@snovon/solast 0.2.0

package/dist/detectors/reentrancy-business-logic-game.js

@@ -0,0 +1,616 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReentrancyBusinessLogicGameDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'reentrancy-business-logic-game';
+const ASSIGN_OPS = new Set([
+    '=', '+=', '-=', '*=', '/=', '%=',
+    '&=', '|=', '^=', '<<=', '>>=', '>>>=',
+]);
+const UNARY_MUTATORS = new Set(['++', '--', 'delete']);
+const LOW_LEVEL_CALL_MEMBERS = new Set([
+    'call', 'delegatecall', 'staticcall', 'send', 'transfer',
+]);
+const BUILTIN_BASE_IDENTIFIERS = new Set([
+    'msg', 'block', 'tx', 'abi', 'super', 'this', 'address', 'payable',
+    'type', 'bytes', 'string', 'keccak256', 'sha256', 'ripemd160', 'ecrecover',
+    'assert', 'require', 'revert', 'gasleft',
+]);
+class ReentrancyBusinessLogicGameDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    currentFile = '';
+    typeKinds = {
+        interfaces: new Set(),
+        contracts: new Set(),
+        libraries: new Set(),
+        structs: new Set(),
+        enums: new Set(),
+    };
+    scanAst(ast, file) {
+        this.currentFile = file;
+        const results = [];
+        if (!ast || ast.type !== 'SourceUnit')
+            return results;
+        this.typeKinds = this.collectTypeKinds(ast);
+        const contractsByName = this.collectContractsByName(ast);
+        for (const child of ast.children || []) {
+            if (child?.type !== 'ContractDefinition')
+                continue;
+            if (child.kind === 'interface' || child.kind === 'library')
+                continue;
+            const stateVars = this.collectStateVariables(child, contractsByName);
+            const stateTypes = this.collectStateVarTypes(child, contractsByName);
+            const internalSummaries = this.summarizeInternalFunctions(child, stateVars, stateTypes);
+            for (const sub of child.subNodes || []) {
+                if (sub?.type !== 'FunctionDefinition')
+                    continue;
+                if (!sub.body)
+                    continue;
+                if (sub.isConstructor)
+                    continue;
+                if (sub.kind === 'constructor')
+                    continue;
+                const mutability = String(sub.stateMutability || '').toLowerCase();
+                if (mutability === 'view' || mutability === 'pure')
+                    continue;
+                const findings = this.analyzeFunction(child, sub, stateVars, stateTypes, internalSummaries);
+                results.push(...findings);
+            }
+        }
+        return results;
+    }
+    analyzeFunction(contract, fn, stateVars, stateTypes, internalSummaries) {
+        const localVars = this.collectLocals(fn);
+        const localTypes = this.collectLocalTypes(fn);
+        const state = {
+            sawInteraction: false,
+            sawStateCommit: false,
+            findingLocation: null,
+        };
+        const ctx = { stateVars, stateTypes, localVars, localTypes, internalSummaries };
+        this.walkForGameLogicCEI(fn.body, state, ctx, false);
+        const findings = [];
+        const fnName = fn.name || '<anonymous>';
+        if (state.findingLocation && !this.functionHasReentrancyGuard(fn)) {
+            findings.push(this.makeFinding(contract, fnName, state.findingLocation, `Reentrancy business-logic flaw in '${fnName}': an external interaction occurs before game or treasury state is committed, allowing re-entry to read stale accounting.`));
+        }
+        return findings;
+    }
+    walkForGameLogicCEI(node, state, ctx, effectsGuarded) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'EmitStatement')
+            return;
+        if (node.type === 'IfStatement') {
+            if (node.condition)
+                this.walkForGameLogicCEI(node.condition, state, ctx, effectsGuarded);
+            const trueBranchGuarded = effectsGuarded || (!!node.trueBody && this.blockEndsWithRevertOrThrow(node.trueBody));
+            const falseBranchGuarded = effectsGuarded || (!!node.falseBody && this.blockEndsWithRevertOrThrow(node.falseBody));
+            if (node.trueBody)
+                this.walkForGameLogicCEI(node.trueBody, state, ctx, trueBranchGuarded);
+            if (node.falseBody)
+                this.walkForGameLogicCEI(node.falseBody, state, ctx, falseBranchGuarded);
+            return;
+        }
+        if (node.type === 'VariableDeclarationStatement') {
+            if (node.initialValue)
+                this.walkForGameLogicCEI(node.initialValue, state, ctx, effectsGuarded);
+            return;
+        }
+        if (node.type === 'FunctionCall') {
+            const directName = this.getDirectCallName(node.expression);
+            if (directName === 'require' || directName === 'assert') {
+                for (const arg of node.arguments || []) {
+                    this.walkForGameLogicCEI(arg, state, ctx, effectsGuarded);
