@snovon/solast 0.2.0

package/dist/detectors/reentrancy-balance.js

@@ -0,0 +1,577 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReentrancyBalanceDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'reentrancy-balance';
+const PATTERN = `${RULE_ID}/balance-check-before-interaction`;
+const ASSIGN_OPS = new Set([
+    '=', '+=', '-=', '*=', '/=', '%=',
+    '&=', '|=', '^=', '<<=', '>>=', '>>>=',
+]);
+const UNARY_MUTATORS = new Set(['++', '--', 'delete']);
+const EXTERNAL_CALL_MEMBERS = new Set([
+    'call', 'delegatecall', 'staticcall', 'send', 'transfer',
+]);
+const BUILTIN_BASE_IDENTIFIERS = new Set([
+    'msg', 'block', 'tx', 'abi', 'this', 'super', 'address', 'payable',
+    'type', 'bytes', 'string', 'keccak256', 'sha256', 'ripemd160', 'ecrecover',
+    'assert', 'require', 'revert', 'gasleft',
+]);
+const INTERNAL_MEMBER_OPERATIONS = new Set(['push', 'pop']);
+class ReentrancyBalanceDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    typeKinds = {
+        interfaces: new Set(),
+        contracts: new Set(),
+        libraries: new Set(),
+        structs: new Set(),
+        enums: new Set(),
+    };
+    scanAst(ast, file) {
+        if (!ast || ast.type !== 'SourceUnit')
+            return [];
+        const findings = [];
+        this.typeKinds = this.collectTypeKinds(ast);
+        const contractsByName = this.collectContractsByName(ast);
+        for (const contract of ast.children || []) {
+            if (contract?.type !== 'ContractDefinition')
+                continue;
+            if (contract.kind === 'interface' || contract.kind === 'library')
+                continue;
+            const stateVars = this.collectStateVariables(contract, contractsByName);
+            const stateTypes = this.collectStateVarTypes(contract, contractsByName);
+            for (const fn of contract.subNodes || []) {
+                if (fn?.type !== 'FunctionDefinition')
+                    continue;
+                if (!fn.body)
+                    continue;
+                if (fn.isConstructor || fn.kind === 'constructor')
+                    continue;
+                const mutability = String(fn.stateMutability || '').toLowerCase();
+                if (mutability === 'view' || mutability === 'pure')
+                    continue;
+                const ctx = {
+                    stateVars,
+                    stateTypes,
+                    localVars: this.collectLocals(fn),
+                    localTypes: this.collectLocalTypes(fn),
+                    balanceAliases: new Set(),
+                };
+                const state = {
+                    balanceGuardActive: false,
+                    stateFinalized: false,
+                    findingLoc: null,
+                    externalCallNode: null,
+                };
+                this.walk(fn.body, state, ctx, false);
+                if (!state.findingLoc)
+                    continue;
+                const contractName = contract.name || '';
+                const functionName = fn.name || '<anonymous>';
+                findings.push({
+                    file,
+                    contract: contractName,
+                    'function': functionName,
+                    line: state.findingLoc.line,
+                    endLine: state.findingLoc.line,
+                    column: state.findingLoc.column,
+                    pattern: PATTERN,
+                    confidence: 'high',
+                    ruleId: RULE_ID,
+                    severity: 'high',
+                    message: `Function '${contractName}.${functionName}' uses a contract balance check before an external interaction without finalizing state first.`,
+                    rationale: 'A contract-balance-dependent branch or require() can be re-entered through the subsequent external interaction while accounting is still unchanged.',
+                    suggestedFix: 'Finalize caller/accounting state before the external interaction, or guard the entry point with a proven nonReentrant modifier.',
+                    contractName,
+                    functionName,
+                    sourceLocation: { line: state.findingLoc.line, column: state.findingLoc.column },
+                    externalCallNode: state.externalCallNode,
+                    trace: 'balance-check-before-interaction',
+                    findingId: '',
+                    contractHash: '',
+                });
+            }
+        }
+        return findings;
+    }
+    walk(node, state, ctx, writeContext) {
+        if (!node || typeof node !== 'object' || state.findingLoc)
+            return;
+        if (node.type === 'EmitStatement')
+            return;
+        if (node.type === 'IfStatement') {
+            const conditionIsBalanceGuard = this.containsBalanceGuard(node.condition, ctx);
+            const guardKind = this.classifyBalanceGuardCondition(node.condition, ctx);
+            this.walk(node.condition, state, ctx, false);
