@snovon/solast 0.2.0

package/dist/detectors/reentrancy-on-sell-nft.js

@@ -0,0 +1,510 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReentrancyOnSellNftDetector = void 0;
+const ast_1 = require("./_common/ast");
+const access_control_1 = require("./_common/access-control");
+const RULE_ID = 'reentrancy-on-sell-nft';
+const PATTERN = `${RULE_ID}/callback-before-listing-consumed`;
+const SOURCE = 'x-20250221-stepheronfts-reentrancy-on-sell-nft';
+const MARKETPLACE_ENTRYPOINTS = new Set([
+    'sellnft',
+    'sell',
+    'buynft',
+    'buy',
+    'buylisting',
+    'purchase',
+    'acceptoffer',
+    'fillorder',
+]);
+const ORDER_STATE_NAMES = new Set([
+    'listing',
+    'listings',
+    'offer',
+    'offers',
+    'order',
+    'orders',
+    'filled',
+    'fills',
+    'fill',
+    'active',
+    'sold',
+    'nonce',
+    'nonces',
+    'executed',
+    'cancelled',
+    'canceled',
+]);
+const CALLBACK_TRANSFER_MEMBERS = new Set(['safeTransferFrom', 'safeBatchTransferFrom']);
+const VALUE_TRANSFER_MEMBERS = new Set(['call', 'transfer', 'send']);
+const REENTRANCY_GUARD_NAMES = new Set([
+    'nonreentrant',
+    'nonreentrantview',
+    'noreentrant',
+    'reentrancyguard',
+    'noreentry',
+    'nonreentrantcall',
+]);
+class ReentrancyOnSellNftDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'NFT sale/listing state is consumed after a callback-capable transfer.',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'high',
+        help: 'Move listing/order consumption before ERC721/ERC1155 safe transfers or value sends, or protect the marketplace entrypoint with a reentrancy guard.',
+    };
+    file = '';
+    findings = [];
+    interfaceNames = new Set();
+    contractStack = [];
+    contractState = new WeakMap();
+    setFile(file) {
+        this.file = file;
+        this.findings = [];
+        this.interfaceNames = new Set();
+        this.contractStack = [];
+        this.contractState = new WeakMap();
+    }
+    getFindings() {
+        return this.findings;
+    }
+    ContractDefinition(node) {
+        if (String(node?.kind || '').toLowerCase() === 'interface' && node?.name) {
+            this.interfaceNames.add(String(node.name));
+        }
+        this.contractStack.push(node);
+        if (!isConcreteContract(node))
+            return;
+        const stateTypes = collectStateTypes(node);
+        const stateNames = collectOrderStateNames(stateTypes);
+        const internalSummaries = summarizeInternalFunctions(node, this.interfaceNames, stateTypes);
+        this.contractState.set(node, { stateNames, stateTypes, internalSummaries });
+    }
+    ContractDefinition_post() {
+        this.contractStack.pop();
+    }
+    FunctionDefinition(node) {
+        const contract = this.contractStack[this.contractStack.length - 1];
+        if (!contract || !isConcreteContract(contract))
+            return;
+        if (!isExternallyReachableFunction(node) || isViewOrPure(node) || !node.body)
+            return;
+        if (hasReentrancyGuard(node) || (0, access_control_1.hasRecognisedAccessControlModifier)(node))
+            return;
+        const state = this.contractState.get(contract);
+        if (!state || state.stateNames.size === 0)
+            return;
+        if (!looksLikeMarketplaceEntrypoint(node, state.stateNames))
+            return;
+        const ctx = {
+            stateNames: state.stateNames,
+            typeNames: mergeTypes(state.stateTypes, collectLocalTypes(node)),
+            storageAliases: new Map(),
+            internalSummaries: state.internalSummaries,
+            sawInteraction: false,
+            interactionLoc: null,
+            interactionNode: null,
+            consumedBeforeInteraction: new Set(),
+            consumedAfterInteraction: null,
+        };
+        walkOrdered(node.body, ctx, this.interfaceNames, false);
+        if (!ctx.interactionLoc || !ctx.interactionNode || !ctx.consumedAfterInteraction)
+            return;
+        const contractName = String(contract.name || '');
+        const functionName = String(node.name || '<anonymous>');
+        this.findings.push({
+            file: this.file,
+            contract: contractName,
+            'function': functionName,
