@snovon/solast 0.2.0

package/dist/detectors/price-manipulation-reentrancy.js

@@ -0,0 +1,445 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PriceManipulationReentrancyDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'price-manipulation-reentrancy';
+const PATTERN = `${RULE_ID}/price-state-settled-after-reentrant-call`;
+const REENTRANCY_GUARD_NAMES = new Set([
+    'nonreentrant',
+    'nonreentrantview',
+    'nonreentrantreadonly',
+    'noreentrant',
+    'noreentry',
+    'reentrancyguard',
+    'nonreentrantcall',
+]);
+const BUILTIN_CALLS = new Set([
+    'require', 'assert', 'revert', 'gasleft', 'keccak256', 'sha256', 'ripemd160',
+    'ecrecover', 'addmod', 'mulmod', 'type', 'abi',
+]);
+const PRICE_ORACLE_MEMBERS = new Set([
+    'getprice',
+    'latestanswer',
+    'latestanswerray',
+    'latestrounddata',
+    'getreserves',
+    'price',
+    'consult',
+    'observe',
+    'slot0',
+]);
+const EXTERNAL_MEMBERS = new Set([
+    'call',
+    'delegatecall',
+    'send',
+    'transfer',
+    'transferfrom',
+    'safetransfer',
+    'safetransferfrom',
+    'swap',
+    'swapexacttokensforeth',
+    'swapexacttokensforethsupportingfeeontransfertokens',
+    'swapexactethfortokens',
+    'swapexacttokensfortokens',
+]);
+class PriceManipulationReentrancyDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'Price-affecting state is settled after a reentrant external call',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'high',
+        help: 'Flags externally callable functions that derive a payout or quote from oracle, reserve, TWAP, or accounting state, yield to an external call, and only then mutate price-affecting settlement state.',
+    };
+    currentFile = '';
+    findings = [];
+    contracts = [];
+    currentFunction = null;
+    setFile(file) {
+        this.currentFile = file;
+        this.findings = [];
+        this.contracts = [];
+        this.currentFunction = null;
+    }
+    getFindings() {
+        return this.findings;
+    }
+    ContractDefinition(node) {
+        const contract = {
+            name: typeof node.name === 'string' && node.name ? node.name : '<anonymous>',
+            kind: String(node.kind || node.contractKind || '').toLowerCase(),
+            stateVars: new Set(),
+            functions: new Map(),
+        };
+        this.contracts.push(contract);
+    }
+    ['ContractDefinition:exit']() {
+        const contract = this.contracts[this.contracts.length - 1];
+        if (contract && contract.kind !== 'interface' && contract.kind !== 'library') {
+            this.finalizeContract(contract);
+        }
+        this.contracts.pop();
+    }
+    StateVariableDeclaration(node) {
+        const contract = this.currentContract();
+        if (!contract || contract.kind === 'interface' || contract.kind === 'library')
+            return;
+        for (const variable of declarationVariables(node)) {
+            if (typeof variable?.name === 'string' && variable.name) {
+                contract.stateVars.add(variable.name);
+            }
+        }
+    }
+    FunctionDefinition(node) {
+        this.currentFunction = null;
+        const contract = this.currentContract();
+        if (!contract || contract.kind === 'interface' || contract.kind === 'library')
+            return;
+        if (!(0, ast_1.isNode)(node, 'FunctionDefinition') || !node.body)
+            return;
+        const fn = {
+            contract,
+            name: functionName(node),
+            node,
+            externallyCallable: isExternallyCallable(node),
+            viewLike: isViewLike(node),
+            guarded: hasReentrancyGuard(node),
+            events: [],
+        };
+        contract.functions.set(fn.name, fn);
+        this.currentFunction = fn;
+    }
+    ['FunctionDefinition:exit']() {
+        this.currentFunction = null;
+    }
+    VariableDeclarationStatement(node) {
+        this.recordStatement(node);
+    }
+    ExpressionStatement(node) {
+        this.recordStatement(node);
+    }
+    ReturnStatement(node) {
+        this.recordStatement(node);
+    }
+    EmitStatement(node) {
+        this.recordStatement(node);
+    }
+    recordStatement(node) {
