@snovon/solast 0.2.0

package/dist/detectors/solhint-unchecked-low-level-call.d.ts

@@ -0,0 +1,74 @@
+import type { ScanResult } from '../index';
+interface Candidate {
+    callName: string;
+    loc: {
+        line: number;
+        column: number;
+    };
+    checkedVar: string | null;
+}
+interface PendingCandidate extends Candidate {
+    validated: boolean;
+}
+export declare class SolhintUncheckedLowLevelCallDetector {
+    readonly id = "solhint-unchecked-low-level-call";
+    readonly patternKey = "solhint-unchecked-low-level-call";
+    readonly supportedAstKinds: "parser"[];
+    private currentFile;
+    private currentContract;
+    private findings;
+    private currentAst;
+    setFile(file: string): void;
+    getFindings(): ScanResult[];
+    SourceUnit(node: any): void;
+    ContractDefinition(node: any): void;
+    ContractDefinition_post(): void;
+    FunctionDefinition(node: any): void;
+    protected walkStatementsInOrder(node: any, pendingScopes: PendingCandidate[][], functionNode: any): void;
+    protected processStatement(statement: any, pendingScopes: PendingCandidate[][], functionNode: any): void;
+    protected processNestedScope(node: any, pendingScopes: PendingCandidate[][], functionNode: any): void;
+    protected markValidatedVariables(validations: Set<string>, pendingScopes: PendingCandidate[][]): void;
+    protected flushPendingCandidates(candidates: PendingCandidate[], functionNode: any): void;
+    protected collectCandidates(node: any, ast: any, candidates: Candidate[]): void;
+    protected collectUnboundConditionCandidates(condition: any): Candidate[];
+    protected collectUnboundConditionCandidatesInto(node: any, candidates: Candidate[]): void;
+    protected conditionCallFailureHandled(statement: any): boolean;
+    protected successConditionLowLevelCall(condition: any): {
+        node: any;
+        callName: string;
+    } | null;
+    protected failureConditionLowLevelCall(condition: any): {
+        node: any;
+        callName: string;
+    } | null;
+    protected collectStatementValidations(node: any, validations: Set<string>): void;
+    protected revertingFailureCheck(node: any): string | null;
+    protected returningFailureCheck(node: any): string | null;
+    protected revertingSuccessCheck(node: any): string | null;
+    protected returningSuccessCheck(node: any): string | null;
+    protected checkedSuccessCondition(condition: any): string | null;
+    protected checkedFailureCondition(condition: any): string | null;
+    protected containsRevert(node: any): boolean;
+    protected containsReturn(node: any): boolean;
+    protected checkedIdentifier(expr: any): string | null;
+    protected collectCheckedIdentifiers(expr: any, validations: Set<string>): void;
+    protected assignedSuccessName(left: any, callNode: any, callName: string, ast: any): string | null;
+    protected firstVariableName(variables: any[]): string | null;
+    protected successVariableName(callNode: any, variables: any[], callName: string, fallback: string | null, ast: any): string | null;
+    protected tupleComponentByReturnName(left: any, callNode: any, ast: any, slotNames: string[], fallbackIndex: number): any;
+    protected asLowLevelCall(node: any): {
+        node: any;
+        callName: string;
+    } | null;
+    protected isNativeAddressSendCall(node: any): boolean;
+    protected lowLevelMemberName(expr: any): string | null;
+    protected directCallName(expr: any): string | null;
+    protected identifierName(expr: any): string | null;
+    protected booleanLiteralValue(expr: any): boolean | null;
+    protected locOf(node: any): {
+        line: number;
+        column: number;
+    };
+    protected childNodes(node: any): any[];
+}
+export {};

package/dist/detectors/solhint-unchecked-low-level-call.js

@@ -0,0 +1,463 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SolhintUncheckedLowLevelCallDetector = void 0;
+const resolve_return_names_1 = require("../ast/resolve-return-names");
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'solhint-unchecked-low-level-call';
+const PATTERN = RULE_ID;
+const LOW_LEVEL_CALLS = new Set(['call', 'delegatecall', 'staticcall', 'send']);
+class SolhintUncheckedLowLevelCallDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    currentFile = '';
+    currentContract = '';
+    findings = [];
+    currentAst = null;
+    setFile(file) {
+        this.currentFile = file;
+        this.currentContract = '';
+        this.findings = [];
+        this.currentAst = null;
