@snovon/solast 0.2.0

package/dist/detectors/price-dependency-veth.js

@@ -0,0 +1,588 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PriceDependencyVethDetector = void 0;
+const ast_1 = require("./_common/ast");
+const price_rate_1 = require("./_common/price-rate");
+const ast_2 = require("./_common/ast");
+const RULE_ID = 'price-dependency-veth';
+class PriceDependencyVethDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    findings = [];
+    currentFile = '';
+    currentContract = '';
+    contractPriceVars = new Set();
+    contractTotalLikeVars = new Set();
+    contractHelperFns = new Map();
+    setFile(file) {
+        this.currentFile = file;
+        this.findings = [];
+        this.currentContract = '';
+        this.contractPriceVars.clear();
+        this.contractTotalLikeVars.clear();
+        this.contractHelperFns.clear();
+    }
+    getFindings() {
+        return this.findings;
+    }
+    ContractDefinition(node) {
+        this.currentContract = node.name || '<anonymous>';
+        this.contractPriceVars.clear();
+        this.contractTotalLikeVars.clear();
+        this.contractHelperFns.clear();
+        for (const sub of node.subNodes || []) {
+            if (sub?.type === 'StateVariableDeclaration') {
+                for (const v of sub.variables || []) {
+                    if (!v?.name)
+                        continue;
+                    if ((0, price_rate_1.isPriceRateLikeIdentifier)(v.name)) {
+                        this.contractPriceVars.add(v.name);
+                    }
+                    if (this.isTotalLikeName(v.name)) {
+                        this.contractTotalLikeVars.add(v.name);
+                    }
+                }
+            }
+            else if (sub?.type === 'FunctionDefinition' && sub.name) {
+                this.contractHelperFns.set(sub.name, sub);
+            }
+        }
+    }
+    ContractDefinition_post(_node) {
+        this.currentContract = '';
+        this.contractPriceVars.clear();
+        this.contractTotalLikeVars.clear();
+        this.contractHelperFns.clear();
+    }
+    FunctionDefinition(node) {
+        if (!node?.body)
+            return;
+        const fnName = node.name || '';
+        if (!fnName)
+            return;
+        const mutability = String(node.stateMutability || '').toLowerCase();
+        if (mutability === 'view' || mutability === 'pure')
+            return;
+        // tryLoc-with-zero-floor (roadmap 2.14.b9.x). The visitor-pump's
+        // FunctionDefinition handler can receive ASTs from test harnesses
+        // (e.g. run-all-assertions.js) that synthesise minimal nodes
+        // without `loc`. assertLoc would crash on those.
+        const fnLocInfo = (0, ast_1.tryLoc)(node) ?? { line: 0, endLine: 0, column: 0 };
+        const fnLoc = { line: fnLocInfo.line, column: fnLocInfo.column };
+        const state = {
+            fnName,
+            fnLoc,
+            contractName: this.currentContract,
+            taintedLocals: new Set(),
+            taintedHelpers: new Set(),
+            priceHits: [],
+            arithmeticUsages: [],
+            hasValueTransferShape: (0, price_rate_1.isCriticalValueTransferFunctionName)(fnName),
+            hasSinkDependency: false,
+            hasGuard: false,
+            hasReadOnlyMutability: false,
+            returnValueNames: new Set((node.returnParameters || [])
+                .map((p) => p?.name || p?.identifier?.name || '')
+                .filter((n) => n.length > 0)),
+        };
+        const modifierNames = (node.modifiers || []).map((m) => {
+            if (typeof m === 'string')
+                return m;
+            const inner = m?.name;
+            if (typeof inner === 'string')
+                return inner;
+            if (inner && typeof inner === 'object')
+                return inner.name || '';
+            return '';
+        });
+        if (modifierNames.some((n) => (0, price_rate_1.isRecognizedFreshnessModifierName)(n))) {
+            return;
+        }
+        this.walkBody(node.body, state);
+        if (!state.hasValueTransferShape)
+            return;
+        if (state.priceHits.length === 0)
+            return;
+        if (!state.hasSinkDependency)
+            return;
+        if (state.hasGuard)
+            return;
+        this.emitFinding(state, this.preferredFindingLoc(state));
+    }
+    preferredFindingLoc(state) {
+        const firstArithmetic = state.arithmeticUsages[0];
+        const preferredPriceHit = state.priceHits.find(hit => hit.kind !== 'state-var')
+            || state.priceHits[0];
+        return firstArithmetic || preferredPriceHit?.loc || state.fnLoc;
+    }
+    walkBody(node, state) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'IfStatement') {
+            this.checkGuardCondition(node.condition, state);
+            this.walkBody(node.condition, state);
+            if (node.trueBody)
+                this.walkBody(node.trueBody, state);
+            if (node.falseBody)
+                this.walkBody(node.falseBody, state);
+            return;
+        }
+        if (node.type === 'VariableDeclarationStatement') {
+            this.handleVarDecl(node, state);
+            return;
+        }
+        if (node.type === 'ExpressionStatement') {
+            this.walkBody(node.expression, state);
+            return;
+        }
+        if ((0, ast_2.isNode)(node, 'FunctionCall')) {