+            line: ctx.interactionLoc.line,
+            column: ctx.interactionLoc.column,
+            pattern: PATTERN,
+            confidence: 'high',
+            ruleId: RULE_ID,
+            severity: 'high',
+            message: `NFT marketplace flow '${contractName}.${functionName}' performs a callback-capable transfer before consuming listing/order state '${ctx.consumedAfterInteraction}'.`,
+            rationale: 'The stepheronfts-style sale flow lets ERC721/ERC1155 receiver callbacks or value-call fallback code run while the listing/order remains live.',
+            suggestedFix: `Consume '${ctx.consumedAfterInteraction}' before the transfer/value send, or protect the entrypoint with nonReentrant.`,
+            contractName,
+            functionName,
+            sourceLocation: { line: ctx.interactionLoc.line, column: ctx.interactionLoc.column },
+            externalCallNode: ctx.interactionNode,
+            stateVariable: ctx.consumedAfterInteraction,
+            operationType: 'nft-sale-callback-before-listing-consumed',
+            findingId: '',
+            contractHash: '',
+            source: SOURCE,
+        });
+    }
+}
+exports.ReentrancyOnSellNftDetector = ReentrancyOnSellNftDetector;
+function walkOrdered(node, ctx, interfaceNames, isWriteContext) {
+    if (!node || typeof node !== 'object' || ctx.consumedAfterInteraction)
+        return;
+    if ((0, ast_1.isNode)(node, 'EmitStatement'))
+        return;
+    if ((0, ast_1.isNode)(node, 'Block') || (0, ast_1.isNode)(node, 'UncheckedBlock')) {
+        for (const stmt of node.statements || [])
+            walkOrdered(stmt, ctx, interfaceNames, false);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'ExpressionStatement')) {
+        walkOrdered(node.expression, ctx, interfaceNames, false);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'VariableDeclarationStatement')) {
+        registerStorageAlias(node, ctx);
+        if (node.initialValue)
+            walkOrdered(node.initialValue, ctx, interfaceNames, false);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'IfStatement')) {
+        walkOrdered(node.condition, ctx, interfaceNames, false);
+        walkOrdered(node.trueBody, ctx, interfaceNames, false);
+        walkOrdered(node.falseBody, ctx, interfaceNames, false);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'ForStatement')) {
+        walkOrdered(node.initExpression || node.initializationExpression, ctx, interfaceNames, false);
+        walkOrdered(node.conditionExpression || node.condition, ctx, interfaceNames, false);
+        walkOrdered(node.body, ctx, interfaceNames, false);
+        walkOrdered(node.loopExpression, ctx, interfaceNames, false);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'WhileStatement') || (0, ast_1.isNode)(node, 'DoWhileStatement')) {
+        walkOrdered(node.condition, ctx, interfaceNames, false);
+        walkOrdered(node.body, ctx, interfaceNames, false);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'BinaryOperation') && isMutationOperator(node.operator)) {
+        if (node.right)
+            walkOrdered(node.right, ctx, interfaceNames, false);
+        handleOrderConsumption(node.left, ctx);
+        walkOrdered(node.left, ctx, interfaceNames, true);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'UnaryOperation') && isMutationOperator(node.operator)) {
+        const target = node.subExpression || node.expression;
+        handleOrderConsumption(target, ctx);
+        walkOrdered(target, ctx, interfaceNames, true);
+        return;
+    }
+    if ((0, ast_1.isNode)(node, 'FunctionCall')) {
+        if (isCallbackCapableInteraction(node, ctx.typeNames, interfaceNames)
+            || isInternalCallbackInteraction(node, ctx.internalSummaries)) {
+            markInteraction(node, ctx);
+            for (const arg of node.arguments || [])
+                walkOrdered(arg, ctx, interfaceNames, false);
+            return;
+        }
+    }
+    if (((0, ast_1.isNode)(node, 'IndexAccess') || (0, ast_1.isNode)(node, 'MemberAccess') || (0, ast_1.isNode)(node, 'Identifier')) && isWriteContext) {
+        handleOrderConsumption(node, ctx);
+    }
+    for (const child of childNodes(node))