+        const fn = this.currentFunction;
+        if (!fn)
+            return;
+        const event = analyzeStatement(node, fn.contract.stateVars, fn.contract.functions);
+        if (event.priceSignal || event.settlementWrite || event.externalCallNode || event.internalCalls.size > 0) {
+            fn.events.push(event);
+        }
+    }
+    finalizeContract(contract) {
+        const summaryCache = new Map();
+        for (const fn of contract.functions.values()) {
+            if (!fn.externallyCallable || fn.viewLike || fn.guarded)
+                continue;
+            const result = analyzeEntrypoint(fn, summaryCache);
+            if (!result)
+                continue;
+            this.findings.push(this.buildFinding(fn, result.callNode));
+        }
+    }
+    buildFinding(fn, callNode) {
+        const loc = (0, ast_1.assertLoc)(callNode, fn.node);
+        return {
+            file: this.currentFile,
+            contract: fn.contract.name,
+            'function': fn.name,
+            line: loc.line,
+            endLine: loc.endLine,
+            column: loc.column,
+            endColumn: loc.endColumn,
+            ruleId: RULE_ID,
+            pattern: PATTERN,
+            severity: 'high',
+            confidence: 'medium',
+            category: 'reentrancy',
+            message: `Price-affecting state in '${fn.contract.name}.${fn.name}' is quoted before an external call and settled only after the reentrancy surface.`,
+            rationale: 'The function observes oracle, reserve, TWAP, or internal accounting state before an external interaction, then mutates settlement/accounting state after control can re-enter.',
+            suggestedFix: 'Finalize balance, reserve, share, collateral, or debt accounting before the external call, or protect the full entrypoint with a recognized non-reentrancy guard.',
+            findingId: '',
+            contractHash: '',
+            contractName: fn.contract.name,
+            functionName: fn.name,
+            sourceLocation: { line: loc.line, column: loc.column },
+        };
+    }
+    currentContract() {
+        return this.contracts[this.contracts.length - 1] || null;
+    }
+}
+exports.PriceManipulationReentrancyDetector = PriceManipulationReentrancyDetector;
+function analyzeEntrypoint(fn, summaryCache) {
+    let sawPriceBeforeCall = false;
+    let vulnerableCallNode = null;
+    for (const event of fn.events) {
+        const expanded = expandEvent(event, fn, summaryCache, new Set([fn.name]));
+        if (expanded.priceSignal)
+            sawPriceBeforeCall = true;
+        if (expanded.externalCallNode && sawPriceBeforeCall && !vulnerableCallNode) {
+            vulnerableCallNode = expanded.externalCallNode;
+        }
+        if (vulnerableCallNode && expanded.settlementWrite) {
+            return { callNode: vulnerableCallNode };
+        }
+    }
+    return null;
+}
+function summarizeFunction(fn, cache, seen) {
+    const cached = cache.get(fn.name);
+    if (cached)
+        return cached;
+    if (seen.has(fn.name))
+        return { priceSignal: false, settlementWrite: false, externalCall: false };
+    seen.add(fn.name);
+    const summary = { priceSignal: false, settlementWrite: false, externalCall: false };
+    for (const event of fn.events) {
+        const expanded = expandEvent(event, fn, cache, seen);
+        summary.priceSignal ||= expanded.priceSignal;
+        summary.settlementWrite ||= expanded.settlementWrite;
+        summary.externalCall ||= !!expanded.externalCallNode;
+    }
+    seen.delete(fn.name);
+    cache.set(fn.name, summary);
+    return summary;
+}
+function expandEvent(event, fn, cache, seen) {
+    const expanded = {
+        node: event.node,
+        priceSignal: event.priceSignal,
+        settlementWrite: event.settlementWrite,
+        externalCallNode: event.externalCallNode,
+        internalCalls: event.internalCalls,
+    };
+    for (const calleeName of event.internalCalls) {
+        const callee = fn.contract.functions.get(calleeName);
+        if (!callee || seen.has(callee.name))
+            continue;
+        const summary = summarizeFunction(callee, cache, seen);
+        expanded.priceSignal ||= summary.priceSignal;