+            if (node.trueBody) {
+                const branchState = { ...state, balanceGuardActive: state.balanceGuardActive || conditionIsBalanceGuard };
+                this.walk(node.trueBody, branchState, ctx, false);
+                this.copyFinding(state, branchState);
+            }
+            if (!state.findingLoc && node.falseBody) {
+                const falseBranchIsProtected = guardKind === 'negative' && this.bodyTerminates(node.trueBody);
+                const branchState = { ...state, balanceGuardActive: state.balanceGuardActive || falseBranchIsProtected };
+                this.walk(node.falseBody, branchState, ctx, false);
+                this.copyFinding(state, branchState);
+                if (!state.findingLoc && falseBranchIsProtected && !this.bodyTerminates(node.falseBody)) {
+                    state.balanceGuardActive = branchState.balanceGuardActive;
+                    state.stateFinalized = branchState.stateFinalized;
+                }
+            }
+            else if (!state.findingLoc && guardKind === 'negative' && this.bodyTerminates(node.trueBody)) {
+                state.balanceGuardActive = true;
+                state.stateFinalized = false;
+            }
+            return;
+        }
+        if (node.type === 'FunctionCall') {
+            const directName = this.getDirectCallName(node.expression);
+            if (directName === 'require' || directName === 'assert') {
+                if (this.containsBalanceGuard((node.arguments || [])[0], ctx)) {
+                    state.balanceGuardActive = true;
+                    state.stateFinalized = false;
+                }
+                for (const arg of node.arguments || [])
+                    this.walk(arg, state, ctx, false);
+                return;
+            }
+            if (this.isExternalCall(node, ctx)) {
+                for (const arg of node.arguments || [])
+                    this.walk(arg, state, ctx, false);
+                if (state.balanceGuardActive && !state.stateFinalized && !state.findingLoc) {
+                    state.findingLoc = this.locOf(node);
+                    state.externalCallNode = node;
+                }
+                return;
+            }
+        }
+        if (node.type === 'VariableDeclarationStatement') {
+            if (node.initialValue && this.containsContractBalanceRead(node.initialValue, ctx)) {
+                for (const v of node.variables || []) {
+                    if (v?.name)
+                        ctx.balanceAliases.add(String(v.name));
+                }
+            }
+            this.walk(node.initialValue, state, ctx, false);
+            return;
+        }
+        if (node.type === 'BinaryOperation' && ASSIGN_OPS.has(String(node.operator || ''))) {
+            const left = node.left;
+            const right = node.right;
+            this.walk(right, state, ctx, false);
+            if (this.refersToStateStorage(left, ctx)) {
+                state.stateFinalized = true;
+            }
+            this.walk(left, state, ctx, true);
+            return;
+        }
+        if (node.type === 'UnaryOperation' && UNARY_MUTATORS.has(String(node.operator || ''))) {
+            if (this.refersToStateStorage(node.subExpression, ctx)) {
+                state.stateFinalized = true;
+            }
+            return;
+        }
+        for (const child of this.childNodes(node)) {
+            this.walk(child, state, ctx, writeContext);
+            if (state.findingLoc)
+                return;
+        }
+    }
+    copyFinding(target, source) {
+        if (source.findingLoc && !target.findingLoc) {
+            target.findingLoc = source.findingLoc;
+            target.externalCallNode = source.externalCallNode;
+        }
+    }
+    containsBalanceGuard(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (this.containsContractBalanceRead(node, ctx))
+            return true;
+        if (node.type === 'Identifier' && ctx.balanceAliases.has(String(node.name || '')))
+            return true;
+        for (const child of this.childNodes(node)) {
+            if (this.containsBalanceGuard(child, ctx))
+                return true;
+        }
+        return false;
+    }
+    classifyBalanceGuardCondition(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return 'unknown';
+        if (node.type !== 'BinaryOperation')
+            return 'unknown';
+        const operator = String(node.operator || '');
+        if (!['<', '<=', '>', '>='].includes(operator))
+            return 'unknown';
+        const leftHasBalance = this.containsBalanceGuard(node.left, ctx);
+        const rightHasBalance = this.containsBalanceGuard(node.right, ctx);
+        if (leftHasBalance === rightHasBalance)
+            return 'unknown';
+        if (leftHasBalance) {
+            return operator === '<' || operator === '<=' ? 'negative' : 'positive';
+        }
+        return operator === '<' || operator === '<=' ? 'positive' : 'negative';