+        walkOrdered(child, ctx, interfaceNames, isWriteContext);
+}
+function markInteraction(node, ctx) {
+    if (ctx.sawInteraction)
+        return;
+    ctx.sawInteraction = true;
+    const loc = (0, ast_1.assertLoc)(node);
+    ctx.interactionLoc = { line: loc.line, column: loc.column };
+    ctx.interactionNode = node;
+}
+function handleOrderConsumption(expr, ctx) {
+    const stateName = orderStateNameFromExpression(expr, ctx.stateNames, ctx.storageAliases);
+    if (!stateName)
+        return;
+    if (ctx.sawInteraction) {
+        if (!ctx.consumedBeforeInteraction.has(stateName))
+            ctx.consumedAfterInteraction = stateName;
+    }
+    else {
+        ctx.consumedBeforeInteraction.add(stateName);
+    }
+}
+function registerStorageAlias(node, ctx) {
+    const variables = node.variables || [];
+    if (variables.length !== 1)
+        return;
+    const variable = variables[0];
+    if (!variable?.name || String(variable.storageLocation || '').toLowerCase() !== 'storage')
+        return;
+    const stateName = orderStateNameFromExpression(node.initialValue, ctx.stateNames, ctx.storageAliases);
+    if (stateName)
+        ctx.storageAliases.set(String(variable.name), stateName);
+}
+function isCallbackCapableInteraction(call, typeNames, interfaceNames) {
+    const callee = unwrapCallOptions(call.expression);
+    if (!(0, ast_1.isNode)(callee, 'MemberAccess'))
+        return false;
+    const member = String(callee.memberName || '');
+    if (CALLBACK_TRANSFER_MEMBERS.has(member)) {
+        return isNftExpression(callee.expression, typeNames, interfaceNames);
+    }
+    if (!VALUE_TRANSFER_MEMBERS.has(member))
+        return false;
+    if (member === 'call')
+        return callHasValueOption(call.expression);
+    return true;
+}
+function isInternalCallbackInteraction(call, summaries) {
+    const name = directCallName(call.expression);
+    return !!name && summaries.get(name)?.callbackCapableInteraction === true;
+}
+function summarizeInternalFunctions(contract, interfaceNames, stateTypes) {
+    const summaries = new Map();
+    for (const fn of contract.subNodes || []) {
+        if (!isFunction(fn) || !fn.body || !fn.name)
+            continue;
+        if (isExternallyReachableFunction(fn))
+            continue;
+        const typeNames = mergeTypes(stateTypes, collectLocalTypes(fn));
+        summaries.set(String(fn.name), {
+            callbackCapableInteraction: containsCallbackCapableInteraction(fn.body, typeNames, interfaceNames),
+        });
+    }
+    return summaries;
+}
+function containsCallbackCapableInteraction(node, typeNames, interfaceNames) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if ((0, ast_1.isNode)(node, 'FunctionCall') && isCallbackCapableInteraction(node, typeNames, interfaceNames))
+        return true;
+    for (const child of childNodes(node)) {
+        if (containsCallbackCapableInteraction(child, typeNames, interfaceNames))
+            return true;
+    }
+    return false;
+}
+function looksLikeMarketplaceEntrypoint(fn, stateNames) {
+    const name = normalizeName(String(fn.name || ''));
+    if (MARKETPLACE_ENTRYPOINTS.has(name))
+        return true;
+    if (name.startsWith('sell') || name.startsWith('buy') || name.startsWith('purchase')
+        || name.startsWith('acceptoffer') || name.startsWith('fillorder')) {
+        return true;
+    }
+    if ([...stateNames].some((stateName) => ORDER_STATE_NAMES.has(normalizeName(stateName)))) {
+        return hasNftOrTokenIdParameter(fn);
+    }
+    return false;
+}
+function hasNftOrTokenIdParameter(fn) {
+    let hasTokenId = false;
+    let hasNftType = false;
+    for (const param of fn.parameters || []) {
+        const paramName = normalizeName(String(param?.name || ''));
+        const typeName = typeNameName(param?.typeName).toLowerCase();
+        if (paramName === 'tokenid' && typeName.includes('uint'))
+            hasTokenId = true;
+        if (/(erc721|erc1155)/i.test(typeName))
+            hasNftType = true;
+    }
+    return hasTokenId || hasNftType;
+}
+function collectStateTypes(contract) {
+    const out = new Map();
+    for (const member of contract.subNodes || []) {
