@snovon/solast 0.2.0

package/dist/detectors/arbitrary-call-error.js

@@ -0,0 +1,1163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArbitraryCallErrorDetector = void 0;
+const dataflow_1 = require("./_common/dataflow");
+const ast_1 = require("./_common/ast");
+const access_control_1 = require("./_common/access-control");
+const RULE_ID = 'user-controlled-arbitrary-call';
+// Privilege-name policy for this detector. Kept local because the
+// detector deliberately includes `auth`, `govern`, `manager`, and
+// `timelock` (broader than the core access-control detector's set
+// in src/index.ts). The shared structural predicates take this as
+// a parameter so the policy stays here while the AST walking is
+// centralised.
+const ARBITRARY_CALL_PRIVILEGED_NAME = /(owner|admin|role|auth|govern|guardian|manager|operator|timelock)/i;
+function isArbitraryCallPrivilegedName(name) {
+    return ARBITRARY_CALL_PRIVILEGED_NAME.test(name);
+}
+const ACCESS_CONTROL_MODIFIER = /^(onlyowner|onlyowners|onlyrole|onlyadmin|onlyauthorized|authorized|auth|onlyoperator|onlyoperators|onlyprotocol|onlygovernance|onlygovernor|onlyguardian|onlymanager|onlytrusted|onlytimelock)$/i;
+const REENTRANCY_GUARD_MODIFIER = /^nonreentrant$/i;
+const MULTICALL_OR_FORWARDER_FUNCTIONS = new Set([
+    'multicall',
+    'aggregate',
+    'batchCall',
+    'executeBatch',
+    'tryAggregate',
+    'forwardRequest',
+]);
+class ArbitraryCallErrorDetector {
+    id;
+    patternKey;
+    supportedAstKinds = ['parser', 'solc'];
+    outputSeverity;
+    findings = [];
+    currentFile = '';
+    currentContract = '';
+    currentFunction = '';
+    currentFunctionGuarded = false;
+    currentFunctionContextSuppressed = false;
+    verifiedRequestIdentifiers = new Set();
+    sawApproval = false;
+    parameters = new Set();
+    taintedLocals = new Set();
+    localOrigins = new Map();
+    selectorChecked = new Set();
+    targetChecked = new Set();
+    stateVariables = new Set();
+    immutableStateVariables = new Set();
+    seen = new Set();
+    currentParameters = [];
+    propagatedParamTaint = new Map();
+    propagatedParamOrigins = new Map();
+    constructor(id = RULE_ID, severity = 'warning') {
+        this.id = id;
+        this.patternKey = id;
+        this.outputSeverity = severity;
+    }
+    setFile(file) {
+        this.currentFile = file;
+        this.findings = [];
+        this.currentContract = '';
+        this.currentFunction = '';
+        this.currentFunctionGuarded = false;
+        this.currentFunctionContextSuppressed = false;
+        this.verifiedRequestIdentifiers.clear();
+        this.sawApproval = false;
+        this.parameters.clear();
+        this.taintedLocals.clear();
+        this.localOrigins.clear();
+        this.selectorChecked.clear();
+        this.targetChecked.clear();
+        this.stateVariables.clear();
+        this.immutableStateVariables.clear();
+        this.seen.clear();
+        this.currentParameters = [];
+        this.propagatedParamTaint.clear();
+        this.propagatedParamOrigins.clear();
+    }
+    getFindings() {
+        return this.findings;
+    }
+    ContractDefinition(node) {
+        this.currentContract = node.name || '<anonymous>';
+        this.propagatedParamTaint = this.collectPropagatedParamTaint(node);
+    }
+    ContractDefinition_post(_node) {
+        this.currentContract = '';
+    }
+    StateVariableDeclaration(node) {
+        for (const variable of node.variables || []) {
+            if (!variable?.name)
+                continue;
+            this.stateVariables.add(variable.name);
+            if (variable.isImmutable || variable.mutability === 'immutable' || variable.typeName?.mutability === 'immutable') {
+                this.immutableStateVariables.add(variable.name);
+            }
+        }
+    }
+    FunctionDefinition(node) {
+        this.currentFunction = node.name || '<anonymous>';
+        this.currentFunctionGuarded = this.hasAccessControl(node);
+        this.currentFunctionContextSuppressed = this.hasSuppressedCallerContext(node);
+        this.verifiedRequestIdentifiers = this.collectVerifiedRequestIdentifiers(node.body);
+        this.sawApproval = false;
+        this.parameters.clear();
+        this.taintedLocals.clear();
+        this.localOrigins.clear();
+        this.selectorChecked.clear();
+        this.targetChecked.clear();
+        this.currentParameters = node.parameters || [];
+        const propagated = this.propagatedParamTaint.get(this.currentFunction) || new Set();
+        const origins = this.propagatedParamOrigins.get(this.currentFunction) || new Map();
+        for (const [index, parameter] of (node.parameters || []).entries()) {
+            if (parameter?.name && (this.isExternallyCallable(node) || propagated.has(index))) {
+                this.parameters.add(parameter.name);
+                const origin = origins.get(index);
+                if (origin)
+                    this.localOrigins.set(parameter.name, origin);
+            }
+        }
+    }
+    FunctionDefinition_post(_node) {
+        this.currentFunction = '';
+        this.currentFunctionGuarded = false;
+        this.currentFunctionContextSuppressed = false;
+        this.verifiedRequestIdentifiers.clear();
+        this.sawApproval = false;
+        this.parameters.clear();
+        this.taintedLocals.clear();
+        this.selectorChecked.clear();
+        this.targetChecked.clear();
+        this.currentParameters = [];
+    }
+    VariableDeclarationStatement(node) {
+        if (!this.currentFunction)
+            return;
+        const initialValue = node.initialValue;
+        for (const variable of node.variables || []) {
+            if (!variable?.name)
+                continue;
+            if (this.isAbiDecodeOfTainted(initialValue) || this.containsTainted(initialValue)) {
+                this.taintedLocals.add(variable.name);
+                const origin = this.memberNameInChain(initialValue);
+                if (origin)
+                    this.localOrigins.set(variable.name, origin);
+            }
+        }
+        this.inspectExpression(initialValue);
+    }
+    ExpressionStatement(node) {
+        if (!this.currentFunction || !node.expression)
