@snovon/solast 0.2.0

package/dist/detectors/share-price-manipulation.js

@@ -0,0 +1,653 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharePriceManipulationDetector = void 0;
+const RULE_ID = 'share-price-manipulation';
+const PROVENANCE = 'x-20250709-gmx-share-price-manipulation';
+const SHARE_STATE_PATTERNS = [
+    /^_?globalShort/,
+    /^_?globalLong/,
+    /shortAverage/i,
+    /longAverage/i,
+    /AveragePrice$/,
+    /^_?aum$/i,
+    /Aum$/,
+    /poolValue/i,
+    /netAssetValue$/i,
+    /getPooledEth/i,
+    /^sharesOf$/i,
+    /sharesToStEth/i,
+    /stethPerShare/i,
+    /pooledEthByShares/i,
+];
+const LIDO_SHARE_STATE_PATTERNS = [
+    /getPooledEth/i,
+    /^sharesOf$/i,
+    /sharesToStEth/i,
+    /stethPerShare/i,
+    /pooledEthByShares/i,
+];
+const LIDO_QUEUE_ACCOUNTING_PATTERNS = [
+    /queuedShares/i,
+    /totalQueuedShares/i,
+    /claimablePooledEth/i,
+];
+const NONREENTRANT_MODIFIERS = new Set([
+    'nonreentrant',
+    'nonreentrantview',
+    'nonreentrantreadonly',
+    'nonreentrantbefore',
+    'nonreentrantafter',
+]);
+const LOW_LEVEL_CALL_NAMES = new Set(['call', 'delegatecall', 'staticcall']);
+class SharePriceManipulationDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser', 'solc'];
+    scanAst(ast, file, sourceText) {
+        if (!ast || typeof ast !== 'object')
+            return [];
+        const findings = [];
+        const lineOffsets = buildLineOffsets(sourceText);
+        for (const contract of collectContracts(ast)) {
+            if (isInterfaceLike(contract))
+                continue;
+            const shareStateVars = collectShareStateNames(contract);
+            const stateVars = collectStateVariableNames(contract);
+            const lidoContext = contractHasLidoShareState(contract);
+            if (shareStateVars.size === 0 && !lidoContext)
+                continue;
+            const functions = new Map();
+            for (const fn of getContractFunctions(contract)) {
+                const info = buildFunctionInfo(fn, shareStateVars);
+                functions.set(info.name, info);
+            }
+            const transitiveMutates = computeTransitiveProperty(functions, info => info.directlyMutatesShareState);
+            const transitiveReads = computeTransitiveProperty(functions, info => info.readsShareState);
+            const allShareReadersGuarded = checkAllShareReadersGuarded(functions, transitiveReads);
+            for (const info of functions.values()) {
+                if (!isExternallyCallable(info.node))
+                    continue;
+                if (info.isView)
+                    continue;
+                if (!info.body)
+                    continue;
+                const result = analyzeEntryFunction(info, functions, shareStateVars, stateVars, transitiveMutates, lidoContext);
+                if (!result)
+                    continue;
+                if (result.inlineWritesBeforeCall >= 2 && !result.lidoSensitive)
+                    continue;
+                if (info.hasNonReentrant && allShareReadersGuarded)
+                    continue;
+                const contractName = getName(contract) || '<anonymous>';
+                const fnLoc = getLoc(info.node, lineOffsets) || { line: 0, column: 0 };
+                const callLoc = getLoc(result.callNode, lineOffsets) || fnLoc;
+                findings.push({
+                    file,
+                    contract: contractName,
+                    'function': info.name,
+                    line: fnLoc.line,
+                    endLine: callLoc.line || fnLoc.line,
+                    column: fnLoc.column,
+                    pattern: RULE_ID,
+                    confidence: 'high',
+                    ruleId: RULE_ID,
+                    severity: 'high',
+                    message: `Share-price manipulation risk in '${contractName}.${info.name}': share-price accounting state is mutated and then a user-controlled callback is invoked before settlement, allowing a re-entered redeem/mint to execute against a transient share price.`,