+            this.handleFunctionCall(node, state);
+            return;
+        }
+        if ((0, ast_2.isNode)(node, 'BinaryOperation')) {
+            this.handleBinaryOp(node, state);
+            return;
+        }
+        if ((0, ast_2.isNode)(node, 'AssemblyCall')) {
+            if (this.exprUsesTaint(node, state)) {
+                state.arithmeticUsages.push(this.locOf(node));
+                state.hasSinkDependency = true;
+            }
+            for (const child of this.childNodes(node)) {
+                this.walkBody(child, state);
+            }
+            return;
+        }
+        for (const child of this.childNodes(node)) {
+            this.walkBody(child, state);
+        }
+    }
+    handleVarDecl(node, state) {
+        const init = node.initialValue;
+        const decls = node.variables || [];
+        let initIsPrice = false;
+        if (init) {
+            const hit = this.priceSourceHit(init, state);
+            if (hit) {
+                state.priceHits.push(hit);
+                initIsPrice = true;
+            }
+            else if (this.exprUsesTaint(init, state)) {
+                state.arithmeticUsages.push(this.locOf(init));
+                state.hasSinkDependency = true;
+                if (!((0, ast_2.isNode)(init, 'FunctionCall') &&
+                    (0, price_rate_1.isCriticalValueTransferFunctionName)((0, price_rate_1.getCalleeName)(init.expression)))) {
+                    initIsPrice = true;
+                }
+            }
+        }
+        for (const decl of decls) {
+            if (!decl?.name)
+                continue;
+            if (initIsPrice) {
+                state.taintedLocals.add(decl.name);
+            }
+        }
+        if (init)
+            this.walkBody(init, state);
+    }
+    handleFunctionCall(node, state) {
+        const calleeName = (0, price_rate_1.getCalleeName)(node.expression);
+        if (calleeName === 'require' || calleeName === 'assert') {
+            const cond = (node.arguments || [])[0];
+            if (cond)
+                this.checkGuardCondition(cond, state);
+            if (cond && this.exprUsesTaint(cond, state)) {
+                state.hasSinkDependency = true;
+            }
+            for (const arg of node.arguments || [])
+                this.walkBody(arg, state);
+            return;
+        }
+        if ((0, price_rate_1.isCriticalValueTransferFunctionName)(calleeName)) {
+            state.hasValueTransferShape = true;
+            for (const arg of node.arguments || []) {
+                const hit = this.priceSourceHit(arg, state);
+                if (hit) {
+                    state.priceHits.push(hit);
+                    state.hasSinkDependency = true;
+                }
+                if (this.exprUsesTaint(arg, state)) {
+                    state.arithmeticUsages.push(this.locOf(arg));
+                    state.hasSinkDependency = true;
+                }
+                this.walkBody(arg, state);
+            }
+            return;
+        }
+        for (const arg of node.arguments || [])
+            this.walkBody(arg, state);
+        if (node.expression)
+            this.walkBody(node.expression, state);
+    }
+    handleBinaryOp(node, state) {
+        const op = node.operator;
+        if (op === '=' || op === '+=' || op === '-=' || op === '*=' || op === '/=') {
+            const right = node.right || node.rightHandSide;
+            const left = node.left || node.leftHandSide;
+            if (right) {
+                if (op === '=') {
+                    const hit = this.priceSourceHit(right, state);
+                    if (hit) {
+                        state.priceHits.push(hit);
+                        this.taintAssignmentTarget(left, state);
+                        if (this.assignmentTargetHasAnyName(left, state.returnValueNames)) {
+                            state.hasSinkDependency = true;
+                        }
+                    }
+                    else if (this.exprUsesTaint(right, state)) {
+                        state.arithmeticUsages.push(this.locOf(right));
+                        this.taintAssignmentTarget(left, state);
+                        state.hasSinkDependency = true;
+                    }
+                }
+                else {
+                    if (this.exprUsesTaint(right, state)) {
+                        state.arithmeticUsages.push(this.locOf(right));
+                        state.hasSinkDependency = true;
+                    }
+                }
+                this.walkBody(right, state);
+            }
+            if (left)
+                this.walkBody(left, state);
+            return;
+        }
+        if (['*', '/', '+', '-'].includes(op)) {
+            if (this.exprUsesTaint(node, state)) {
+                state.arithmeticUsages.push(this.locOf(node));
+                state.hasSinkDependency = true;
+            }
+        }
+        const left = node.left || node.leftExpression;
+        const right = node.right || node.rightExpression;
+        if (left)
+            this.walkBody(left, state);
+        if (right)
+            this.walkBody(right, state);
+    }
+    /**
+     * Identify a node as a price-source if it (or its child after a cast or
+     * arithmetic op) directly comes from a price/rate signal. Returns the hit
+     * descriptor when found, null otherwise.