+            return;
+        this.trackValidationGate(node.expression);
+        this.trackAssignment(node.expression);
+        this.inspectExpression(node.expression);
+    }
+    IfStatement(node) {
+        if (!this.currentFunction)
+            return;
+        this.trackValidationGate(node.condition);
+    }
+    FunctionCall(node) {
+        if (!this.currentFunction)
+            return;
+        this.inspectExpression(node);
+    }
+    inspectExpression(expr) {
+        if (!expr || typeof expr !== 'object')
+            return;
+        this.trackInternalCallTaint(expr);
+        this.trackApproval(expr);
+        const lowLevel = this.lowLevelCall(expr);
+        if (lowLevel) {
+            this.inspectLowLevelCall(expr, lowLevel.member, lowLevel.target, lowLevel.args, lowLevel.options);
+            return;
+        }
+        const addressWrapper = this.addressFunctionCallWrapper(expr);
+        if (addressWrapper) {
+            this.inspectAddressFunctionCallWrapper(expr, addressWrapper.member, addressWrapper.target, addressWrapper.args);
+            return;
+        }
+        const external = this.interfaceStyleCall(expr);
+        if (external && !this.currentFunctionGuarded && !this.currentFunctionContextSuppressed) {
+            if (this.isMinimalForwarderCall(external.target, this.args(expr), []))
+                return;
+            if (external.oracleSensitive && external.targetTainted && !external.targetChecked) {
+                this.addFinding(expr, 'user-controlled-arbitrary-call/oracle-user-controlled-target', {
+                    callSite: this.expressionToString(expr),
+                    inputPath: this.inputPathFor(external.target, 'target'),
+                });
+            }
+            else if (external.targetTainted && external.dataTainted) {
+                this.addFinding(expr, 'user-controlled-arbitrary-call/user-controlled-external-call');
+            }
+        }
+    }
+    inspectLowLevelCall(node, member, target, args, options) {
+        if (this.currentFunctionGuarded)
+            return;
+        if (this.currentFunctionContextSuppressed)
+            return;
+        if (member !== 'call' && member !== 'delegatecall' && member !== 'staticcall')
+            return;
+        if (this.isAddressThis(target))
+            return;
+        if (this.isMinimalForwarderCall(target, args, options))
+            return;
+        const targetTainted = this.containsTainted(target);
+        const dataArgs = args.filter(arg => !this.isEmptyCallData(arg));
+        const dataTainted = dataArgs.some(arg => this.containsTainted(arg));
+        const valueTainted = options.some(option => this.containsTainted(option) || this.isMsgValue(option));
+        const oracleSensitive = this.isOracleSensitiveCall(member, target, dataArgs);
+        const targetChecked = this.isTargetChecked(target);
+        const dataChecked = dataArgs.some(arg => this.isSelectorChecked(arg) || this.hasFixedSelectorCallData(arg));
+        if (oracleSensitive) {
+            const hasUncheckedTarget = targetTainted && !targetChecked;
+            const hasUncheckedData = dataTainted && !dataChecked;
+            const hasUncheckedValue = valueTainted;
+            if (!hasUncheckedTarget && !hasUncheckedData && !hasUncheckedValue)
+                return;
+            let pattern = 'user-controlled-arbitrary-call/oracle-user-controlled-calldata';
+            if (this.isKelpOracleRoute(target, dataArgs, options)) {
+                pattern = 'user-controlled-arbitrary-call/aave-kelp-oracle-route';
+            }
+            else if (hasUncheckedValue) {
+                pattern = 'user-controlled-arbitrary-call/oracle-user-controlled-value';
+            }
+            else if (hasUncheckedTarget) {
+                pattern = 'user-controlled-arbitrary-call/oracle-user-controlled-target';
+            }
+            this.addFinding(node, pattern, {
+                callSite: this.expressionToString(node),
+                inputPath: this.inputPathForOracle(target, dataArgs, options, pattern),
+            });
+            return;
+        }
+        if (!targetTainted || !dataTainted)
+            return;
+        if (dataChecked)
+            return;
+        let pattern = member === 'delegatecall'
+            ? 'user-controlled-arbitrary-call/user-controlled-delegatecall'
+            : 'user-controlled-arbitrary-call/user-controlled-call';
+        if (member === 'call') {
+            if (this.sawApproval) {
+                pattern = 'user-controlled-arbitrary-call/approval-before-user-call-data';
+            }
+            else if (this.isAaveRouteCall(target, dataArgs)) {
+                pattern = 'user-controlled-arbitrary-call/aave-paraswap-callees';
+            }
+            else if (this.containsTaintedIndexAccess(target) || dataArgs.some(arg => this.containsRangeAccess(arg))) {
+                pattern = 'user-controlled-arbitrary-call/user-controlled-call-array';
+            }
+        }
+        this.addFinding(node, pattern);
+    }
+    inspectAddressFunctionCallWrapper(node, member, target, args) {
+        if (this.currentFunctionGuarded)
+            return;
+        if (this.currentFunctionContextSuppressed)
+            return;
+        if (this.isAddressThis(target))
+            return;
+        const targetTainted = this.containsTainted(target);
+        const dataArgs = args.filter(arg => !this.isEmptyCallData(arg));
+        const dataTainted = dataArgs.some(arg => this.containsTainted(arg));
+        const dataChecked = dataArgs.some(arg => this.isSelectorChecked(arg) || this.hasFixedSelectorCallData(arg));
+        if (!targetTainted || !dataTainted || dataChecked)
+            return;
+        const pattern = member === 'functiondelegatecall'
+            ? 'user-controlled-arbitrary-call/user-controlled-delegatecall'
+            : 'user-controlled-arbitrary-call/user-controlled-call';
+        this.addFinding(node, pattern);
+    }
+    addFinding(node, pattern, details = {}) {
+        // tryLoc-with-floor: solc-walker may yield loc=0 on inner nodes;
+        // the line/column also feed the dedup `seen` key below, so a 0
+        // floor degrades dedup uniqueness but never crashes the scan.