+                }
+                return;
+            }
+            if (this.isExternalCallExpression(node, ctx.stateVars, ctx.stateTypes, ctx.localVars, ctx.localTypes)) {
+                for (const arg of node.arguments || []) {
+                    this.walkForGameLogicCEI(arg, state, ctx, effectsGuarded);
+                }
+                state.sawInteraction = true;
+                return;
+            }
+            if (directName) {
+                const summary = ctx.internalSummaries.get(directName);
+                if (summary?.performsInteraction) {
+                    for (const arg of node.arguments || []) {
+                        this.walkForGameLogicCEI(arg, state, ctx, effectsGuarded);
+                    }
+                    state.sawInteraction = true;
+                    return;
+                }
+            }
+            for (const child of this.childNodes(node)) {
+                this.walkForGameLogicCEI(child, state, ctx, effectsGuarded);
+            }
+            return;
+        }
+        if (node.type === 'BinaryOperation' && ASSIGN_OPS.has(node.operator)) {
+            if (this.refersToStateStorage(node.left, ctx.stateVars, ctx.localVars)) {
+                if (node.right)
+                    this.walkForGameLogicCEI(node.right, state, ctx, effectsGuarded);
+                state.sawStateCommit = true;
+                if (state.sawInteraction && !state.findingLocation && !effectsGuarded) {
+                    state.findingLocation = this.locOf(node);
+                }
+                if (node.left)
+                    this.walkForGameLogicCEI(node.left, state, ctx, effectsGuarded);
+                return;
+            }
+        }
+        if (node.type === 'UnaryOperation' && UNARY_MUTATORS.has(node.operator)) {
+            if (this.refersToStateStorage(node.subExpression, ctx.stateVars, ctx.localVars)) {
+                state.sawStateCommit = true;
+                if (state.sawInteraction && !state.findingLocation && !effectsGuarded) {
+                    state.findingLocation = this.locOf(node);
+                }
+                return;
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.walkForGameLogicCEI(child, state, ctx, effectsGuarded);
+        }
+    }
+    isExternalCallExpression(call, stateVars, stateTypes, localVars, localTypes) {
+        let callee = call?.expression;
+        if (callee?.type === 'NameValueExpression')
+            callee = callee.expression;
+        if (callee?.type === 'MemberAccess') {
+            const member = String(callee.memberName || '').toLowerCase();
+            if (LOW_LEVEL_CALL_MEMBERS.has(member))
+                return true;
+            const baseName = this.simpleIdentifierName(callee.expression);
+            if (baseName) {
+                if (BUILTIN_BASE_IDENTIFIERS.has(baseName))
+                    return false;
+                if (stateVars.has(baseName)) {
+                    const cls = this.classifyBaseType(stateTypes.get(baseName));
+                    if (cls === 'safe')
+                        return false;
+                    return true;
+                }
+                if (localVars.has(baseName)) {
+                    const cls = this.classifyBaseType(localTypes.get(baseName));
+                    if (cls === 'safe')
+                        return false;
+                    return true;
+                }
+            }
+            else {
+                const baseExpr = callee.expression;
+                if (baseExpr?.type === 'FunctionCall' && Array.isArray(baseExpr.arguments) && baseExpr.arguments.length === 1) {
+                    const cls = this.classifyCastCallee(baseExpr.expression);
+                    if (cls === 'external')
+                        return true;
+                }
+            }
+        }
+        return false;
+    }
+    classifyCastCallee(expr) {
+        if (!expr || typeof expr !== 'object')
+            return 'unknown';
+        if (expr.type === 'ElementaryTypeName') {
+            const name = String(expr.name || '').toLowerCase();
+            return name === 'address' ? 'external' : 'safe';
+        }
+        if (expr.type === 'UserDefinedTypeName') {
+            return this.classifyBaseType(expr);
+        }
+        if (expr.type === 'Identifier') {
+            const name = String(expr.name || '');
+            if (this.typeKinds.interfaces.has(name))
+                return 'external';
+            if (this.typeKinds.contracts.has(name))
+                return 'external';
+            if (this.typeKinds.libraries.has(name))
+                return 'safe';
+            if (this.typeKinds.structs.has(name))
+                return 'safe';
+            if (this.typeKinds.enums.has(name))
+                return 'safe';
+            if (name === 'address' || name === 'payable')
+                return 'external';