+        expanded.settlementWrite ||= summary.settlementWrite;
+        if (!expanded.externalCallNode && summary.externalCall)
+            expanded.externalCallNode = event.node;
+    }
+    return expanded;
+}
+function analyzeStatement(node, stateVars, functions) {
+    const event = {
+        node,
+        priceSignal: false,
+        settlementWrite: false,
+        externalCallNode: null,
+        internalCalls: new Set(),
+    };
+    visitSubtree(node, child => {
+        if ((0, ast_1.isNode)(child, 'FunctionCall')) {
+            const call = classifyCall(child, functions);
+            if (call === 'internal') {
+                const name = directIdentifierName(unwrapCallExpression(child.expression));
+                if (name)
+                    event.internalCalls.add(name);
+            }
+            else if (call === 'external' && !event.externalCallNode) {
+                event.externalCallNode = child;
+            }
+            if (isPriceOracleCall(child))
+                event.priceSignal = true;
+        }
+        if ((0, ast_1.isNode)(child, 'BinaryOperation')) {
+            if (isAssignmentOperator(child.operator) && writesSettlementState(child.left, stateVars)) {
+                event.settlementWrite = true;
+            }
+            if (isPriceArithmetic(child, stateVars))
+                event.priceSignal = true;
+        }
+        if ((0, ast_1.isNode)(child, 'UnaryOperation') && writesSettlementState(child.subExpression, stateVars)) {
+            event.settlementWrite = true;
+        }
+        if ((0, ast_1.isNode)(child, 'Identifier') && stateVars.has(child.name) && isPriceStateName(child.name)) {
+            event.priceSignal = true;
+        }
+    });
+    return event;
+}
+function classifyCall(node, functions) {
+    const expression = unwrapCallExpression(node.expression);
+    const direct = directIdentifierName(expression);
+    if (direct) {
+        if (BUILTIN_CALLS.has(direct.toLowerCase()))
+            return 'builtin';
+        if (functions.has(direct))
+            return 'internal';
+        return 'builtin';
+    }
+    const member = memberName(expression);
+    if (!member)
+        return 'builtin';
+    const lower = member.toLowerCase();
+    if (EXTERNAL_MEMBERS.has(lower) || lower.startsWith('swap'))
+        return 'external';
+    return 'builtin';
+}
+function isPriceOracleCall(node) {
+    const member = memberName(unwrapCallExpression(node.expression));
+    if (!member)
+        return false;
+    const lower = member.toLowerCase();
+    return PRICE_ORACLE_MEMBERS.has(lower) || lower.includes('price') || lower.includes('reserve') || lower.includes('twap');
+}
+function isPriceArithmetic(node, stateVars) {
+    const operator = String(node.operator || '');
+    if (!['*', '/', '+', '-'].includes(operator))
+        return false;
+    const reads = collectIdentifiers(node).filter(name => stateVars.has(name));
+    const priceReads = reads.filter(isPriceStateName);
+    if (priceReads.length > 0)
+        return true;
+    return reads.filter(isSettlementStateName).length >= 2 && (operator === '*' || operator === '/');
+}
+function writesSettlementState(node, stateVars) {
+    const root = rootIdentifierName(node);
+    return !!root && stateVars.has(root) && isSettlementStateName(root);
+}
+function isSettlementStateName(name) {
+    const lower = name.toLowerCase();
+    return lower.includes('balance') ||
+        lower.includes('balances') ||
+        lower.includes('reserve') ||
+        lower.includes('collateral') ||
+        lower.includes('debt') ||
+        lower.includes('share') ||
+        lower.includes('supply') ||
+        lower.includes('totalasset') ||
+        lower.includes('totalliquidity') ||
+        lower.includes('accounting') ||
+        lower.includes('credit');
+}
+function isPriceStateName(name) {
+    const lower = name.toLowerCase();
+    return lower.includes('price') ||
+        lower.includes('oracle') ||
+        lower.includes('twap') ||
+        lower.includes('cumulative') ||
+        lower.includes('reserve') ||
+        lower.includes('liquidity') ||
+        lower.includes('totalasset') ||