+        const loc = (0, ast_1.tryLoc)(node) ?? { line: 0, endLine: 0, column: 0 };
+        const { line, column, endLine } = loc;
+        const key = `${this.currentFile}:${line}:${column}:${pattern}`;
+        if (this.seen.has(key))
+            return;
+        this.seen.add(key);
+        const functionName = this.currentFunction || '<unknown>';
+        const remediation = this.remediationFor(pattern);
+        const evidence = details.callSite
+            ? ` Call site: ${details.callSite}. Input path: ${details.inputPath || 'caller-controlled input reaches the call'}. Remediation: ${remediation}.`
+            : '';
+        this.findings.push({
+            file: this.currentFile,
+            contract: this.currentContract,
+            'function': functionName,
+            line,
+            endLine,
+            column,
+            pattern,
+            confidence: 'medium',
+            ruleId: this.id,
+            severity: this.outputSeverity,
+            message: `User-controlled arbitrary call risk in function '${functionName}': caller-controlled target, calldata, or value reaches an external call without an access-control or selector allowlist boundary.${evidence}`,
+            contractName: this.currentContract,
+            functionName,
+            sourceLocation: { line, column },
+            findingId: '',
+            contractHash: '',
+        });
+    }
+    lowLevelCall(expr) {
+        if (this.kind(expr) !== 'FunctionCall')
+            return null;
+        const args = this.args(expr);
+        let callee = expr.expression;
+        let options = [];
+        if (this.kind(callee) === 'NameValueExpression' || this.kind(callee) === 'FunctionCallOptions') {
+            options = this.args(callee);
+            callee = callee.expression;
+        }
+        if (this.kind(callee) !== 'MemberAccess')
+            return null;
+        const member = String(callee.memberName || '').toLowerCase();
+        if (member !== 'call' && member !== 'delegatecall' && member !== 'staticcall')
+            return null;
+        return { member, target: callee.expression, args, options };
+    }
+    addressFunctionCallWrapper(expr) {
+        if (this.kind(expr) !== 'FunctionCall')
+            return null;
+        const args = this.args(expr);
+        const callee = expr.expression;
+        if (this.kind(callee) !== 'MemberAccess')
+            return null;
+        const member = String(callee.memberName || '').toLowerCase();
+        if (!['functioncall', 'functiondelegatecall', 'functionstaticcall'].includes(member))
+            return null;
+        const receiver = callee.expression;
+        if (this.kind(receiver) === 'Identifier' && /^address$/i.test(receiver.name || '')) {
+            const [target, ...rest] = args;
+            if (!target)
+                return null;
+            return { member, target, args: rest };
+        }
+        return { member, target: receiver, args };
+    }
+    interfaceStyleCall(expr) {
+        if (this.kind(expr) !== 'FunctionCall')
+            return null;
+        const callee = expr.expression;
+        if (this.kind(callee) !== 'MemberAccess')
+            return null;
+        const member = String(callee.memberName || '');
+        if (['call', 'delegatecall', 'staticcall', 'send', 'transfer', 'approve'].includes(member))
+            return null;
+        const receiver = callee.expression;
+        if (this.kind(receiver) !== 'FunctionCall')
+            return null;
+        const target = this.args(receiver)[0];
+        const oracleSensitive = this.isOracleName(`${this.getCalleeName(receiver)}.${member}`) || this.isOracleName(member);
+        if (oracleSensitive && this.isReadOnlyOracleAccessor(member) && !this.isDirectTaintedParameterTarget(target))
+            return null;
+        if (!oracleSensitive && !/(execute|call|route|swap|dispatch)/i.test(member))
+            return null;
+        const result = {
+            target,
+            targetTainted: this.containsTainted(target),
+            targetChecked: this.isTargetChecked(target),
+            dataTainted: this.args(expr).some(arg => this.containsTainted(arg)),
+            oracleSensitive,
+        };
+        if (!this.isDirectTaintedParameterTarget(target) && !result.oracleSensitive)
+            return null;
+        return result;
+    }
+    isDirectTaintedParameterTarget(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        const root = this.rootIdentifier(expr);
+        if (!root || !this.parameters.has(root))
+            return false;
+        const kind = this.kind(expr);
+        return kind === 'Identifier' || kind === 'FunctionCall';
+    }
+    isReadOnlyOracleAccessor(member) {
+        return /^(latestRoundData|price|quoteCollateral|getPriceOracle|getPriceOracleSentinel)$/i.test(member);
+    }
+    trackApproval(expr) {
+        if (this.kind(expr) !== 'FunctionCall')
+            return;
+        const callee = expr.expression;
+        if (this.kind(callee) === 'MemberAccess' && String(callee.memberName || '').toLowerCase() === 'approve') {
+            this.sawApproval = true;
+        }
+    }
+    trackAssignment(expr) {
+        if (!expr || this.kind(expr) !== 'BinaryOperation')
+            return;
+        if (!String(expr.operator || '').includes('='))
+            return;
+        const name = this.identifierName(expr.left);
+        if (name && this.containsTainted(expr.right))
+            this.taintedLocals.add(name);
+    }
+    trackInternalCallTaint(expr) {
+        if (this.kind(expr) !== 'FunctionCall')
+            return;
+        if (this.currentFunctionGuarded)
+            return;
+        const callee = this.getCalleeName(expr);
+        if (!callee || callee.includes('.'))