+                    rationale: 'Mirrors the 2025-07-09 GMX share-price manipulation: a position-adjusting function updates share-price-relevant accounting (e.g., globalShortAveragePrice) and then yields control to an attacker-controlled callback. The callback can re-enter mint/redeem against the manipulated AUM before the function returns.',
+                    suggestedFix: 'Finalize all share-price accounting (snapshot AUM into the variable read by mint/redeem) BEFORE making any external callback, or guard the writer, the redeem/mint path, and any public AUM/share-state reader with a shared `nonReentrant`/`nonReentrantView` modifier.',
+                    contractName,
+                    functionName: info.name,
+                    sourceLocation: { line: fnLoc.line, column: fnLoc.column },
+                    findingId: '',
+                    contractHash: '',
+                    provenance: PROVENANCE,
+                    source: PROVENANCE,
+                });
+            }
+        }
+        return findings;
+    }
+}
+exports.SharePriceManipulationDetector = SharePriceManipulationDetector;
+function buildFunctionInfo(fn, shareStateVars) {
+    const body = getFunctionBody(fn);
+    const internalCalls = body ? collectInternalCallNames(body) : new Set();
+    return {
+        node: fn,
+        name: functionDisplayName(fn),
+        body,
+        isView: isViewLike(fn),
+        paramNames: getParamNames(fn),
+        hasNonReentrant: hasNonReentrantModifier(fn),
+        internalCalls,
+        directlyMutatesShareState: !!body && bodyAssignsShareState(body, shareStateVars),
+        readsShareState: !!body && bodyReadsShareState(body, shareStateVars),
+    };
+}
+function computeTransitiveProperty(functions, prop) {
+    const cache = new Map();
+    function compute(info, seen) {
+        const cached = cache.get(info.name);
+        if (cached !== undefined)
+            return cached;
+        if (prop(info)) {
+            cache.set(info.name, true);
+            return true;
+        }
+        if (seen.has(info.name))
+            return false;
+        seen.add(info.name);
+        for (const callee of info.internalCalls) {
+            const c = functions.get(callee);
+            if (c && compute(c, seen)) {
+                cache.set(info.name, true);
+                return true;
+            }
+        }
+        cache.set(info.name, false);
+        return false;
+    }
+    for (const info of functions.values())
+        compute(info, new Set());
+    return cache;
+}
+function checkAllShareReadersGuarded(functions, transitiveReads) {
+    for (const info of functions.values()) {
+        if (!isExternallyCallable(info.node))
+            continue;
+        if (!transitiveReads.get(info.name))
+            continue;
+        if (!info.hasNonReentrant)
+            return false;
+    }
+    return true;
+}
+function analyzeEntryFunction(info, functions, shareStateVars, stateVars, transitiveMutates, lidoContext) {
+    const stmts = getBlockStatements(info.body);
+    let mutationOccurred = false;
+    let lidoMutationOccurred = false;
+    let inlineWritesBeforeCall = 0;
+    for (let i = 0; i < stmts.length; i++) {
+        const stmt = stmts[i];
+        const stmtInline = countShareStateAssignments(stmt, shareStateVars);
+        const stmtLidoQueue = lidoContext ? countLidoQueueAssignments(stmt, stateVars) : 0;
+        if (stmtInline > 0) {
+            mutationOccurred = true;
+            if (statementTouchesLidoShareState(stmt))
+                lidoMutationOccurred = true;
+        }
+        else if (stmtLidoQueue > 0) {
+            mutationOccurred = true;
+            lidoMutationOccurred = true;
+        }
+        else if (!mutationOccurred) {
+            const calleeNames = collectInternalCallNames(stmt);
+            for (const cn of calleeNames) {
+                const called = functions.get(cn);
+                if (called && transitiveMutates.get(called.name)) {
+                    mutationOccurred = true;
+                    break;
+                }
+            }
+        }