+    }
+    bodyTerminates(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'ReturnStatement' || node.type === 'RevertStatement')
+            return true;
+        if (node.type === 'ExpressionStatement') {
+            return this.getDirectCallName(node.expression?.expression) === 'revert';
+        }
+        if (node.type === 'Block') {
+            const statements = node.statements || [];
+            return statements.length > 0 && this.bodyTerminates(statements[statements.length - 1]);
+        }
+        return false;
+    }
+    containsContractBalanceRead(node, ctx) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'MemberAccess' && String(node.memberName || '') === 'balance') {
+            if (this.isThisAddress(node.expression))
+                return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.containsContractBalanceRead(child, ctx))
+                return true;
+        }
+        return false;
+    }
+    isThisAddress(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (expr.type === 'Identifier' && expr.name === 'this')
+            return true;
+        if (expr.type !== 'FunctionCall')
+            return false;
+        const callee = expr.expression;
+        if (!((callee?.type === 'ElementaryTypeName' || callee?.type === 'Identifier') &&
+            String(callee.name || '').toLowerCase() === 'address')) {
+            return false;
+        }
+        const arg = (expr.arguments || [])[0];
+        return arg?.type === 'Identifier' && arg.name === 'this';
+    }
+    isExternalCall(call, ctx) {
+        let callee = call?.expression;
+        while (callee?.type === 'NameValueExpression' || callee?.type === 'FunctionCallOptions') {
+            callee = callee.expression;
+        }
+        if (callee?.type !== 'MemberAccess')
+            return false;
+        const member = String(callee.memberName || '').toLowerCase();
+        if (EXTERNAL_CALL_MEMBERS.has(member))
+            return true;
+        if (this.isKnownInternalMemberCall(member, callee.expression, ctx))
+            return false;
+        const baseName = this.simpleIdentifierName(callee.expression);
+        if (baseName) {
+            if (BUILTIN_BASE_IDENTIFIERS.has(baseName))
+                return false;
+            if (ctx.stateVars.has(baseName) && !ctx.localVars.has(baseName)) {
+                return this.classifyBaseType(ctx.stateTypes.get(baseName)) === 'external';
+            }
+            if (ctx.localVars.has(baseName)) {
+                return this.classifyBaseType(ctx.localTypes.get(baseName)) === 'external';
+            }
+            return false;
+        }
+        if (callee.expression?.type === 'FunctionCall' && Array.isArray(callee.expression.arguments) && callee.expression.arguments.length === 1) {
+            return this.classifyCastCallee(callee.expression.expression) === 'external';
+        }
+        return false;
+    }
+    isKnownInternalMemberCall(member, base, ctx) {
+        if (INTERNAL_MEMBER_OPERATIONS.has(member)) {
+            return this.classifyBaseType(this.typeForExpressionBase(base, ctx)) !== 'external';
+        }
+        if (/^tou?int\d*$/i.test(member)) {
+            return this.baseLooksNumeric(base, ctx);
+        }
+        return false;
+    }
+    baseLooksNumeric(expr, ctx) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (expr.type === 'Identifier') {
+            const name = String(expr.name || '');
+            if (this.isNumericTypeName(ctx.localTypes.get(name) || ctx.stateTypes.get(name)))
+                return true;
+            return /^(amount|value|balance|supply|shares|assets|total|count|index|id|fee|rate|price|limit|nonce)$/i.test(name);
+        }
+        if (expr.type === 'NumberLiteral' || expr.type === 'DecimalNumber' || expr.type === 'HexNumber') {
+            return true;
+        }
+        return false;
+    }
+    typeForExpressionBase(expr, ctx) {
+        const name = this.simpleIdentifierName(expr);
+        if (!name)
+            return null;
+        if (ctx.localTypes.has(name))
+            return ctx.localTypes.get(name);
+        if (ctx.stateTypes.has(name))
+            return ctx.stateTypes.get(name);
+        return null;
+    }
+    classifyCastCallee(expr) {
+        if (!expr || typeof expr !== 'object')
+            return 'unknown';
+        if (expr.type === 'ElementaryTypeName') {
+            const name = String(expr.name || '').toLowerCase();
+            return name === 'address' ? 'external' : 'safe';
+        }
+        if (expr.type === 'UserDefinedTypeName')
+            return this.classifyBaseType(expr);
+        if (expr.type === 'Identifier') {
+            const name = String(expr.name || '');
+            if (name === 'address' || name === 'payable')
+                return 'external';
+            if (this.typeKinds.interfaces.has(name) || this.typeKinds.contracts.has(name))
+                return 'external';