+            return 'unknown';
+        }
+        return 'unknown';
+    }
+    classifyBaseType(typeName) {
+        if (!typeName || typeof typeName !== 'object')
+            return 'unknown';
+        if (typeName.type === 'ElementaryTypeName') {
+            const name = String(typeName.name || '').toLowerCase();
+            return name === 'address' ? 'external' : 'safe';
+        }
+        if (typeName.type === 'UserDefinedTypeName') {
+            const namePath = String(typeName.namePath || '');
+            const head = namePath.split('.')[0];
+            if (this.typeKinds.interfaces.has(head))
+                return 'external';
+            if (this.typeKinds.contracts.has(head))
+                return 'external';
+            if (this.typeKinds.libraries.has(head))
+                return 'safe';
+            if (this.typeKinds.structs.has(head))
+                return 'safe';
+            if (this.typeKinds.enums.has(head))
+                return 'safe';
+            return 'unknown';
+        }
+        if (typeName.type === 'ArrayTypeName' || typeName.type === 'Mapping' || typeName.type === 'FunctionTypeName') {
+            return 'safe';
+        }
+        return 'unknown';
+    }
+    refersToStateStorage(expr, stateVars, localVars) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (expr.type === 'Identifier') {
+            const name = String(expr.name || '');
+            if (localVars.has(name))
+                return false;
+            return stateVars.has(name);
+        }
+        if (expr.type === 'IndexAccess')
+            return this.refersToStateStorage(expr.base, stateVars, localVars);
+        if (expr.type === 'MemberAccess')
+            return this.refersToStateStorage(expr.expression, stateVars, localVars);
+        if (expr.type === 'TupleExpression') {
+            for (const c of expr.components || []) {
+                if (this.refersToStateStorage(c, stateVars, localVars))
+                    return true;
+            }
+        }
+        return false;
+    }
+    blockEndsWithRevertOrThrow(block) {
+        if (!block || typeof block !== 'object')
+            return false;
+        const stmts = block.type === 'Block' ? (block.statements || []) : [block];
+        for (const s of stmts) {
+            if (this.statementIsRevertOrThrow(s))
+                return true;
+        }
+        return false;
+    }
+    statementIsRevertOrThrow(stmt) {
+        if (!stmt || typeof stmt !== 'object')
+            return false;
+        if (stmt.type === 'RevertStatement')
+            return true;
+        if (stmt.type === 'ThrowStatement')
+            return true;
+        if (stmt.type === 'ExpressionStatement') {
+            const expr = stmt.expression;
+            if (expr?.type === 'FunctionCall') {
+                const name = this.getDirectCallName(expr.expression);
+                if (name === 'revert')
+                    return true;
+            }
+        }
+        return false;
+    }
+    summarizeInternalFunctions(contract, stateVars, stateTypes) {
+        const summaries = new Map();
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'FunctionDefinition')
+                continue;
+            if (!sub.body)
+                continue;
+            if (sub.isConstructor)
+                continue;
+            const name = sub.name;
+            if (!name)
+                continue;
+            const localVars = this.collectLocals(sub);
+            const localTypes = this.collectLocalTypes(sub);
+            const performsInteraction = this.bodyContainsExternalCall(sub.body, stateVars, stateTypes, localVars, localTypes);
+            summaries.set(name, { name, performsInteraction });
+        }
+        return summaries;
+    }
+    bodyContainsExternalCall(node, stateVars, stateTypes, localVars, localTypes) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'FunctionCall' && this.isExternalCallExpression(node, stateVars, stateTypes, localVars, localTypes)) {
+            return true;
+        }
+        for (const child of this.childNodes(node)) {
+            if (this.bodyContainsExternalCall(child, stateVars, stateTypes, localVars, localTypes))
+                return true;
+        }
+        return false;
+    }
+    functionHasReentrancyGuard(fn) {
+        const modifiers = fn?.modifiers || [];
+        for (const mod of modifiers) {
+            const name = String(mod?.name || '');
+            if (this.isReentrancyGuardModifierName(name))
+                return true;
+        }
+        return this.bodyHasInlineMutexPattern(fn?.body);
+    }
+    isReentrancyGuardModifierName(name) {
+        if (!name)
+            return false;
+        const exact = new Set([
+            'nonReentrant', '_nonReentrant', 'noReentrant',
+            'lock', 'locked', 'mutex',
+        ]);
+        if (exact.has(name))
+            return true;
