@snovon/solast 0.2.0

package/dist/detectors/mev-boost-timestamp.js

@@ -0,0 +1,318 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MevBoostTimestampDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'mev-boost-timestamp';
+const PATTERN_ID = `${RULE_ID}/timestamp-controlled-value-path`;
+class MevBoostTimestampDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser', 'solc'];
+    scanAst(ast, file, sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        const lineOffsets = buildLineOffsets(sourceText);
+        for (const contract of collectContracts(ast)) {
+            if (isInterfaceLike(contract))
+                continue;
+            const contractName = getName(contract) || '<anonymous>';
+            for (const fn of getContractFunctions(contract)) {
+                const info = {
+                    node: fn,
+                    name: functionDisplayName(fn),
+                    body: getFunctionBody(fn),
+                };
+                if (!info.body || isReadOnlyFunction(fn))
+                    continue;
+                if (!containsValueMovement(info.body))
+                    continue;
+                const candidates = collectTimestampCandidates(info.body);
+                if (candidates.length === 0)
+                    continue;
+                const candidate = candidates[0];
+                const loc = (0, ast_1.getLoc)(candidate.node, lineOffsets) || (0, ast_1.getLoc)(info.node, lineOffsets) || { line: 0, column: 0 };
+                findings.push({
+                    file,
+                    contract: contractName,
+                    'function': info.name,
+                    line: loc.line,
+                    endLine: getEndLine(candidate.node, lineOffsets) || loc.line,
+                    column: loc.column,
+                    pattern: PATTERN_ID,
+                    confidence: 'high',
+                    ruleId: RULE_ID,
+                    severity: 'warning',
+                    message: `MEV-Boost timestamp exposure in '${contractName}.${info.name}' at ${candidate.site}: proposer/builder-controlled block timestamps influence a branch or randomness source before value is transferred. Avoid using block.timestamp as a fairness, randomness, expiry, or settlement boundary for value-moving paths.`,
+                    rationale: 'Post-Merge proposer/builder timing can choose whether a transaction lands on a boundary timestamp, biasing withdrawals, bonuses, prize selection, or settlement outcomes that depend on block.timestamp.',
+                    suggestedFix: 'Use longer challenge windows for expiry-only logic, commit-reveal or trusted randomness for winner selection, and settlement designs that do not let a single slot timestamp change who receives value.',
+                    contractName,
+                    functionName: info.name,
+                    sourceLocation: { line: loc.line, column: loc.column },
+                    findingId: '',
+                    contractHash: '',
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.MevBoostTimestampDetector = MevBoostTimestampDetector;
+function collectTimestampCandidates(body) {
+    const out = [];
+    walk(body, node => {
+        if (!node || typeof node !== 'object')
+            return;
+        if (isNode(node, 'FunctionCall')) {
+            const calleeName = getCalleeName(node);
+            const firstArg = getCallArguments(node)[0];
+            if ((calleeName === 'require' || calleeName === 'assert') && containsBlockTimestamp(firstArg)) {
+                out.push({ node: firstArg || node, site: 'require/assert condition' });
+                return;
+            }
+            if (isRandomnessCall(node) && containsBlockTimestamp(node)) {
+                out.push({ node, site: 'timestamp-seeded randomness' });
+                return;
+            }
+        }
+        if (isNode(node, 'IfStatement') && containsBlockTimestamp(node.condition)) {
+            out.push({ node: node.condition || node, site: 'if condition' });
+            return;
+        }
+        if (isNode(node, 'Conditional') && containsBlockTimestamp(node.condition)) {
+            out.push({ node: node.condition || node, site: 'ternary condition' });
+        }
+    });
+    return dedupeCandidates(out);
+}
+function dedupeCandidates(candidates) {
+    const seen = new Set();
+    const out = [];
+    for (const candidate of candidates) {
+        const locKey = candidate.node?.range
+            ? String(candidate.node.range[0])
+            : candidate.node?.src
+                ? String(candidate.node.src)
+                : (() => {
+                    // Dedup-key site (synthetic-aware via tryLoc floor — solc-walker
+                    // may yield loc=0 on this detector's solc-AST inputs).