+            if (this.typeKinds.libraries.has(name) || this.typeKinds.structs.has(name) || this.typeKinds.enums.has(name))
+                return 'safe';
+        }
+        return 'unknown';
+    }
+    classifyBaseType(typeName) {
+        if (!typeName || typeof typeName !== 'object')
+            return 'unknown';
+        if (typeName.type === 'ElementaryTypeName') {
+            const name = String(typeName.name || '').toLowerCase();
+            return name === 'address' ? 'external' : 'safe';
+        }
+        if (typeName.type === 'UserDefinedTypeName') {
+            const namePath = String(typeName.namePath || typeName.name || '');
+            const head = namePath.split('.')[0];
+            if (this.typeKinds.interfaces.has(head) || this.typeKinds.contracts.has(head))
+                return 'external';
+            if (this.typeKinds.libraries.has(head) || this.typeKinds.structs.has(head) || this.typeKinds.enums.has(head))
+                return 'safe';
+            return 'unknown';
+        }
+        if (typeName.type === 'ArrayTypeName' || typeName.type === 'Mapping' || typeName.type === 'FunctionTypeName') {
+            return 'safe';
+        }
+        return 'unknown';
+    }
+    isNumericTypeName(typeName) {
+        if (!typeName || typeof typeName !== 'object')
+            return false;
+        if (typeName.type !== 'ElementaryTypeName')
+            return false;
+        return /^(u?int)([0-9]+)?$/.test(String(typeName.name || '').toLowerCase());
+    }
+    refersToStateStorage(expr, ctx) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (expr.type === 'Identifier') {
+            const name = String(expr.name || '');
+            return ctx.stateVars.has(name) && !ctx.localVars.has(name);
+        }
+        if (expr.type === 'IndexAccess')
+            return this.refersToStateStorage(expr.base, ctx);
+        if (expr.type === 'MemberAccess')
+            return this.refersToStateStorage(expr.expression, ctx);
+        if (expr.type === 'TupleExpression') {
+            return (expr.components || []).some((c) => this.refersToStateStorage(c, ctx));
+        }
+        return false;
+    }
+    collectStateVariables(contract, contractsByName, visited = new Set()) {
+        const set = new Set();
+        const contractName = String(contract?.name || '');
+        if (contractName) {
+            if (visited.has(contractName))
+                return set;
+            visited.add(contractName);
+        }
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'StateVariableDeclaration')
+                continue;
+            for (const v of sub.variables || []) {
+                if (v?.name)
+                    set.add(String(v.name));
+            }
+        }
+        for (const base of contract.baseContracts || []) {
+            const baseName = this.baseContractName(base);
+            if (!baseName)
+                continue;
+            const baseContract = contractsByName.get(baseName);
+            if (!baseContract)
+                continue;
+            for (const name of this.collectStateVariables(baseContract, contractsByName, visited)) {
+                set.add(name);
+            }
+        }
+        return set;
+    }
+    collectStateVarTypes(contract, contractsByName, visited = new Set()) {
+        const map = new Map();
+        const contractName = String(contract?.name || '');
+        if (contractName) {
+            if (visited.has(contractName))
+                return map;
+            visited.add(contractName);
+        }
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'StateVariableDeclaration')
+                continue;
+            for (const v of sub.variables || []) {
+                if (v?.name)
+                    map.set(String(v.name), v.typeName);
+            }
+        }
+        for (const base of contract.baseContracts || []) {
+            const baseName = this.baseContractName(base);
+            if (!baseName)
+                continue;
+            const baseContract = contractsByName.get(baseName);
+            if (!baseContract)
+                continue;
+            for (const [name, type] of this.collectStateVarTypes(baseContract, contractsByName, visited)) {
+                if (!map.has(name))
+                    map.set(name, type);
+            }
+        }
+        return map;
+    }
+    collectContractsByName(ast) {
+        const map = new Map();
+        for (const child of ast.children || []) {
+            if (child?.type === 'ContractDefinition' && child.name) {
+                map.set(String(child.name), child);
+            }
+        }
+        return map;
+    }
+    baseContractName(base) {
+        const namePath = base?.baseName?.namePath;
+        if (namePath)
+            return String(namePath).split('.').pop() || '';
+        const name = base?.baseName?.name;
+        if (name)
+            return String(name).split('.').pop() || '';
+        return '';
+    }
+    collectLocals(fn) {
+        const set = new Set();