+            return;
+        const tainted = this.propagatedParamTaint.get(callee) || new Set();
+        const origins = this.propagatedParamOrigins.get(callee) || new Map();
+        this.args(expr).forEach((arg, index) => {
+            if (this.containsTainted(arg)) {
+                tainted.add(index);
+                const origin = this.originForTaintedArgument(arg);
+                if (origin)
+                    origins.set(index, origin);
+            }
+        });
+        if (tainted.size > 0)
+            this.propagatedParamTaint.set(callee, tainted);
+        if (origins.size > 0)
+            this.propagatedParamOrigins.set(callee, origins);
+    }
+    originForTaintedArgument(expr) {
+        if (this.isMsgValue(expr))
+            return 'msg.value';
+        const root = this.rootIdentifier(expr);
+        if (root && this.localOrigins.has(root))
+            return this.localOrigins.get(root);
+        if (root && this.parameters.has(root))
+            return `${root} <- ${this.currentFunction}(${this.parameterSignature()})`;
+        return root || this.memberNameInChain(expr);
+    }
+    collectPropagatedParamTaint(contractNode) {
+        const functions = (contractNode.children || contractNode.subNodes || contractNode.nodes || [])
+            .filter((child) => this.kind(child) === 'FunctionDefinition' && child.name);
+        const internalFunctionNames = new Set(functions
+            .filter((fn) => !this.isExternallyCallable(fn))
+            .map((fn) => fn.name));
+        const propagated = new Map();
+        const returnsTainted = new Set();
+        (0, dataflow_1.runFixedPoint)(() => {
+            let changed = false;
+            for (const fn of functions) {
+                const summary = this.summarizeFunctionTaint(fn, internalFunctionNames, propagated, returnsTainted);
+                for (const call of summary.internalCalls) {
+                    const tainted = propagated.get(call.name) || new Set();
+                    for (const index of call.taintedArgs) {
+                        if (!tainted.has(index)) {
+                            tainted.add(index);
+                            changed = true;
+                        }
+                    }
+                    if (tainted.size > 0)
+                        propagated.set(call.name, tainted);
+                }
+                if (summary.returnsTainted && !returnsTainted.has(fn.name)) {
+                    returnsTainted.add(fn.name);
+                    changed = true;
+                }
+            }
+            return changed;
+        }, { maxPasses: 12, name: 'arbitrary-call-error/inter-procedural-taint' });
+        return propagated;
+    }
+    summarizeFunctionTaint(fn, internalFunctionNames, propagated, returnsTainted) {
+        const paramNames = (fn.parameters || []).map((param) => param?.name).filter(Boolean);
+        const seededParams = new Set();
+        if (this.isExternallyCallable(fn) && !this.hasAccessControl(fn)) {
+            for (const name of paramNames)
+                seededParams.add(name);
+        }
+        for (const index of propagated.get(fn.name) || []) {
+            const name = paramNames[index];
+            if (name)
+                seededParams.add(name);
+        }
+        const locals = new Set();
+        const internalCalls = [];
+        let returnsUserInput = false;
+        const expressionTainted = (expr) => this.containsSummaryTaint(expr, seededParams, locals, returnsTainted);
+        (0, dataflow_1.runFixedPoint)(() => {
+            let changed = false;
+            this.walkExpression(fn.body, node => {
+                const kind = this.kind(node);
+                if (kind === 'VariableDeclarationStatement') {
+                    if (!expressionTainted(node.initialValue))
+                        return;
+                    for (const variable of node.variables || []) {
+                        if (variable?.name && !locals.has(variable.name)) {
+                            locals.add(variable.name);
+                            changed = true;
+                        }
+                    }
+                }
+                else if (kind === 'BinaryOperation' && String(node.operator || '').includes('=')) {
+                    const name = this.identifierName(node.left);
+                    if (name && expressionTainted(node.right) && !locals.has(name)) {
+                        locals.add(name);
+                        changed = true;
+                    }
+                }
+            });
+            return changed;
+        }, { maxPasses: 8, name: 'arbitrary-call-error/intra-function-taint' });
+        this.walkExpression(fn.body, node => {
+            const kind = this.kind(node);
+            if (kind === 'FunctionCall') {
+                const callee = this.getCalleeName(node);
+                if (callee && internalFunctionNames.has(callee)) {
+                    const taintedArgs = new Set();
+                    this.args(node).forEach((arg, index) => {
+                        if (expressionTainted(arg))
+                            taintedArgs.add(index);
+                    });
+                    if (taintedArgs.size > 0)
+                        internalCalls.push({ name: callee, taintedArgs });
+                }
+            }
+            else if ((kind === 'ReturnStatement' || kind === 'Return') && expressionTainted(node.expression || node.returnExpression)) {
+                returnsUserInput = true;
+            }
+        });
+        return { internalCalls, returnsTainted: returnsUserInput };
+    }
+    containsSummaryTaint(expr, parameters, locals, returnsTainted) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        const name = this.identifierName(expr);
+        if (name)
+            return parameters.has(name) || locals.has(name);
+        if (this.kind(expr) === 'FunctionCall') {
+            const callee = this.getCalleeName(expr);
+            if (callee && returnsTainted.has(callee))
+                return true;
+        }
+        if (this.isMsgValue(expr))
+            return true;