+    }
+    getFindings() {
+        return this.findings;
+    }
+    SourceUnit(node) {
+        this.currentAst = node;
+    }
+    ContractDefinition(node) {
+        this.currentContract = node.name || '<anonymous>';
+    }
+    ContractDefinition_post() {
+        this.currentContract = '';
+    }
+    FunctionDefinition(node) {
+        if (!node.body)
+            return;
+        const pendingScopes = [[]];
+        this.walkStatementsInOrder(node.body, pendingScopes, node);
+        this.flushPendingCandidates(pendingScopes[0], node);
+    }
+    walkStatementsInOrder(node, pendingScopes, functionNode) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (Array.isArray(node.statements)) {
+            for (const statement of node.statements) {
+                this.processStatement(statement, pendingScopes, functionNode);
+            }
+            return;
+        }
+        this.processStatement(node, pendingScopes, functionNode);
+    }
+    processStatement(statement, pendingScopes, functionNode) {
+        if (!statement || typeof statement !== 'object')
+            return;
+        if (statement.type === 'Block') {
+            this.processNestedScope(statement, pendingScopes, functionNode);
+            return;
+        }
+        if (statement.type === 'IfStatement') {
+            const conditionCandidates = this.collectUnboundConditionCandidates(statement.condition);
+            if (conditionCandidates.length > 0 && !this.conditionCallFailureHandled(statement)) {
+                const currentScope = pendingScopes[pendingScopes.length - 1];
+                for (const candidate of conditionCandidates) {
+                    currentScope.push({ ...candidate, validated: false });
+                }
+            }
+            const validations = new Set();
+            const checked = this.revertingFailureCheck(statement) ||
+                this.returningFailureCheck(statement) ||
+                this.revertingSuccessCheck(statement) ||
+                this.returningSuccessCheck(statement);
+            if (checked)
+                validations.add(checked);
+            this.markValidatedVariables(validations, pendingScopes);
+            this.processNestedScope(statement.trueBody, pendingScopes, functionNode);
+            this.processNestedScope(statement.falseBody, pendingScopes, functionNode);
+            return;
+        }
+        if (statement.type === 'ForStatement' || statement.type === 'WhileStatement' || statement.type === 'DoWhileStatement') {
+            this.processNestedScope(statement.body, pendingScopes, functionNode);
+            return;
+        }
+        const candidates = [];
+        this.collectCandidates(statement, this.currentAst, candidates);
+        if (candidates.length > 0) {
+            const currentScope = pendingScopes[pendingScopes.length - 1];
+            for (const candidate of candidates) {
+                currentScope.push({ ...candidate, validated: false });
+            }
+            return;
+        }
+        const validations = new Set();
+        this.collectStatementValidations(statement, validations);
+        this.markValidatedVariables(validations, pendingScopes);
+    }
+    processNestedScope(node, pendingScopes, functionNode) {
+        if (!node || typeof node !== 'object')
+            return;
+        const nestedScope = [];
+        pendingScopes.push(nestedScope);
+        this.walkStatementsInOrder(node, pendingScopes, functionNode);
+        pendingScopes.pop();
+        if (pendingScopes.length > 0) {
+            pendingScopes[pendingScopes.length - 1].push(...nestedScope.filter(candidate => !candidate.validated));
+        }
+        else {
+            this.flushPendingCandidates(nestedScope, functionNode);
+        }
+    }
+    markValidatedVariables(validations, pendingScopes) {
+        for (const checked of validations) {
+            for (let scopeIndex = pendingScopes.length - 1; scopeIndex >= 0; scopeIndex--) {
+                const scope = pendingScopes[scopeIndex];
+                for (let candidateIndex = scope.length - 1; candidateIndex >= 0; candidateIndex--) {
+                    const candidate = scope[candidateIndex];
+                    if (!candidate.validated && candidate.checkedVar === checked) {
+                        candidate.validated = true;
+                    }
+                }
+            }
+        }
+    }
+    flushPendingCandidates(candidates, functionNode) {
+        for (const candidate of candidates) {