+        for (const p of fn.parameters || []) {
+            if (p?.name)
+                set.add(String(p.name));
+        }
+        for (const p of fn.returnParameters || []) {
+            if (p?.name)
+                set.add(String(p.name));
+        }
+        this.harvestLocals(fn.body, set);
+        return set;
+    }
+    collectLocalTypes(fn) {
+        const map = new Map();
+        for (const p of fn.parameters || []) {
+            if (p?.name)
+                map.set(String(p.name), p.typeName);
+        }
+        for (const p of fn.returnParameters || []) {
+            if (p?.name)
+                map.set(String(p.name), p.typeName);
+        }
+        this.harvestLocalTypes(fn.body, map);
+        return map;
+    }
+    harvestLocals(node, set) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            for (const v of node.variables || []) {
+                if (v?.name)
+                    set.add(String(v.name));
+            }
+        }
+        for (const child of this.childNodes(node))
+            this.harvestLocals(child, set);
+    }
+    harvestLocalTypes(node, map) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            for (const v of node.variables || []) {
+                if (v?.name)
+                    map.set(String(v.name), v.typeName);
+            }
+        }
+        for (const child of this.childNodes(node))
+            this.harvestLocalTypes(child, map);
+    }
+    collectTypeKinds(ast) {
+        const interfaces = new Set();
+        const contracts = new Set();
+        const libraries = new Set();
+        const structs = new Set();
+        const enums = new Set();
+        const visit = (children) => {
+            for (const node of children || []) {
+                if (!node || typeof node !== 'object')
+                    continue;
+                if (node.type === 'ContractDefinition' && node.name) {
+                    if (node.kind === 'interface')
+                        interfaces.add(String(node.name));
+                    else if (node.kind === 'library')
+                        libraries.add(String(node.name));
+                    else if (node.kind === 'contract')
+                        contracts.add(String(node.name));
+                    if (Array.isArray(node.subNodes))
+                        visit(node.subNodes);
+                }
+                else if (node.type === 'StructDefinition' && node.name) {
+                    structs.add(String(node.name));
+                }
+                else if (node.type === 'EnumDefinition' && node.name) {
+                    enums.add(String(node.name));
+                }
+            }
+        };
+        visit(ast.children);
+        return { interfaces, contracts, libraries, structs, enums };
+    }
+    getDirectCallName(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        return expr.type === 'Identifier' ? String(expr.name || '') : '';
+    }
+    simpleIdentifierName(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        return expr.type === 'Identifier' ? String(expr.name || '') : '';
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    childNodes(node) {
+        const out = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range' || key === 'typeName')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        out.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                out.push(value);
+            }
+        }
+        return out;
+    }
+}
+exports.ReentrancyBalanceDetector = ReentrancyBalanceDetector;
+//# sourceMappingURL=reentrancy-balance.js.map

package/dist/detectors/reentrancy-business-logic-game.d.ts

@@ -0,0 +1,36 @@
+import type { ScanResult } from '../index';
+export declare class ReentrancyBusinessLogicGameDetector {
+    readonly id = "reentrancy-business-logic-game";
+    readonly patternKey = "reentrancy-business-logic-game";
+    readonly supportedAstKinds: "parser"[];
+    private currentFile;
+    private typeKinds;
+    scanAst(ast: any, file: string): ScanResult[];
+    private analyzeFunction;
+    private walkForGameLogicCEI;
+    private isExternalCallExpression;
+    private classifyCastCallee;
+    private classifyBaseType;
+    private refersToStateStorage;
+    private blockEndsWithRevertOrThrow;
+    private statementIsRevertOrThrow;
+    private summarizeInternalFunctions;
+    private bodyContainsExternalCall;
+    private functionHasReentrancyGuard;
+    private isReentrancyGuardModifierName;
+    private bodyHasInlineMutexPattern;
+    private collectStateVariables;
+    private collectStateVarTypes;
+    private collectContractsByName;
+    private baseContractName;
+    private collectLocals;
+    private collectLocalTypes;
+    private harvestLocalsRecursive;
+    private harvestLocalTypesRecursive;
+    private collectTypeKinds;
+    private getDirectCallName;
+    private simpleIdentifierName;
+    private locOf;
+    private childNodes;
+    private makeFinding;
+}