+                    const info = (0, ast_1.tryLoc)(candidate.node);
+                    return `${info?.line ?? 0}:${info?.column ?? 0}`;
+                })();
+        const key = `${candidate.site}:${locKey}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(candidate);
+    }
+    return out;
+}
+function containsValueMovement(node) {
+    return walkAny(node, n => {
+        if (!isNode(n, 'FunctionCall'))
+            return false;
+        const callee = unwrapCallOptions(n.expression);
+        if (!isNode(callee, 'MemberAccess'))
+            return false;
+        const member = String(callee.memberName || '').toLowerCase();
+        if (member === 'transfer' || member === 'send')
+            return true;
+        return member === 'call' && callHasValue(n);
+    });
+}
+function callHasValue(call) {
+    const expr = call?.expression;
+    if (!isNode(expr, 'NameValueExpression') && !isNode(expr, 'FunctionCallOptions'))
+        return false;
+    const names = Array.isArray(expr.names)
+        ? expr.names
+        : Array.isArray(expr.options?.names)
+            ? expr.options.names
+            : Array.isArray(expr.arguments?.names)
+                ? expr.arguments.names
+                : [];
+    if (names.some(name => nodeName(name).toLowerCase() === 'value'))
+        return true;
+    const options = Array.isArray(expr.options)
+        ? expr.options
+        : Array.isArray(expr.arguments)
+            ? expr.arguments
+            : [];
+    if (options.some(option => nodeName(option?.name || option?.keyName || option).toLowerCase() === 'value'))
+        return true;
+    if (expr.options && !Array.isArray(expr.options) && Object.prototype.hasOwnProperty.call(expr.options, 'value'))
+        return true;
+    return Array.isArray(expr.arguments) && expr.arguments.length > 0;
+}
+function containsBlockTimestamp(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (isNode(node, 'MemberAccess') &&
+        String(node.memberName || '') === 'timestamp' &&
+        isNode(node.expression, 'Identifier') &&
+        String(node.expression.name || '') === 'block') {
+        return true;
+    }
+    return childrenOf(node).some(containsBlockTimestamp);
+}
+function isRandomnessCall(node) {
+    const name = getCalleeName(node);
+    return name === 'keccak256' || name === 'sha256' || name === 'ripemd160';
+}
+function getCallArguments(node) {
+    return Array.isArray(node?.arguments) ? node.arguments : [];
+}
+function getCalleeName(call) {
+    const callee = unwrapCallOptions(call?.expression);
+    if (isNode(callee, 'Identifier'))
+        return String(callee.name || '');
+    if (isNode(callee, 'MemberAccess'))
+        return String(callee.memberName || '');
+    return '';
+}
+function unwrapCallOptions(expr) {
+    if (isNode(expr, 'NameValueExpression') || isNode(expr, 'FunctionCallOptions'))
+        return expr.expression;
+    return expr;
+}
+function isReadOnlyFunction(fn) {
+    const mutability = String(fn?.stateMutability || '').toLowerCase();
+    return mutability === 'view' || mutability === 'pure';
+}
+function isInterfaceLike(contract) {
+    const kind = String(contract?.kind || contract?.contractKind || '').toLowerCase();
+    return kind === 'interface' || kind === 'library';
+}
+function getFunctionBody(node) {
+    return node?.body || null;
+}
+function getContractFunctions(contract) {
+    return getContractMembers(contract).filter(child => isNode(child, 'FunctionDefinition'));
+}
+function getContractMembers(contract) {
+    if (!contract || typeof contract !== 'object')
+        return [];
+    if (Array.isArray(contract.subNodes))
+        return contract.subNodes;
+    if (Array.isArray(contract.nodes))
+        return contract.nodes;
+    return [];
+}
+function collectContracts(ast) {
+    const out = [];
+    walkContracts(ast, n => out.push(n));
+    return out;
+}
+function walkContracts(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (isNode(node, 'ContractDefinition')) {
+        visit(node);
+        return;
+    }
+    for (const child of childrenOf(node))