+     */
+    priceSourceHit(node, state) {
+        if (!node || typeof node !== 'object')
+            return null;
+        if (this.isVethPriceSourceCall(node)) {
+            return { kind: 'oracle-call', loc: this.locOf(node) };
+        }
+        if ((0, ast_2.isNode)(node, 'FunctionCall')) {
+            const calleeName = (0, price_rate_1.getCalleeName)(node.expression);
+            // Cast wrappers: `uint256(feed.latestAnswer())` or similar. The call
+            // expression is the type name, args carry the inner expression. Recurse
+            // into the single argument when it exists.
+            if (this.isTypeCastCall(node)) {
+                const inner = (node.arguments || [])[0];
+                return inner ? this.priceSourceHit(inner, state) : null;
+            }
+            // Same-contract helper whose name is price/rate-like — treat as a
+            // helper-call hit. Avoids deep cross-function analysis while catching
+            // obvious wrapper patterns like `currentRedeemRate()`.
+            if (calleeName && this.contractHelperFns.has(calleeName) &&
+                (0, price_rate_1.isPriceRateLikeIdentifier)(calleeName)) {
+                return { kind: 'helper-call', loc: this.locOf(node) };
+            }
+            // `asset.balanceOf(address(this))` is treated as a rate component only
+            // when used in an arithmetic expression that divides by a state var
+            // matching `total*` (handled at the BinaryOperation layer below). The
+            // raw call alone is not a price hit.
+            return null;
+        }
+        if ((0, ast_2.isNode)(node, 'Identifier')) {
+            if (this.contractPriceVars.has(node.name)) {
+                return { kind: 'state-var', loc: this.locOf(node) };
+            }
+            if (state.taintedLocals.has(node.name)) {
+                return { kind: 'tainted-local', loc: this.locOf(node) };
+            }
+            return null;
+        }
+        if ((0, ast_2.isNode)(node, 'MemberAccess')) {
+            // `this.exchangeRate` or `self.price` — check the member name.
+            const memberName = node.memberName || '';
+            if (memberName && this.contractPriceVars.has(memberName)) {
+                return { kind: 'state-var', loc: this.locOf(node) };
+            }
+            return null;
+        }
+        if ((0, ast_2.isNode)(node, 'BinaryOperation') && (node.operator === '*' || node.operator === '/')) {
+            // Balance-derived rate: `balanceOf(...) [op] totalShares` shapes.