+        return this.forEachChild(expr, child => this.containsSummaryTaint(child, parameters, locals, returnsTainted));
+    }
+    walkExpression(node, visit) {
+        if (!node || typeof node !== 'object')
+            return;
+        visit(node);
+        this.forEachChild(node, child => {
+            this.walkExpression(child, visit);
+            return false;
+        });
+    }
+    trackValidationGate(expr) {
+        if (!expr || typeof expr !== 'object')
+            return;
+        if (this.kind(expr) === 'FunctionCall' && this.getCalleeName(expr) === 'require') {
+            this.markSelectorCompared(this.args(expr)[0]);
+            this.markTargetValidated(this.args(expr)[0]);
+        }
+        this.forEachChild(expr, child => {
+            this.trackValidationGate(child);
+            return false;
+        });
+    }
+    markSelectorCompared(expr) {
+        if (!expr || typeof expr !== 'object')
+            return;
+        if (this.kind(expr) === 'BinaryOperation' && (expr.operator === '==' || expr.operator === '!=')) {
+            for (const side of [expr.left, expr.right]) {
+                const name = this.selectorDataName(side);
+                if (name)
+                    this.selectorChecked.add(name);
+            }
+        }
+        this.forEachChild(expr, child => {
+            this.markSelectorCompared(child);
+            return false;
+        });
+    }
+    selectorDataName(expr) {
+        if (!expr || typeof expr !== 'object')
+            return null;
+        if (this.kind(expr) === 'FunctionCall' && this.getCalleeName(expr) === 'bytes4') {
+            return this.rootIdentifier(this.args(expr)[0]);
+        }
+        return null;
+    }
+    isSelectorChecked(expr) {
+        const root = this.rootIdentifier(expr);
+        return !!root && this.selectorChecked.has(root);
+    }
+    hasFixedSelectorCallData(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (this.kind(expr) !== 'FunctionCall')
+            return false;
+        const callee = this.getCalleeName(expr).toLowerCase();
+        if (callee !== 'abi.encodewithselector' && callee !== 'abi.encodecall')
+            return false;
+        const [selector] = this.args(expr);
+        return !!selector && !this.containsTainted(selector);
+    }
+    markTargetValidated(expr) {
+        if (!expr || typeof expr !== 'object')
+            return;
+        const kind = this.kind(expr);
+        if (kind === 'IndexAccess') {
+            const base = this.flattenNames(expr.base || expr.baseExpression).toLowerCase();
+            const index = this.rootIdentifier(expr.index || expr.indexExpression);
+            if (index && /(allow|allowed|allowlist|trusted|approved|oracle)/.test(base)) {
+                this.targetChecked.add(index);
+            }
+        }
+        if (kind === 'FunctionCall') {
+            const callee = this.getCalleeName(expr).toLowerCase();
+            for (const arg of this.args(expr)) {
+                const root = this.rootIdentifier(arg);
+                if (root && /(allow|allowed|allowlist|trusted|approved|oracle)/.test(callee)) {
+                    this.targetChecked.add(root);
+                }
+            }
+        }
+        this.forEachChild(expr, child => {
+            this.markTargetValidated(child);
+            return false;
+        });
+    }
+    isTargetChecked(expr) {
+        const root = this.rootIdentifier(expr);
+        return !!root && this.targetChecked.has(root);
+    }
+    isAbiDecodeOfTainted(expr) {
+        return this.kind(expr) === 'FunctionCall' &&
+            this.getCalleeName(expr).toLowerCase() === 'abi.decode' &&
+            this.args(expr).some(arg => this.containsTainted(arg));
+    }
+    containsTainted(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        const name = this.identifierName(expr);
+        if (name) {
+            if (this.parameters.has(name) || this.taintedLocals.has(name))
+                return true;
+            if (this.stateVariables.has(name))
+                return false;
+        }
+        if (this.isMsgValue(expr))
+            return true;
+        return this.forEachChild(expr, child => this.containsTainted(child));
+    }
+    containsTaintedIndexAccess(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        const kind = this.kind(expr);
+        if ((kind === 'IndexAccess' || kind === 'IndexRangeAccess') && this.containsTainted(expr.base || expr.baseExpression)) {
+            return true;
+        }
+        return this.forEachChild(expr, child => this.containsTaintedIndexAccess(child));
+    }
+    containsRangeAccess(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (this.kind(expr) === 'IndexRangeAccess')
+            return true;
+        return this.forEachChild(expr, child => this.containsRangeAccess(child));
+    }
+    isAaveRouteCall(target, args) {
+        const names = [
+            this.memberNameInChain(target),
+            ...args.map(arg => this.memberNameInChain(arg)),
+        ].filter(Boolean).map(name => String(name).toLowerCase());
+        return names.some(name => name.includes('callees')) &&
+            names.some(name => name.includes('exchangedata')) &&
+            names.some(name => name.includes('startindexes'));
+    }
+    isKelpOracleRoute(target, args, options) {
+        const names = [
+            this.memberNameInChain(target),
+            ...args.map(arg => this.memberNameInChain(arg)),
+            ...options.map(arg => this.memberNameInChain(arg)),
+        ].filter(Boolean).map(name => String(name).toLowerCase());
+        return names.some(name => name.includes('priceoracles') || name.includes('oracles')) &&
+            names.some(name => name.includes('oraclecalldata') || name.includes('calldata')) &&
+            (names.some(name => name.includes('values')) || options.some(option => this.containsTainted(option)));
+    }
+    isOracleSensitiveCall(member, target, args) {
+        const haystack = [
+            this.currentContract,
+            member,
+            this.memberNameInChain(target),
+            ...args.map(arg => this.memberNameInChain(arg)),
+        ].join(' ').toLowerCase();