+        if (!(0, ast_1.isNode)(member, 'StateVariableDeclaration'))
+            continue;
+        for (const variable of member.variables || []) {
+            if (variable?.name)
+                out.set(String(variable.name), variable.typeName);
+        }
+    }
+    return out;
+}
+function collectOrderStateNames(stateTypes) {
+    const out = new Set();
+    for (const [name, typeName] of stateTypes) {
+        if (!isMappingType(typeName))
+            continue;
+        if (ORDER_STATE_NAMES.has(normalizeName(name)))
+            out.add(name);
+    }
+    return out;
+}
+function collectLocalTypes(fn) {
+    const out = new Map();
+    for (const param of fn.parameters || []) {
+        if (param?.name)
+            out.set(String(param.name), param.typeName);
+    }
+    for (const param of fn.returnParameters || []) {
+        if (param?.name)
+            out.set(String(param.name), param.typeName);
+    }
+    collectVariableTypes(fn.body, out);
+    return out;
+}
+function collectVariableTypes(node, out) {
+    if (!node || typeof node !== 'object')
+        return;
+    if ((0, ast_1.isNode)(node, 'VariableDeclarationStatement')) {
+        for (const variable of node.variables || []) {
+            if (variable?.name)
+                out.set(String(variable.name), variable.typeName);
+        }
+    }
+    for (const child of childNodes(node))
+        collectVariableTypes(child, out);
+}
+function mergeTypes(...maps) {
+    const out = new Map();
+    for (const map of maps) {
+        for (const [name, typeName] of map)
+            out.set(name, typeName);
+    }
+    return out;
+}
+function isNftExpression(expr, typeNames, interfaceNames) {
+    if (!expr)
+        return false;
+    if ((0, ast_1.isNode)(expr, 'FunctionCall'))
+        return isNftTypeName(expr.expression, interfaceNames);
+    if ((0, ast_1.isNode)(expr, 'Identifier'))
+        return isNftTypeName(typeNames.get(String(expr.name || '')), interfaceNames);
+    if ((0, ast_1.isNode)(expr, 'MemberAccess'))
+        return isNftTypeName(typeNames.get(String(expr.expression?.name || '')), interfaceNames);
+    return false;
+}
+function isNftTypeName(typeName, interfaceNames) {
+    const name = typeNameName(typeName);
+    if (!name)
+        return false;
+    const bare = name.split('.').pop() || name;
+    return /^(I)?ERC(721|1155)$/i.test(bare) || (interfaceNames.has(bare) && /721|1155/i.test(bare));
+}
+function typeNameName(typeName) {
+    if (!typeName || typeof typeName !== 'object')
+        return '';
+    if ((0, ast_1.isNode)(typeName, 'UserDefinedTypeName'))
+        return String(typeName.namePath || typeName.name || '');
+    if ((0, ast_1.isNode)(typeName, 'ElementaryTypeName'))
+        return String(typeName.name || '');
+    if ((0, ast_1.isNode)(typeName, 'Identifier'))
+        return String(typeName.name || '');
+    if ((0, ast_1.isNode)(typeName, 'ArrayTypeName'))
+        return typeNameName(typeName.baseTypeName);
+    return '';
+}
+function orderStateNameFromExpression(expr, stateNames, aliases) {
+    if (!expr || typeof expr !== 'object')
+        return '';
+    if ((0, ast_1.isNode)(expr, 'Identifier')) {
+        const name = String(expr.name || '');
+        return stateNames.has(name) ? name : aliases.get(name) || '';
+    }
+    if ((0, ast_1.isNode)(expr, 'IndexAccess'))
+        return orderStateNameFromExpression(expr.base, stateNames, aliases);
+    if ((0, ast_1.isNode)(expr, 'MemberAccess'))
+        return orderStateNameFromExpression(expr.expression, stateNames, aliases);
+    if ((0, ast_1.isNode)(expr, 'TupleExpression')) {
+        for (const component of expr.components || []) {
+            const name = orderStateNameFromExpression(component, stateNames, aliases);
+            if (name)
+                return name;
+        }
+    }
+    return '';
+}
+function hasReentrancyGuard(fn) {
+    for (const modifier of fn?.modifiers || []) {
+        const name = normalizeName(modifierName(modifier));
+        if (REENTRANCY_GUARD_NAMES.has(name) || name.includes('reentrancyguard'))
+            return true;
+    }
+    return false;
+}
+function modifierName(modifier) {
+    if (!modifier)
+        return '';
+    if (typeof modifier === 'string')