+        const lower = name.toLowerCase();
+        if (lower.includes('reentran'))
+            return true;
+        if (lower.includes('mutex'))
+            return true;
+        return false;
+    }
+    bodyHasInlineMutexPattern(body) {
+        if (!body || body.type !== 'Block')
+            return false;
+        const stmts = body.statements || [];
+        const guardNames = new Set();
+        for (const stmt of stmts) {
+            if (stmt?.type !== 'ExpressionStatement')
+                continue;
+            const expr = stmt.expression;
+            if (expr?.type !== 'FunctionCall')
+                continue;
+            if (this.getDirectCallName(expr.expression) !== 'require')
+                continue;
+            const arg0 = expr.arguments?.[0];
+            if (arg0?.type !== 'UnaryOperation' || arg0.operator !== '!')
+                continue;
+            const guardName = this.simpleIdentifierName(arg0.subExpression);
+            if (guardName)
+                guardNames.add(guardName);
+        }
+        if (guardNames.size === 0)
+            return false;
+        for (const guardName of guardNames) {
+            let setTrue = false;
+            let setFalse = false;
+            for (const s of stmts) {
+                if (s?.type !== 'ExpressionStatement')
+                    continue;
+                const e = s.expression;
+                if (e?.type !== 'BinaryOperation' || e.operator !== '=')
+                    continue;
+                if (this.simpleIdentifierName(e.left) !== guardName)
+                    continue;
+                const lit = e.right;
+                if (lit?.type === 'BooleanLiteral') {
+                    if (lit.value === true)
+                        setTrue = true;
+                    else if (lit.value === false)
+                        setFalse = true;
+                }
+            }
+            if (setTrue && setFalse)
+                return true;
+        }
+        return false;
+    }
+    collectStateVariables(contract, contractsByName, visited = new Set()) {
+        const set = new Set();
+        const contractName = String(contract?.name || '');
+        if (contractName) {
+            if (visited.has(contractName))
+                return set;
+            visited.add(contractName);
+        }
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'StateVariableDeclaration')
+                continue;
+            for (const v of sub.variables || []) {
+                if (v?.name)
+                    set.add(v.name);
+            }
+        }
+        for (const base of contract.baseContracts || []) {
+            const baseName = this.baseContractName(base);
+            if (!baseName)
+                continue;
+            const baseContract = contractsByName.get(baseName);
+            if (!baseContract)
+                continue;
+            for (const name of this.collectStateVariables(baseContract, contractsByName, visited)) {
+                set.add(name);
+            }
+        }
+        return set;
+    }
+    collectStateVarTypes(contract, contractsByName, visited = new Set()) {
+        const map = new Map();
+        const contractName = String(contract?.name || '');
+        if (contractName) {
+            if (visited.has(contractName))
+                return map;
+            visited.add(contractName);
+        }
+        for (const sub of contract.subNodes || []) {
+            if (sub?.type !== 'StateVariableDeclaration')
+                continue;
+            for (const v of sub.variables || []) {
+                if (v?.name)
+                    map.set(v.name, v.typeName);
+            }
+        }
+        for (const base of contract.baseContracts || []) {
+            const baseName = this.baseContractName(base);
+            if (!baseName)
+                continue;
+            const baseContract = contractsByName.get(baseName);
+            if (!baseContract)
+                continue;
+            for (const [name, type] of this.collectStateVarTypes(baseContract, contractsByName, visited)) {
+                if (!map.has(name))
+                    map.set(name, type);
+            }
+        }
+        return map;
+    }
+    collectContractsByName(ast) {
+        const map = new Map();
+        for (const child of ast.children || []) {
+            if (child?.type === 'ContractDefinition' && child.name) {
+                map.set(child.name, child);
+            }
+        }
+        return map;
+    }
+    baseContractName(base) {
+        const namePath = base?.baseName?.namePath;
+        if (namePath)
+            return String(namePath).split('.').pop() || '';
+        const name = base?.baseName?.name;
+        if (name)
+            return String(name).split('.').pop() || '';
+        return '';
+    }
+    collectLocals(fn) {
+        const set = new Set();
+        for (const p of fn.parameters || []) {