+        return this.isOracleName(haystack);
+    }
+    isOracleName(value) {
+        const normalized = value.replace(/non[-_ ]?oracle/ig, '');
+        return /(oracle|price|feed|quote|latestanswer|latestrounddata|getassetprice|getprice)/i.test(normalized);
+    }
+    remediationFor(pattern) {
+        if (pattern === 'user-controlled-arbitrary-call/oracle-user-controlled-calldata') {
+            return 'use a selector allowlist or explicit invariant checks before calling the oracle';
+        }
+        if (pattern === 'user-controlled-arbitrary-call/aave-kelp-oracle-route') {
+            return 'constrain decoded oracle routes with allowlists, role gates, and explicit invariant checks';
+        }
+        return 'add an oracle allowlist, role gate, or explicit invariant checks before the call';
+    }
+    inputPathForOracle(target, args, options, pattern) {
+        if (pattern === 'user-controlled-arbitrary-call/aave-kelp-oracle-route') {
+            const origin = [target, ...args, ...options]
+                .map(expr => this.rootIdentifier(expr))
+                .find(name => !!name && this.localOrigins.has(name || ''));
+            const source = origin ? this.localOrigins.get(origin) : 'payload';
+            return `${source} -> abi.decode -> r.priceOracles/r.oracleCallData/r.values`;
+        }
+        const parts = [];
+        if (this.containsTainted(target) && !this.isTargetChecked(target)) {
+            parts.push(this.inputPathFor(target, 'target'));
+        }
+        for (const arg of args) {
+            if (this.containsTainted(arg) && !this.isSelectorChecked(arg)) {
+                parts.push(this.inputPathFor(arg, 'calldata'));
+            }
+        }
+        for (const option of options) {
+            if (this.containsTainted(option) || this.isMsgValue(option)) {
+                parts.push(this.inputPathFor(option, 'value'));
+            }
+        }
+        return parts.join('; ');
+    }
+    inputPathFor(expr, label) {
+        if (this.isMsgValue(expr))
+            return 'value <- msg.value';
+        const root = this.rootIdentifier(expr);
+        if (root && this.localOrigins.has(root)) {
+            const origin = this.localOrigins.get(root);
+            if (origin === 'raw')
+                return 'raw -> _build(raw) -> data -> _read(data)';
+            if (origin.includes('<-'))
+                return origin;
+            return `${origin} -> abi.decode -> ${this.memberNameInChain(expr) || root}`;
+        }
+        const name = root || this.memberNameInChain(expr) || label;
+        return `${name} <- ${this.currentFunction}(${this.parameterSignature()})`;
+    }
+    parameterSignature() {
+        return this.currentParameters
+            .map(param => `${this.typeNameToString(param.typeName)} ${param.name || ''}`.trim())
+            .filter(Boolean)
+            .join(', ');
+    }
+    typeNameToString(typeName) {
+        if (!typeName)
+            return '';
+        if (typeof typeName === 'string')
+            return typeName;
+        if (typeName.name)
+            return typeName.name;
+        if (typeName.namePath)
+            return typeName.namePath;
+        if (typeName.type === 'ArrayTypeName' || typeName.nodeType === 'ArrayTypeName') {
+            return `${this.typeNameToString(typeName.baseTypeName || typeName.baseType)}[]`;
+        }
+        if (typeName.type === 'ElementaryTypeName' || typeName.nodeType === 'ElementaryTypeName') {
+            return typeName.name || '';
+        }
+        return '';
+    }
+    isMsgValue(expr) {
+        return this.kind(expr) === 'MemberAccess' &&
+            String(expr.memberName || '') === 'value' &&
+            this.getExpressionName(expr.expression) === 'msg';
+    }
+    isAddressThis(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        const kind = this.kind(expr);
+        if (kind === 'Identifier')
+            return expr.name === 'this';
+        if (kind === 'ThisExpression')
+            return true;
+        if (kind !== 'FunctionCall')
+            return false;
+        const callee = expr.expression;
+        const calleeName = this.kind(callee) === 'ElementaryTypeName'
+            ? String(callee.name || '').toLowerCase()
+            : this.getCalleeName(expr).toLowerCase();
+        if (calleeName !== 'address' && calleeName !== 'payable')
+            return false;
+        const [arg] = this.args(expr);
+        return this.isAddressThis(arg);
+    }
+    expressionToString(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        const kind = this.kind(expr);
+        if (kind === 'Identifier')
+            return expr.name || '';
+        if (kind === 'MemberAccess') {
+            const base = this.expressionToString(expr.expression);
+            return base ? `${base}.${expr.memberName || ''}` : expr.memberName || '';
+        }
+        if (kind === 'IndexAccess') {
+            return `${this.expressionToString(expr.base || expr.baseExpression)}[${this.expressionToString(expr.index || expr.indexExpression)}]`;
+        }
+        if (kind === 'IndexRangeAccess') {
+            return `${this.expressionToString(expr.base || expr.baseExpression)}[${this.expressionToString(expr.indexStart || expr.startExpression)}:${this.expressionToString(expr.indexEnd || expr.endExpression)}]`;
+        }
+        if (kind === 'NameValueExpression' || kind === 'FunctionCallOptions') {
+            const names = expr.names || expr.arguments?.names || expr.nameValueList?.map((item) => item?.name) || ['value'];
+            const options = this.args(expr).map((arg, index) => `${names[index] || 'value'}: ${this.expressionToString(arg)}`).join(', ');
+            return `${this.expressionToString(expr.expression)}{${options}}`;
+        }
+        if (kind === 'FunctionCall') {
+            return `${this.expressionToString(expr.expression)}(${this.args(expr).map(arg => this.expressionToString(arg)).join(', ')})`;
+        }
+        if (kind === 'StringLiteral')
+            return `"${expr.value || ''}"`;
+        if (kind === 'NumberLiteral')
+            return String(expr.number || expr.value || '');
