars) {
+    if (!expr || typeof expr !== 'object')
+        return '';
+    if (isNode(expr, 'Identifier')) {
+        const name = getName(expr);
+        if (localVars.has(name))
+            return '';
+        return stateVars.has(name) ? name : '';
+    }
+    if (isNode(expr, 'IndexAccess'))
+        return stateVarRoot(expr.base || expr.baseExpression, stateVars, localVars);
+    if (isNode(expr, 'MemberAccess'))
+        return stateVarRoot(expr.expression, stateVars, localVars);
+    return '';
+}
+function expressionMentionsAny(node, names) {
+    if (names.size === 0)
+        return false;
+    let found = false;
+    walk(node, current => {
+        if (isNode(current, 'Identifier') && names.has(getName(current)))
+            found = true;
+    });
+    return found;
+}
+function mentionsAnyName(node, names) {
+    return expressionMentionsAny(node, names);
+}
+function mentionsStateName(node, stateVars, pattern) {
+    let found = false;
+    walk(node, current => {
+        if (isNode(current, 'Identifier')) {
+            const name = getName(current);
+            if (stateVars.has(name) && pattern.test(name))
+                found = true;
+        }
+    });
+    return found;
+}
+function isComparison(node) {
+    return walkAny(node, current => isNode(current, 'BinaryOperation') && ['==', '!=', '<', '>', '<=', '>='].includes(String(current.operator || '')));
+}
+function expressionText(node) {
+    if (!node || typeof node !== 'object')
+        return '';
+    if (isNode(node, 'Identifier'))
+        return getName(node);
+    if (isNode(node, 'MemberAccess'))
+        return `${expressionText(node.expression)}.${node.memberName || ''}`;
+    if (isNode(node, 'IndexAccess'))
+        return `${expressionText(node.base || node.baseExpression)}[${expressionText(node.index || node.indexExpression)}]`;
+    if (isNode(node, 'FunctionCall'))
+        return `${expressionText(callExpression(node))}(${(node.arguments || []).map(expressionText).join(',')})`;
+    if (isNode(node, 'UnaryOperation'))
+        return `${node.operator || ''}${expressionText(node.subExpression)}`;
+    if (isNode(node, 'BinaryOperation'))
+        return `${expressionText(node.left || node.leftExpression)}${node.operator || ''}${expressionText(node.right || node.rightExpression)}`;
+    if (isNode(node, 'Literal') || isNode(node, 'NumberLiteral') || isNode(node, 'StringLiteral') || isNode(node, 'BooleanLiteral'))
+        return String(node.value ?? node.number ?? '');
+    return childNodes(node).map(expressionText).join(' ');
+}
+function directCallName(expr) {
+    return isNode(expr, 'Identifier') ? getName(expr) : '';
+}
+function simpleIdentifierName(expr) {
+    return isNode(expr, 'Identifier') ? getName(expr) : '';
+}
+function getName(node) {
+    return String(node?.name || '');
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function walk(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const child of childNodes(node))
+        walk(child, visit);
+}
+function walkAny(node, predicate) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (predicate(node))
+        return true;
+    return childNodes(node).some(child => walkAny(child, predicate));
+}
+function childNodes(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const out = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'src' || key === 'range' || key === 'typeDescriptions' || key === 'documentation')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item && typeof item === 'object')
+                    out.push(item);
+            }
+        }
+        else if (value && typeof value === 'object') {
+            out.push(value);
+        }
+    }
+    return out;
+}
+function locOf(node, lineOffsets) {
+    if (node?.loc?.start)
+        return { line: node.loc.start.line || 0, column: node.loc.start.column || 0 };
+    return getLocFromSrc(node, lineOffsets) || { line: 0, column: 0 };
+}
+function buildLineOffsets(sourceText) {
+    if (sourceText === undefined)
+        return undefined;
+    const lineOffsets = [0];
+    let byteOffset = 0;
+    for (const char of sourceText) {
+        byteOffset += Buffer.byteLength(char, 'utf8');
+        if (char === '\n')
+            lineOffsets.push(byteOffset);
+    }
+    return lineOffsets;
+}
+function getLocFromSrc(node, lineOffsets) {
+    if (!node?.src || !lineOffsets)
+        return undefined;
+    const offset = Number(String(node.src).split(':')[0]);
+    if (!Number.isFinite(offset) || offset < 0)
+        return undefined;
+    let lineIndex = 0;
+    for (let i = 0; i < lineOffsets.length; i++) {
+        if (lineOffsets[i] <= offset)
+            lineIndex = i;
+        else
+            break;
+    }
+    return { line: lineIndex + 1, column: offset - lineOffsets[lineIndex] };
+}
+//# sourceMappingURL=l1-to-l2-message-reentrancy.js.map

package/dist/detectors/l2-withdrawal-validation.d.ts

@@ -0,0 +1,8 @@
+import type { ScanResult } from '../index';
+export declare class L2WithdrawalValidationDetector {
+    readonly id = "l2-withdrawal-validation";
+    readonly patternKey = "l2-withdrawal-validation";
+    readonly supportedAstKinds: "parser"[];
+    scan(ast: any, ctx?: any): ScanResult[];
+    scanAst(ast: any, file: string): ScanResult[];
+}