+            if (this.isBalanceRateExpression(node)) {
+                return { kind: 'balance-rate', loc: this.locOf(node) };
+            }
+            const left = node.left || node.leftExpression;
+            const right = node.right || node.rightExpression;
+            if (node.operator === '/' && this.containsTotalLikeRef(right)) {
+                return null;
+            }
+            const leftHit = this.priceSourceHit(left, state);
+            if (leftHit)
+                return leftHit;
+            const rightHit = this.priceSourceHit(right, state);
+            if (rightHit)
+                return rightHit;
+            return null;
+        }
+        if ((0, ast_2.isNode)(node, 'TupleExpression')) {
+            for (const c of node.components || []) {
+                const hit = this.priceSourceHit(c, state);
+                if (hit)
+                    return hit;
+            }
+            return null;
+        }
+        return null;
+    }
+    exprUsesTaint(node, state) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if ((0, ast_2.isNode)(node, 'Identifier')) {
+            if (state.taintedLocals.has(node.name))
+                return true;
+            if (this.contractPriceVars.has(node.name))
+                return true;
+            return false;
+        }
+        if ((0, ast_2.isNode)(node, 'MemberAccess')) {
+            const memberName = node.memberName || '';
+            if (memberName && state.taintedLocals.has(memberName))
+                return true;
+            if (memberName && this.contractPriceVars.has(memberName))
+                return true;
+            return this.exprUsesTaint(node.expression, state);
+        }
+        if ((0, ast_2.isNode)(node, 'FunctionCall')) {
+            if (this.isVethPriceSourceCall(node))
+                return true;
+            const calleeName = (0, price_rate_1.getCalleeName)(node.expression);
+            if (calleeName && this.contractHelperFns.has(calleeName) &&
+                (0, price_rate_1.isPriceRateLikeIdentifier)(calleeName)) {
+                return true;
+            }
+            if (this.exprUsesTaint(node.expression, state))
+                return true;
+            if (this.isTypeCastCall(node)) {
+                const inner = (node.arguments || [])[0];
+                return inner ? this.exprUsesTaint(inner, state) : false;
+            }
+            for (const arg of node.arguments || []) {
+                if (this.exprUsesTaint(arg, state))
+                    return true;
+            }
+            return false;
+        }
+        if ((0, ast_2.isNode)(node, 'BinaryOperation')) {
+            if ((node.operator === '*' || node.operator === '/') &&
+                this.isBalanceRateExpression(node)) {
+                return true;
+            }
+            const left = node.left || node.leftExpression;
+            const right = node.right || node.rightExpression;
+            if (node.operator === '/' && this.containsTotalLikeRef(right)) {
+                return false;
+            }
+            return this.exprUsesTaint(left, state) || this.exprUsesTaint(right, state);
+        }
+        if ((0, ast_2.isNode)(node, 'UnaryOperation')) {
+            return this.exprUsesTaint(node.subExpression, state);
+        }
+        if ((0, ast_2.isNode)(node, 'TupleExpression')) {
+            for (const c of node.components || []) {
+                if (this.exprUsesTaint(c, state))
+                    return true;
+            }
+            return false;
+        }
+        if ((0, ast_2.isNode)(node, 'IndexAccess')) {
+            return this.exprUsesTaint(node.base, state) || this.exprUsesTaint(node.index, state);
+        }
+        if ((0, ast_2.isNode)(node, 'AssemblyCall')) {
+            if (state.taintedLocals.has(node.functionName || ''))
+                return true;
+            for (const arg of node.arguments || []) {
+                if (this.exprUsesTaint(arg, state))
+                    return true;
+            }
+            return false;
+        }
+        return false;
+    }
+    taintAssignmentTarget(left, state) {
+        if (!left || typeof left !== 'object')
+            return;
+        if ((0, ast_2.isNode)(left, 'Identifier') && left.name) {
+            state.taintedLocals.add(left.name);
+            return;
+        }
+        if ((0, ast_2.isNode)(left, 'MemberAccess') && left.memberName) {
+            state.taintedLocals.add(left.memberName);
+            return;
+        }
+        if ((0, ast_2.isNode)(left, 'TupleExpression')) {
+            for (const component of left.components || []) {
+                this.taintAssignmentTarget(component, state);
+            }
+        }
+    }
+    assignmentTargetHasAnyName(left, names) {
+        if (!left || typeof left !== 'object' || names.size === 0)
+            return false;
+        if ((0, ast_2.isNode)(left, 'Identifier') && names.has(left.name || ''))
+            return true;
+        if ((0, ast_2.isNode)(left, 'MemberAccess') && names.has(left.memberName || ''))
+            return true;
+        if ((0, ast_2.isNode)(left, 'TupleExpression')) {