+            if (p?.name)
+                set.add(p.name);
+        }
+        for (const p of fn.returnParameters || []) {
+            if (p?.name)
+                set.add(p.name);
+        }
+        this.harvestLocalsRecursive(fn.body, set);
+        return set;
+    }
+    collectLocalTypes(fn) {
+        const map = new Map();
+        for (const p of fn.parameters || []) {
+            if (p?.name)
+                map.set(p.name, p.typeName);
+        }
+        for (const p of fn.returnParameters || []) {
+            if (p?.name)
+                map.set(p.name, p.typeName);
+        }
+        this.harvestLocalTypesRecursive(fn.body, map);
+        return map;
+    }
+    harvestLocalsRecursive(node, set) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            for (const v of node.variables || []) {
+                if (v?.name)
+                    set.add(v.name);
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.harvestLocalsRecursive(child, set);
+        }
+    }
+    harvestLocalTypesRecursive(node, map) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            for (const v of node.variables || []) {
+                if (v?.name)
+                    map.set(v.name, v.typeName);
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.harvestLocalTypesRecursive(child, map);
+        }
+    }
+    collectTypeKinds(ast) {
+        const interfaces = new Set();
+        const contracts = new Set();
+        const libraries = new Set();
+        const structs = new Set();
+        const enums = new Set();
+        const visit = (children) => {
+            for (const node of children || []) {
+                if (!node || typeof node !== 'object')
+                    continue;
+                if (node.type === 'ContractDefinition' && node.name) {
+                    if (node.kind === 'interface')
+                        interfaces.add(node.name);
+                    else if (node.kind === 'library')
+                        libraries.add(node.name);
+                    else if (node.kind === 'contract')
+                        contracts.add(node.name);
+                    if (Array.isArray(node.subNodes))
+                        visit(node.subNodes);
+                }
+                else if (node.type === 'StructDefinition' && node.name) {
+                    structs.add(node.name);
+                }
+                else if (node.type === 'EnumDefinition' && node.name) {
+                    enums.add(node.name);
+                }
+            }
+        };
+        visit(ast.children);
+        return { interfaces, contracts, libraries, structs, enums };
+    }
+    getDirectCallName(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        if (expr.type === 'Identifier')
+            return String(expr.name || '');
+        return '';
+    }
+    simpleIdentifierName(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        if (expr.type === 'Identifier')
+            return String(expr.name || '');
+        return '';
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    childNodes(node) {
+        const out = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range' || key === 'typeName')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        out.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                out.push(value);
+            }
+        }
+        return out;
+    }
+    makeFinding(contract, functionName, loc, message) {
+        const contractName = contract?.name || '';
+        return {
+            file: this.currentFile,
+            contract: contractName,
+            'function': functionName,
+            line: loc.line,
+            column: loc.column,
+            pattern: RULE_ID,
+            confidence: 'high',
+            ruleId: RULE_ID,
+            severity: 'high',
+            message,
+            contractName,
+            functionName,
+            sourceLocation: { line: loc.line, column: loc.column },
+            findingId: '',
+            contractHash: '',
+        };
+    }
+}
+exports.ReentrancyBusinessLogicGameDetector = ReentrancyBusinessLogicGameDetector;
+//# sourceMappingURL=reentrancy-business-logic-game.js.map

package/dist/detectors/reentrancy-on-sell-nft.d.ts

@@ -0,0 +1,23 @@
+import type { ScanResult } from '../index';
+export declare class ReentrancyOnSellNftDetector {
+    readonly id = "reentrancy-on-sell-nft";
+    readonly patternKey = "reentrancy-on-sell-nft";
+    readonly supportedAstKinds: "parser"[];
+    readonly descriptor: {
+        id: string;
+        shortDescription: string;
+        helpUri: string;
+        defaultSeverity: "high";
+        help: string;
+    };
+    private file;
+    private findings;
+    private interfaceNames;
+    private contractStack;
+    private contractState;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(): void;
+    FunctionDefinition(node: any): void;
+}