+        const directExternalCall = findFirstExternalCall(stmt, info.paramNames);
+        const lidoProtocolCall = lidoContext && lidoMutationOccurred
+            ? findFirstExternalProtocolCall(stmt, stateVars)
+            : null;
+        const callNode = directExternalCall || lidoProtocolCall;
+        if (callNode && mutationOccurred) {
+            const lidoSensitive = lidoMutationOccurred || statementTouchesLidoShareState(stmt) || statementsHaveLidoShareStateRead(stmts.slice(i + 1));
+            if (!lidoProtocolCall || lidoSensitive) {
+                return { callNode, inlineWritesBeforeCall, lidoSensitive };
+            }
+        }
+        inlineWritesBeforeCall += stmtInline + stmtLidoQueue;
+    }
+    return null;
+}
+function isShareStateName(name) {
+    if (!name)
+        return false;
+    return SHARE_STATE_PATTERNS.some(p => p.test(name));
+}
+function isLidoShareStateName(name) {
+    if (!name)
+        return false;
+    return LIDO_SHARE_STATE_PATTERNS.some(p => p.test(name));
+}
+function isLidoQueueAccountingName(name) {
+    if (!name)
+        return false;
+    return LIDO_QUEUE_ACCOUNTING_PATTERNS.some(p => p.test(name));
+}
+function collectShareStateNames(contract) {
+    const names = new Set();
+    for (const child of getContractMembers(contract)) {
+        if (isNode(child, 'StateVariableDeclaration')) {
+            for (const v of child.variables || []) {
+                if (v?.name && isShareStateName(String(v.name)))
+                    names.add(String(v.name));
+            }
+        }
+        else if (isNode(child, 'VariableDeclaration') && child.stateVariable) {
+            if (child.name && isShareStateName(String(child.name)))
+                names.add(String(child.name));
+        }
+    }
+    return names;
+}
+function collectStateVariableNames(contract) {
+    const names = new Set();
+    for (const child of getContractMembers(contract)) {
+        if (isNode(child, 'StateVariableDeclaration')) {
+            for (const v of child.variables || []) {
+                if (v?.name)
+                    names.add(String(v.name));
+            }
+        }
+        else if (isNode(child, 'VariableDeclaration') && child.stateVariable) {
+            if (child.name)
+                names.add(String(child.name));
+        }
+    }
+    return names;
+}
+function contractHasLidoShareState(contract) {
+    return walkAny(contract, node => {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (isNode(node, 'Identifier') && isLidoShareStateName(String(node.name || '')))
+            return true;
+        if (isNode(node, 'MemberAccess') && isLidoShareStateName(String(node.memberName || '')))
+            return true;
+        if (isNode(node, 'FunctionDefinition') && isLidoShareStateName(functionDisplayName(node)))
+            return true;
+        return false;
+    });
+}
+function bodyAssignsShareState(body, shareStateVars) {
+    return walkAny(body, node => isShareStateAssignment(node, shareStateVars));
+}
+function bodyReadsShareState(body, shareStateVars) {
+    return walkAny(body, node => {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (isNode(node, 'Identifier') && shareStateVars.has(String(node.name || '')))
+            return true;
+        if (isNode(node, 'MemberAccess') && shareStateVars.has(String(node.memberName || '')))
+            return true;
+        return false;
+    });
+}
+function isShareStateAssignment(node, shareStateVars) {
+    if (!node || typeof node !== 'object')
+        return false;
+    let lhs = null;
+    if (isNode(node, 'BinaryOperation')) {
+        const op = String(node.operator || '');
+        if (!op.includes('='))
+            return false;
+        if (['==', '===', '!=', '!==', '<=', '>='].includes(op))
+            return false;
+        lhs = node.left || node.leftExpression;
+    }
+    else if (isNode(node, 'Assignment')) {
+        if (!String(node.operator || '').includes('='))
+            return false;
+        lhs = node.leftHandSide;
+    }
+    else {
+        return false;
+    }
+    return targetsShareState(lhs, shareStateVars);