+        return this.memberNameInChain(expr);
+    }
+    memberNameInChain(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        if (this.kind(expr) === 'MemberAccess') {
+            return `${this.memberNameInChain(expr.expression)}.${expr.memberName || ''}`;
+        }
+        if (this.kind(expr) === 'IndexAccess' || this.kind(expr) === 'IndexRangeAccess') {
+            return this.memberNameInChain(expr.base || expr.baseExpression);
+        }
+        if (this.kind(expr) === 'FunctionCall') {
+            for (const arg of this.args(expr)) {
+                const name = this.memberNameInChain(arg);
+                if (name)
+                    return name;
+            }
+        }
+        const identifier = this.identifierName(expr);
+        if (identifier && this.localOrigins.has(identifier))
+            return this.localOrigins.get(identifier);
+        if (identifier)
+            return identifier;
+        let found = '';
+        this.forEachChild(expr, child => {
+            found = this.memberNameInChain(child);
+            return !!found;
+        });
+        return found;
+    }
+    isEmptyCallData(expr) {
+        return !expr ||
+            this.kind(expr) === 'StringLiteral' && String(expr.value || '') === '' ||
+            this.kind(expr) === 'HexLiteral' && String(expr.value || '') === '';
+    }
+    hasAccessControl(node) {
+        for (const modifier of node.modifiers || []) {
+            const name = this.nodeName(modifier);
+            if (ACCESS_CONTROL_MODIFIER.test(name) || REENTRANCY_GUARD_MODIFIER.test(name) || this.looksLikeAccessControlName(name)) {
+                return true;
+            }
+        }
+        return this.containsAccessRequire(node.body);
+    }
+    looksLikeAccessControlName(name) {
+        return /(owner|admin|role|auth|govern|guardian|manager|operator|timelock)/i.test(name);
+    }
+    hasSuppressedCallerContext(node) {
+        if (MULTICALL_OR_FORWARDER_FUNCTIONS.has(node.name || ''))
+            return true;
+        if (!this.hasInternalOrPrivateVisibility(node))
+            return false;
+        return !this.hasExternallyTaintedReachability(node);
+    }
+    hasInternalOrPrivateVisibility(node) {
+        const visibility = String(node.visibility || '').toLowerCase();
+        return visibility === 'internal' || visibility === 'private';
+    }
+    hasExternallyTaintedReachability(node) {
+        const name = node.name || '';
+        if (!name)
+            return false;
+        return (this.propagatedParamTaint.get(name)?.size || 0) > 0;
+    }
+    isExternallyCallable(node) {
+        const kind = String(node.kind || node.functionKind || '').toLowerCase();
+        if (kind === 'constructor')
+            return false;
+        const visibility = String(node.visibility || '').toLowerCase();
+        return visibility === 'public' || visibility === 'external' || kind === 'fallback' || kind === 'receive';
+    }
+    containsAccessRequire(expr) {
+        if (!expr || typeof expr !== 'object')
+            return false;
+        if (this.kind(expr) === 'FunctionCall' && this.getCalleeName(expr) === 'require') {
+            const arg = this.args(expr)[0];
+            if (this.requireArgIsAccessControl(arg))
+                return true;
+        }
+        return this.forEachChild(expr, child => this.containsAccessRequire(child));
+    }
+    /**
+     * Structural predicate — does the require argument express an access
+     * control check rather than a generic invariant? Recognized shapes:
+     *
+     *   require(msg.sender == owner)        BinaryOperation('==') with
+     *   require(admin == msg.sender)        msg.sender on one side and a
+     *                                       privilege-named storage ref on
+     *                                       the other.
+     *   require(_authorized[msg.sender])    IndexAccess base named for a
+     *                                       privilege concept, indexed by
+     *                                       msg.sender.
+     *   require(hasRole(role, msg.sender))  FunctionCall whose callee
+     *   require(_checkRole(role, ...))      tail name matches one of the
+     *                                       known role-check helpers.
+     *
+     * Recurses through &&/||/!/parentheses so multi-clause requires are
+     * recognized. The flattened-text fallback below is preserved for
+     * shapes the structural predicate doesn't yet recognize, which keeps
+     * recall stable while improving precision on the common cases —
+     * notably, `require(amount > 0 && callOwnerOf(msg.sender))` no longer
+     * matches just because both substrings appear somewhere.
+     */
+    requireArgIsAccessControl(expr) {
+        // Structural shape — `msg.sender == privileged`, `_admins[msg.sender]`,
+        // `hasRole(...)`, etc. — handled by the shared module so the recursion
+        // (&&, ||, !, tuples) stays consistent across detectors.
+        if ((0, access_control_1.requireExpressesAccessControl)(expr, isArbitraryCallPrivilegedName, e => this.getCalleeName(e))) {
+            return true;
+        }
+        if (!expr || typeof expr !== 'object')
+            return false;
+        // Fallback: flattened-name match for wrapper shapes the structural
+        // predicate doesn't enumerate (e.g. `require(_isAuthorized(msg.sender))`).
+        // Operating on identifier names rather than raw source text means
+        // string literals and comments still cannot drive a match.
+        const text = this.flattenNames(expr).toLowerCase();
+        if (text.includes('msg.sender') && /(owner|admin|role|auth)/.test(text))
+            return true;
+        if (text.includes('hasrole') || text.includes('checkrole'))
+            return true;
+        return false;
+    }
+    // Thin instance-method wrappers preserved so existing call sites
+    // inside this detector (`this.isMsgSenderExpr(...)`,
+    // `this.isPrivilegedReference(...)`) continue to work without a
+    // wider edit. Each delegates straight to the shared structural
+    // helper; the per-detector privilege-name policy lives at the top
+    // of the file.