+        walkContracts(child, visit);
+}
+function walkAny(node, predicate) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (predicate(node))
+        return true;
+    return childrenOf(node).some(c => walkAny(c, predicate));
+}
+function walk(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const child of childrenOf(node))
+        walk(child, visit);
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const out = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'src' || key === 'range' || key === 'typeDescriptions' || key === 'id')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item && typeof item === 'object')
+                    out.push(item);
+            }
+        }
+        else if (value && typeof value === 'object') {
+            out.push(value);
+        }
+    }
+    return out;
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function getName(node) {
+    return typeof node?.name === 'string' ? node.name : '';
+}
+function functionDisplayName(fn) {
+    const kind = String(fn?.kind || '').toLowerCase();
+    if (fn?.isFallback === true || kind === 'fallback')
+        return '<fallback>';
+    if (fn?.isReceiveEther === true || kind === 'receive')
+        return '<receive>';
+    if (fn?.isConstructor === true || kind === 'constructor')
+        return '<constructor>';
+    return getName(fn) || '<anonymous>';
+}
+function nodeName(node) {
+    if (!node)
+        return '';
+    if (typeof node === 'string')
+        return node;
+    if (typeof node.name === 'string')
+        return node.name;
+    if (node.name)
+        return nodeName(node.name);
+    if (typeof node.keyName === 'string')
+        return node.keyName;
+    return '';
+}
+function buildLineOffsets(sourceText) {
+    if (sourceText === undefined)
+        return undefined;
+    const offsets = [0];
+    let byteOffset = 0;
+    for (const ch of sourceText) {
+        byteOffset += Buffer.byteLength(ch, 'utf8');
+        if (ch === '\n')
+            offsets.push(byteOffset);
+    }
+    return offsets;
+}
+function getEndLine(node, lineOffsets) {
+    if (node?.loc?.end?.line)
+        return node.loc.end.line;
+    if (!node?.src || !lineOffsets)
+        return undefined;
+    const [offsetRaw, lengthRaw] = String(node.src).split(':');
+    const offset = Number(offsetRaw);
+    const length = Number(lengthRaw);
+    if (!Number.isFinite(offset) || !Number.isFinite(length) || offset < 0)
+        return undefined;
+    return byteOffsetToLineColumn(offset + length, lineOffsets).line;
+}
+function byteOffsetToLineColumn(byteOffset, lineOffsets) {
+    let low = 0;
+    let high = lineOffsets.length - 1;
+    let lineIdx = 0;
+    while (low <= high) {
+        const mid = Math.floor((low + high) / 2);
+        if (lineOffsets[mid] <= byteOffset) {
+            lineIdx = mid;
+            low = mid + 1;
+        }
+        else {
+            high = mid - 1;
+        }
+    }
+    return { line: lineIdx + 1, column: byteOffset - lineOffsets[lineIdx] };
+}
+//# sourceMappingURL=mev-boost-timestamp.js.map

package/dist/detectors/mev-merge-exploit.d.ts

@@ -0,0 +1,29 @@
+import type { ScanResult } from '../index';
+export declare class MevMergeExploitDetector {
+    readonly id = "mev-merge-exploit";
+    readonly patternKey = "mev-merge-exploit";
+    readonly supportedAstKinds: "parser"[];
+    private currentFile;
+    private findings;
+    private currentContract;
+    private contractStack;
+    private stateVars;
+    private fn;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(_node: any): void;
+    ['ContractDefinition:exit'](node: any): void;
+    StateVariableDeclaration(node: any): void;
+    FunctionDefinition(node: any): void;
+    FunctionDefinition_post(_node: any): void;
+    ['FunctionDefinition:exit'](node: any): void;
+    VariableDeclaration(node: any): void;
+    IfStatement(node: any): void;
+    IfStatement_post(node: any): void;
+    ['IfStatement:exit'](node: any): void;
+    FunctionCall(node: any): void;
+    BinaryOperation(node: any): void;
+    UnaryOperation(node: any): void;
+    private emitFinding;
+}