+}
+function targetsShareState(expr, shareStateVars) {
+    if (!expr || typeof expr !== 'object')
+        return false;
+    if (isNode(expr, 'Identifier'))
+        return shareStateVars.has(String(expr.name || ''));
+    if (isNode(expr, 'MemberAccess')) {
+        if (shareStateVars.has(String(expr.memberName || '')))
+            return true;
+        return false;
+    }
+    if (isNode(expr, 'IndexAccess')) {
+        return targetsShareState(expr.base || expr.baseExpression, shareStateVars);
+    }
+    if (isNode(expr, 'TupleExpression')) {
+        return (expr.components || []).some((c) => targetsShareState(c, shareStateVars));
+    }
+    return false;
+}
+function countShareStateAssignments(stmt, shareStateVars) {
+    let count = 0;
+    walk(stmt, node => {
+        if (isShareStateAssignment(node, shareStateVars))
+            count++;
+    });
+    return count;
+}
+function countLidoQueueAssignments(stmt, stateVars) {
+    let count = 0;
+    walk(stmt, node => {
+        if (isLidoQueueAssignment(node, stateVars))
+            count++;
+    });
+    return count;
+}
+function isLidoQueueAssignment(node, stateVars) {
+    if (!node || typeof node !== 'object')
+        return false;
+    let lhs = null;
+    if (isNode(node, 'BinaryOperation')) {
+        const op = String(node.operator || '');
+        if (!op.includes('='))
+            return false;
+        if (['==', '===', '!=', '!==', '<=', '>='].includes(op))
+            return false;
+        lhs = node.left || node.leftExpression;
+    }
+    else if (isNode(node, 'Assignment')) {
+        if (!String(node.operator || '').includes('='))
+            return false;
+        lhs = node.leftHandSide;
+    }
+    else {
+        return false;
+    }
+    return targetsLidoQueueState(lhs, stateVars);
+}
+function targetsLidoQueueState(expr, stateVars) {
+    if (!expr || typeof expr !== 'object')
+        return false;
+    if (isNode(expr, 'Identifier')) {
+        const name = String(expr.name || '');
+        return stateVars.has(name) && isLidoQueueAccountingName(name);
+    }
+    if (isNode(expr, 'MemberAccess')) {
+        const name = String(expr.memberName || '');
+        return stateVars.has(name) && isLidoQueueAccountingName(name);
+    }
+    if (isNode(expr, 'IndexAccess')) {
+        return targetsLidoQueueState(expr.base || expr.baseExpression, stateVars);
+    }
+    if (isNode(expr, 'TupleExpression')) {
+        return (expr.components || []).some((c) => targetsLidoQueueState(c, stateVars));
+    }
+    return false;
+}
+function statementTouchesLidoShareState(stmt) {
+    return walkAny(stmt, node => {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (isNode(node, 'Identifier') && isLidoShareStateName(String(node.name || '')))
+            return true;
+        if (isNode(node, 'MemberAccess') && isLidoShareStateName(String(node.memberName || '')))
+            return true;
+        return false;
+    });
+}
+function statementsHaveLidoShareStateRead(stmts) {
+    return stmts.some(stmt => statementTouchesLidoShareState(stmt));
+}
+function collectInternalCallNames(stmt) {
+    const names = new Set();
+    walk(stmt, node => {
+        if (!isNode(node, 'FunctionCall'))
+            return;
+        const callee = node.expression;
+        if (isNode(callee, 'Identifier')) {
+            const name = String(callee.name || '');
+            if (name)
+                names.add(name);
+        }
+    });
+    return names;
+}
+function findFirstExternalCall(stmt, paramNames) {
+    let found = null;
+    walkAny(stmt, node => {
+        if (found)
+            return false;
+        if (isNode(node, 'FunctionCall') && isExternalCall(node, paramNames)) {
+            found = node;
+            return true;
+        }
+        return false;
+    });
+    return found;
+}
+function findFirstExternalProtocolCall(stmt, stateVars) {
+    let found = null;
+    walkAny(stmt, node => {
+        if (found)
+            return false;
+        if (!isNode(node, 'FunctionCall'))
+            return false;
+        const callee = node.expression;