+            return (left.components || []).some((component) => this.assignmentTargetHasAnyName(component, names));
+        }
+        return false;
+    }
+    isVethPriceSourceCall(node) {
+        if (!node || !(0, ast_2.isNode)(node, 'FunctionCall'))
+            return false;
+        if ((0, price_rate_1.isPriceSourceCall)(node))
+            return true;
+        if ((0, price_rate_1.getCalleeName)(node.expression) === 'getReserves') {
+            return (0, ast_2.isNode)(node.expression, 'MemberAccess');
+        }
+        return false;
+    }
+    checkGuardCondition(cond, state) {
+        if (!cond)
+            return;
+        if (state.hasGuard)
+            return;
+        if ((0, price_rate_1.isFreshnessGuard)(cond)) {
+            state.hasGuard = true;
+            return;
+        }
+        const taintedNames = [
+            ...state.taintedLocals,
+            ...this.contractPriceVars,
+        ];
+        if ((0, price_rate_1.isSanityBoundGuard)(cond, taintedNames)) {
+            state.hasGuard = true;
+            return;
+        }
+    }
+    isTotalLikeName(name) {
+        if (!name)
+            return false;
+        const lower = name.toLowerCase();
+        return lower === 'totalsupply' || lower === 'totalshares' ||
+            lower === 'totalassets' || lower === 'total' ||
+            lower.startsWith('total');
+    }
+    isBalanceRateExpression(node) {
+        if (!(0, ast_2.isNode)(node, 'BinaryOperation'))
+            return false;
+        if (node.operator !== '*' && node.operator !== '/')
+            return false;
+        return this.containsBalanceCall(node) && this.containsTotalLikeRef(node);
+    }
+    containsBalanceCall(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if ((0, ast_2.isNode)(node, 'FunctionCall')) {
+            const callee = (0, price_rate_1.getCalleeName)(node.expression);
+            if (callee === 'balanceOf')
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsBalanceCall(child))
+                return true;
+        }
+        return false;
+    }
+    containsTotalLikeRef(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if ((0, ast_2.isNode)(node, 'Identifier')) {
+            if (this.contractTotalLikeVars.has(node.name))
+                return true;
+            if (this.isTotalLikeName(node.name || ''))
+                return true;
+        }
+        if ((0, ast_2.isNode)(node, 'MemberAccess')) {
+            if (this.isTotalLikeName(node.memberName || ''))
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsTotalLikeRef(child))
+                return true;
+        }
+        return false;
+    }
+    isTypeCastCall(node) {
+        if (!(0, ast_2.isNode)(node, 'FunctionCall'))
+            return false;
+        const expr = node.expression;
+        if (!expr)
+            return false;
+        if ((0, ast_2.isNode)(expr, 'ElementaryTypeName'))
+            return true;
+        if ((0, ast_2.isNode)(expr, 'TypeNameExpression'))
+            return true;
+        return false;
+    }
+    locOf(node) {
+        // tryLoc + zero floor: same reason as the FunctionDefinition
+        // handler above — test-harness-synthesised ASTs feed this
+        // detector during run-all-assertions, and the synthetic nodes
+        // lack `loc`. The detector's emit logic already tolerates
+        // line/column = 0 for those test paths.
+        const info = (0, ast_1.tryLoc)(node) ?? { line: 0, endLine: 0, column: 0 };
+        return { line: info.line, column: info.column };
+    }
+    emitFinding(state, sinkLoc) {
+        const line = sinkLoc.line || state.fnLoc.line || 1;
+        const column = sinkLoc.column || state.fnLoc.column || 0;
+        this.findings.push({
+            file: this.currentFile,
+            contract: state.contractName,
+            function: state.fnName,
+            line,
+            column,
+            pattern: RULE_ID,
+            confidence: 'high',
+            ruleId: RULE_ID,
+            severity: 'high',
+            message: `Vulnerable price dependency in '${state.contractName}.${state.fnName}': critical value transfer is computed from a single unsanitized price/rate signal without freshness, deviation, bound, or TWAP validation.`,
+            contractName: state.contractName,
+            functionName: state.fnName,
+            sourceLocation: { line, column },
+            findingId: '',
+            contractHash: '',
+        });
+    }
+    childNodes(node) {
+        const children = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range' || key === 'src')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        children.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                children.push(value);
+            }
+        }
+        return children;
+    }
+}
+exports.PriceDependencyVethDetector = PriceDependencyVethDetector;
+//# sourceMappingURL=price-dependency-veth.js.map

package/dist/detectors/price-feed-verification.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class PriceFeedVerificationDetector {
+    readonly id = "oracle/price-feed-verification";
+    readonly patternKey = "oracle/price-feed-verification";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+}