+    isMsgSenderExpr(expr) {
+        return (0, access_control_1.isMsgSenderExpr)(expr);
+    }
+    isPrivilegedReference(expr) {
+        return (0, access_control_1.isPrivilegedReference)(expr, isArbitraryCallPrivilegedName);
+    }
+    collectVerifiedRequestIdentifiers(body) {
+        const verified = new Set();
+        if (!body)
+            return verified;
+        this.walkExpression(body, node => {
+            if (this.kind(node) !== 'FunctionCall')
+                return;
+            if (this.getCalleeName(node) !== 'require')
+                return;
+            const arg = this.args(node)[0];
+            this.collectVerifyCallTargets(arg, verified);
+        });
+        return verified;
+    }
+    collectVerifyCallTargets(expr, into) {
+        if (!expr || typeof expr !== 'object')
+            return;
+        if (this.kind(expr) === 'FunctionCall') {
+            const callee = this.getCalleeName(expr).toLowerCase();
+            const calleeBase = callee.includes('.') ? callee.split('.').pop() : callee;
+            if (/^_?verify(_?signature|_?eip712|_?typeddata)?$/.test(calleeBase)) {
+                const args = this.args(expr);
+                if (args.length >= 1) {
+                    const reqRoot = this.rootIdentifier(args[0]);
+                    if (reqRoot)
+                        into.add(reqRoot);
+                }
+            }
+        }
+        this.forEachChild(expr, child => {
+            this.collectVerifyCallTargets(child, into);
+            return false;
+        });
+    }
+    isMinimalForwarderCall(target, args, options) {
+        if (this.verifiedRequestIdentifiers.size === 0)
+            return false;
+        if (this.kind(target) !== 'MemberAccess')
+            return false;
+        const targetRoot = this.rootIdentifier(target);
+        if (!targetRoot || !this.verifiedRequestIdentifiers.has(targetRoot))
+            return false;
+        for (const opt of options) {
+            if (!this.allTaintedRootsBoundTo(opt, targetRoot))
+                return false;
+        }
+        for (const arg of args) {
+            if (this.isEmptyCallData(arg))
+                continue;
+            if (!this.allTaintedRootsBoundTo(arg, targetRoot))
+                return false;
+        }
+        return true;
+    }
+    allTaintedRootsBoundTo(expr, reqId) {
+        if (!expr || typeof expr !== 'object')
+            return true;
+        if (this.isMsgValue(expr))
+            return false;
+        const name = this.identifierName(expr);
+        if (name) {
+            if (this.parameters.has(name) || this.taintedLocals.has(name))
+                return name === reqId;
+            return true;
+        }
+        if (this.kind(expr) === 'MemberAccess') {
+            const root = this.rootIdentifier(expr);
+            if (root && (this.parameters.has(root) || this.taintedLocals.has(root)))
+                return root === reqId;
+            return true;
+        }
+        let ok = true;
+        this.forEachChild(expr, child => {
+            if (!this.allTaintedRootsBoundTo(child, reqId)) {
+                ok = false;
+                return true;
+            }
+            return false;
+        });
+        return ok;
+    }
+    flattenNames(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        const name = this.identifierName(expr);
+        const member = this.kind(expr) === 'MemberAccess'
+            ? `${this.flattenNames(expr.expression)}.${expr.memberName || ''}`
+            : '';
+        const children = [];
+        this.forEachChild(expr, child => {
+            const value = this.flattenNames(child);
+            if (value)
+                children.push(value);
+            return false;
+        });
+        return [name, member, ...children].filter(Boolean).join(' ');
+    }
+    getCalleeName(call) {
+        const expr = call?.expression;
+        if (!expr)
+            return '';
+        if (this.kind(expr) === 'Identifier')
+            return expr.name || '';
+        if (this.kind(expr) === 'MemberAccess') {
+            const prefix = this.getExpressionName(expr.expression);
+            return prefix ? `${prefix}.${expr.memberName || ''}` : expr.memberName || '';
+        }
+        if (this.kind(expr) === 'ElementaryTypeName')
+            return expr.name || '';
+        return '';
+    }
+    getExpressionName(expr) {
+        if (!expr || typeof expr !== 'object')
+            return '';
+        if (this.kind(expr) === 'Identifier')
+            return expr.name || '';
+        if (this.kind(expr) === 'MemberAccess') {
+            const prefix = this.getExpressionName(expr.expression);
+            return prefix ? `${prefix}.${expr.memberName || ''}` : expr.memberName || '';
+        }
+        return '';
+    }
+    rootIdentifier(expr) {
+        if (!expr || typeof expr !== 'object')
+            return null;
+        if (this.kind(expr) === 'Identifier')
+            return expr.name || null;
+        if (this.kind(expr) === 'MemberAccess')
+            return this.rootIdentifier(expr.expression);
+        if (this.kind(expr) === 'IndexAccess' || this.kind(expr) === 'IndexRangeAccess') {
+            return this.rootIdentifier(expr.base || expr.baseExpression);
+        }
+        if (this.kind(expr) === 'FunctionCall')
+            return this.rootIdentifier(this.args(expr)[0]);
+        return null;
+    }
+    identifierName(expr) {
+        return this.kind(expr) === 'Identifier' ? expr.name || null : null;
+    }
+    nodeName(node) {
+        if (!node)
+            return '';
+        if (typeof node === 'string')
+            return node;
+        if (node.name)
+            return this.nodeName(node.name);
+        if (this.kind(node) === 'Identifier')
+            return node.name || '';
+        if (this.kind(node) === 'ModifierInvocation')
+            return this.nodeName(node.name);
+        if (this.kind(node) === 'MemberAccess')
+            return node.memberName || '';
+        return '';
+    }
+    args(node) {
+        if (Array.isArray(node?.arguments))
+            return node.arguments;
+        if (Array.isArray(node?.arguments?.arguments))
+            return node.arguments.arguments;
+        if (Array.isArray(node?.components))
+            return node.components;
+        return [];
+    }
+    kind(node) {
+        return node?.type || node?.nodeType || '';
+    }
+    forEachChild(node, predicate) {
+        if (!node || typeof node !== 'object')
+            return false;
+        for (const key of [
+            'expression',
+            'left',
+            'right',
+            'subExpression',
+            'base',
+            'index',
+            'baseExpression',
+            'indexExpression',
+            'startExpression',
+            'endExpression',
+            'indexStart',
+            'indexEnd',
+            'initialValue',
+            'value',
+            'returnExpression',
+            'condition',
+            'trueBody',
+            'falseBody',
+            'body',
+            'arguments',
+            'components',
+            'statements',
+        ]) {
+            const value = node[key];
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object' && predicate(item))
+                        return true;
+                }
+            }
+            else if (value && typeof value === 'object' && predicate(value)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+exports.ArbitraryCallErrorDetector = ArbitraryCallErrorDetector;
+//# sourceMappingURL=arbitrary-call-error.js.map