+        if (!isNode(callee, 'MemberAccess'))
+            return false;
+        const base = callee.expression;
+        if (isNode(base, 'Identifier') && stateVars.has(String(base.name || ''))) {
+            found = node;
+            return true;
+        }
+        return false;
+    });
+    return found;
+}
+function isExternalCall(call, paramNames) {
+    const callee = call?.expression;
+    if (!callee || typeof callee !== 'object')
+        return false;
+    if (!isNode(callee, 'MemberAccess'))
+        return false;
+    const memberName = String(callee.memberName || '');
+    if (LOW_LEVEL_CALL_NAMES.has(memberName))
+        return true;
+    const base = callee.expression;
+    if (!base || typeof base !== 'object')
+        return false;
+    if (isNode(base, 'Identifier') && paramNames.has(String(base.name || '')))
+        return true;
+    if (isNode(base, 'FunctionCall')) {
+        const inner = base.expression;
+        if (isNode(inner, 'Identifier')) {
+            const name = String(inner.name || '');
+            if (/^[A-Z]/.test(name) && (base.arguments || []).length === 1)
+                return true;
+        }
+    }
+    return false;
+}
+function isInterfaceLike(contract) {
+    const kind = String(contract?.kind || contract?.contractKind || '').toLowerCase();
+    return kind === 'interface' || kind === 'library';
+}
+function isExternallyCallable(fn) {
+    if (!fn)
+        return false;
+    if (fn.isConstructor === true)
+        return false;
+    const kind = String(fn.kind || '').toLowerCase();
+    if (kind === 'constructor' || kind === 'fallback' || kind === 'receive')
+        return false;
+    if (fn.isFallback === true || fn.isReceiveEther === true)
+        return false;
+    const visibility = String(fn.visibility || '').toLowerCase();
+    return visibility === 'public' || visibility === 'external';
+}
+function isViewLike(fn) {
+    const m = String(fn?.stateMutability || '').toLowerCase();
+    return m === 'view' || m === 'pure';
+}
+function hasNonReentrantModifier(fn) {
+    for (const mod of fn?.modifiers || []) {
+        const name = getModifierName(mod).toLowerCase();
+        if (NONREENTRANT_MODIFIERS.has(name))
+            return true;
+    }
+    return false;
+}
+function getModifierName(modifier) {
+    if (!modifier)
+        return '';
+    if (typeof modifier === 'string')
+        return modifier;
+    if (typeof modifier.name === 'string')
+        return modifier.name;
+    if (modifier.name && typeof modifier.name === 'object') {
+        if (typeof modifier.name.name === 'string')
+            return modifier.name.name;
+        if (typeof modifier.name.namePath === 'string')
+            return modifier.name.namePath;
+    }
+    if (modifier.modifierName) {
+        const inner = modifier.modifierName;
+        if (typeof inner === 'string')
+            return inner;
+        if (inner && typeof inner.name === 'string')
+            return inner.name;
+    }
+    return '';
+}
+function getParamNames(fn) {
+    const out = new Set();
+    let params = [];
+    if (Array.isArray(fn?.parameters)) {
+        params = fn.parameters;
+    }
+    else if (Array.isArray(fn?.parameters?.parameters)) {
+        params = fn.parameters.parameters;
+    }
+    for (const p of params) {
+        if (p?.name)
+            out.add(String(p.name));
+    }
+    return out;
+}
+function functionDisplayName(fn) {
+    if (fn?.isFallback === true)
+        return '<fallback>';
+    if (fn?.isReceiveEther === true)
+        return '<receive>';
+    const kind = String(fn?.kind || '').toLowerCase();
+    if (kind === 'fallback')
+        return '<fallback>';
+    if (kind === 'receive')
+        return '<receive>';
+    if (kind === 'constructor')
+        return '<constructor>';
+    const name = fn?.name;
+    if (typeof name === 'string' && name.length > 0)
+        return name;
+    return '<anonymous>';
+}
+function getName(node) {
+    return typeof node?.name === 'string' ? node.name : '';
+}
+function getFunctionBody(node) {
+    return node?.body || null;