+        lower.includes('totalshare') ||
+        lower.includes('exchange');
+}
+function isAssignmentOperator(operator) {
+    return ['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>='].includes(operator);
+}
+function unwrapCallExpression(expr) {
+    let current = expr;
+    while ((0, ast_1.isNode)(current, 'NameValueExpression')) {
+        current = current.expression;
+    }
+    return current;
+}
+function directIdentifierName(node) {
+    return (0, ast_1.isNode)(node, 'Identifier') && typeof node.name === 'string' ? node.name : '';
+}
+function memberName(node) {
+    return (0, ast_1.isNode)(node, 'MemberAccess') && typeof node.memberName === 'string' ? node.memberName : '';
+}
+function rootIdentifierName(node) {
+    let current = node;
+    while (current) {
+        if ((0, ast_1.isNode)(current, 'Identifier'))
+            return current.name || '';
+        if ((0, ast_1.isNode)(current, 'IndexAccess')) {
+            current = current.base;
+            continue;
+        }
+        if ((0, ast_1.isNode)(current, 'MemberAccess')) {
+            current = current.expression;
+            continue;
+        }
+        if ((0, ast_1.isNode)(current, 'TupleExpression')) {
+            const components = current.components || [];
+            for (const component of components) {
+                const name = rootIdentifierName(component);
+                if (name)
+                    return name;
+            }
+        }
+        return '';
+    }
+    return '';
+}
+function collectIdentifiers(node) {
+    const names = [];
+    visitSubtree(node, child => {
+        if ((0, ast_1.isNode)(child, 'Identifier') && typeof child.name === 'string')
+            names.push(child.name);
+    });
+    return names;
+}
+function visitSubtree(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const key of Object.keys(node)) {
+        if (key === 'loc' || key === 'range')
+            continue;
+        const value = node[key];
+        if (Array.isArray(value)) {
+            for (const child of value)
+                visitSubtree(child, visit);
+        }
+        else if (value && typeof value === 'object') {
+            visitSubtree(value, visit);
+        }
+    }
+}
+function declarationVariables(node) {
+    if (Array.isArray(node.variables))
+        return node.variables.filter(Boolean);
+    if (node.variables)
+        return [node.variables].filter(Boolean);
+    return [];
+}
+function functionName(node) {
+    if (typeof node.name === 'string' && node.name)
+        return node.name;
+    if (node.isConstructor)
+        return '<constructor>';
+    return '<fallback>';
+}
+function isExternallyCallable(node) {
+    const visibility = String(node.visibility || '').toLowerCase();
+    if (visibility === 'private' || visibility === 'internal')
+        return false;
+    return !node.isConstructor && String(node.kind || '').toLowerCase() !== 'constructor';
+}
+function isViewLike(node) {
+    const visibility = String(node.stateMutability || node.visibility || '').toLowerCase();
+    return visibility === 'view' || visibility === 'pure' || node.isDeclaredConst === true;
+}
+function hasReentrancyGuard(node) {
+    const modifiers = Array.isArray(node.modifiers) ? node.modifiers : [];
+    for (const modifier of modifiers) {
+        const name = modifierName(modifier).toLowerCase();
+        if (REENTRANCY_GUARD_NAMES.has(name) || name.includes('reentrancyguard'))
+            return true;
+    }
+    return false;
+}
+function modifierName(modifier) {
+    const name = modifier?.name;
+    if (typeof name === 'string')
+        return name;
+    if (typeof name?.name === 'string')
+        return name.name;
+    if (typeof modifier?.modifierName?.name === 'string')
+        return modifier.modifierName.name;
+    return '';
+}
+//# sourceMappingURL=price-manipulation-reentrancy.js.map

package/dist/detectors/price-manipulation-via-reentranc.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class PriceManipulationViaReentrancDetector {
+    readonly id = "price-manipulation-via-reentranc";
+    readonly patternKey = "price-manipulation-via-reentranc";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+}