+        return modifier;
+    if (typeof modifier.name === 'string')
+        return modifier.name;
+    if (modifier.name && typeof modifier.name === 'object')
+        return String(modifier.name.name || modifier.name.namePath || '');
+    if (modifier.modifierName) {
+        const m = modifier.modifierName;
+        if (typeof m === 'string')
+            return m;
+        return String(m.name || m.namePath || '');
+    }
+    return '';
+}
+function callHasValueOption(expr) {
+    let current = expr;
+    while (current && typeof current === 'object') {
+        if ((0, ast_1.isNode)(current, 'FunctionCallOptions') || (0, ast_1.isNode)(current, 'NameValueExpression')) {
+            const names = current.names || current.arguments?.names || [];
+            if (names.some((name) => String(name?.name || name) === 'value'))
+                return true;
+            current = current.expression;
+            continue;
+        }
+        return false;
+    }
+    return false;
+}
+function unwrapCallOptions(expr) {
+    let current = expr;
+    while (current && ((0, ast_1.isNode)(current, 'NameValueExpression') || (0, ast_1.isNode)(current, 'FunctionCallOptions'))) {
+        current = current.expression;
+    }
+    return current;
+}
+function directCallName(expr) {
+    return (0, ast_1.isNode)(expr, 'Identifier') ? String(expr.name || '') : '';
+}
+function isMappingType(typeName) {
+    return !!typeName && typeof typeName === 'object'
+        && ((0, ast_1.isNode)(typeName, 'Mapping') || String(typeName.typeString || '').startsWith('mapping('));
+}
+function isConcreteContract(contract) {
+    const kind = String(contract?.kind || '').toLowerCase();
+    return (0, ast_1.isNode)(contract, 'ContractDefinition') && kind !== 'interface' && kind !== 'library';
+}
+function isFunction(node) {
+    return (0, ast_1.isNode)(node, 'FunctionDefinition') && !node.isConstructor && String(node.kind || '').toLowerCase() !== 'constructor';
+}
+function isExternallyReachableFunction(fn) {
+    if (!isFunction(fn))
+        return false;
+    const visibility = String(fn.visibility || '').toLowerCase();
+    if (visibility === 'public' || visibility === 'external')
+        return true;
+    const kind = String(fn.kind || '').toLowerCase();
+    return kind === 'fallback' || kind === 'receive';
+}
+function isViewOrPure(fn) {
+    const mutability = String(fn.stateMutability || '').toLowerCase();
+    return mutability === 'view' || mutability === 'pure';
+}
+function isMutationOperator(operator) {
+    return new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=', '++', '--', 'delete']).has(String(operator || ''));
+}
+function normalizeName(name) {
+    return name.replace(/[^a-zA-Z0-9]/g, '').toLowerCase();
+}
+function childNodes(node) {
+    const out = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'range' || key === 'typeName')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                if (item && typeof item === 'object')
+                    out.push(item);
+        }
+        else if (value && typeof value === 'object') {
+            out.push(value);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=reentrancy-on-sell-nft.js.map

package/dist/detectors/reflection-token-balance-desync.d.ts

@@ -0,0 +1,28 @@
+import type { ScanResult } from '../api';
+export declare class ReflectionTokenBalanceDesyncDetector {
+    readonly id = "reflection-token-balance-desync";
+    readonly patternKey = "reflection-token-balance-desync";
+    readonly supportedAstKinds: "parser"[];
+    private currentFile;
+    private currentContract;
+    private findings;
+    private stateVariables;
+    private mappings;
+    private rateVariables;
+    private divisions;
+    private currentFunction;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(): void;
+    ['ContractDefinition:exit'](): void;
+    StateVariableDeclaration(node: any): void;
+    BinaryOperation(node: any): void;
+    FunctionCall(node: any): void;
+    FunctionDefinition(node: any): void;
+    FunctionDefinition_post(node: any): void;
+    ['FunctionDefinition:exit'](node: any): void;
+    private recordDivision;
+    private refreshRateVariables;
+    private recordFunctionMutation;
+}