+}
+function getContractFunctions(contract) {
+    return getContractMembers(contract).filter(child => isNode(child, 'FunctionDefinition'));
+}
+function getContractMembers(contract) {
+    if (!contract || typeof contract !== 'object')
+        return [];
+    if (Array.isArray(contract.subNodes))
+        return contract.subNodes;
+    if (Array.isArray(contract.nodes))
+        return contract.nodes;
+    return [];
+}
+function getBlockStatements(body) {
+    if (!body || typeof body !== 'object')
+        return [];
+    return Array.isArray(body.statements) ? body.statements : [];
+}
+function collectContracts(ast) {
+    const out = [];
+    walkContracts(ast, node => out.push(node));
+    return out;
+}
+function walkContracts(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    if (isNode(node, 'ContractDefinition')) {
+        visit(node);
+        return;
+    }
+    for (const child of childrenOf(node))
+        walkContracts(child, visit);
+}
+function isNode(node, kind) {
+    return node?.type === kind || node?.nodeType === kind;
+}
+function walk(node, visit) {
+    if (!node || typeof node !== 'object')
+        return;
+    visit(node);
+    for (const child of childrenOf(node))
+        walk(child, visit);
+}
+function walkAny(node, predicate) {
+    if (!node || typeof node !== 'object')
+        return false;
+    if (predicate(node))
+        return true;
+    for (const child of childrenOf(node)) {
+        if (walkAny(child, predicate))
+            return true;
+    }
+    return false;
+}
+function childrenOf(node) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const children = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'loc' || key === 'src' || key === 'range' || key === 'typeDescriptions' || key === 'id' || key === 'typeName')
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (item && typeof item === 'object')
+                    children.push(item);
+            }
+        }
+        else if (value && typeof value === 'object') {
+            children.push(value);
+        }
+    }
+    return children;
+}
+function buildLineOffsets(sourceText) {
+    if (sourceText === undefined)
+        return undefined;
+    const lineOffsets = [0];
+    let byteOffset = 0;
+    for (const char of sourceText) {
+        byteOffset += Buffer.byteLength(char, 'utf8');
+        if (char === '\n')
+            lineOffsets.push(byteOffset);
+    }
+    return lineOffsets;
+}
+function getLoc(node, lineOffsets) {
+    if (node?.loc?.start)
+        return node.loc.start;
+    if (!node?.src || !lineOffsets)
+        return undefined;
+    const offset = Number(String(node.src).split(':')[0]);
+    if (!Number.isFinite(offset) || offset < 0)
+        return undefined;
+    let lineIndex = 0;
+    for (let i = 0; i < lineOffsets.length; i++) {
+        if (lineOffsets[i] <= offset)
+            lineIndex = i;
+        else
+            break;
+    }
+    return { line: lineIndex + 1, column: offset - lineOffsets[lineIndex] };
+}
+//# sourceMappingURL=share-price-manipulation.js.map

package/dist/detectors/signature-replay.d.ts

@@ -0,0 +1,30 @@
+import type { ScanResult } from '../index';
+export declare class SignatureReplayDetector {
+    readonly id = "signature-replay";
+    readonly patternKey = "signature-replay";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string): ScanResult[];
+    private analyzeFunction;
+    private collectReturnInitializers;
+    private collectFunctionFacts;
+    private findSignatureVerifications;
+    private digestFromSignerComparison;
+    private resolveLocalExpression;
+    private recoverDigest;
+    private looksLikeSigner;
+    private digestFacts;
+    private missingBindings;
+    private collectTemporalChecks;
+    private containsTimestamp;
+    private bodyBlocks;
+    private singleReturnedExpression;
+    private walkResolved;
+    private walk;
+    private childNodes;
+    private directCallName;
+    private indexRootName;
+    private functionParamCount;
+    private isExternallyCallable;
+    private locOf;
+    private makeFinding;
+}