+            if (!candidate.validated) {
+                this.findings.push({
+                    file: this.currentFile,
+                    contract: this.currentContract,
+                    'function': functionNode.name || (functionNode.isConstructor ? '<constructor>' : '<anonymous>'),
+                    line: candidate.loc.line,
+                    column: candidate.loc.column,
+                    ruleId: RULE_ID,
+                    pattern: PATTERN,
+                    severity: 'medium',
+                    confidence: 'high',
+                    category: 'vulnerability',
+                    message: `Unchecked low-level call to ${candidate.callName}: validate the boolean success result.`,
+                    findingId: '',
+                    contractHash: '',
+                });
+            }
+        }
+    }
+    collectCandidates(node, ast, candidates) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'VariableDeclarationStatement') {
+            const call = this.asLowLevelCall(node.initialValue);
+            if (call) {
+                const checkedVar = this.firstVariableName(node.variables);
+                candidates.push({
+                    callName: call.callName,
+                    loc: this.locOf(call.node),
+                    checkedVar: this.successVariableName(call.node, node.variables, call.callName, checkedVar, ast),
+                });
+            }
+            return;
+        }
+        if (node.type === 'ExpressionStatement') {
+            const expr = node.expression;
+            const directCall = this.asLowLevelCall(expr);
+            if (directCall) {
+                candidates.push({
+                    callName: directCall.callName,
+                    loc: this.locOf(directCall.node),
+                    checkedVar: null,
+                });
+                return;
+            }
+            if (expr?.type === 'BinaryOperation' && expr.operator === '=') {
+                const call = this.asLowLevelCall(expr.right);
+                if (call) {
+                    candidates.push({
+                        callName: call.callName,
+                        loc: this.locOf(call.node),
+                        checkedVar: this.assignedSuccessName(expr.left, call.node, call.callName, ast),
+                    });
+                    return;
+                }
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectCandidates(child, ast, candidates);
+        }
+    }
+    collectUnboundConditionCandidates(condition) {
+        const candidates = [];
+        this.collectUnboundConditionCandidatesInto(condition, candidates);
+        return candidates;
+    }
+    collectUnboundConditionCandidatesInto(node, candidates) {
+        if (!node || typeof node !== 'object')
+            return;
+        const call = this.asLowLevelCall(node);
+        if (call) {
+            candidates.push({
+                callName: call.callName,
+                loc: this.locOf(call.node),
+                checkedVar: null,
+            });
+            return;
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectUnboundConditionCandidatesInto(child, candidates);
+        }
+    }
+    conditionCallFailureHandled(statement) {
+        const failureCall = this.failureConditionLowLevelCall(statement.condition);
+        if (failureCall && (this.containsRevert(statement.trueBody) || this.containsReturn(statement.trueBody)))
+            return true;
+        const successCall = this.successConditionLowLevelCall(statement.condition);
+        return !!(successCall && statement.falseBody && (this.containsRevert(statement.falseBody) || this.containsReturn(statement.falseBody)));
+    }
+    successConditionLowLevelCall(condition) {
+        const direct = this.asLowLevelCall(condition);
+        if (direct)
+            return direct;
+        if (condition?.type === 'BinaryOperation' && (condition.operator === '==' || condition.operator === '!=')) {
+            const left = this.asLowLevelCall(condition.left);
+            const right = this.asLowLevelCall(condition.right);
+            const leftBool = this.booleanLiteralValue(condition.left);
+            const rightBool = this.booleanLiteralValue(condition.right);
+            if (left && ((condition.operator === '==' && rightBool === true) || (condition.operator === '!=' && rightBool === false)))
+                return left;
+            if (right && ((condition.operator === '==' && leftBool === true) || (condition.operator === '!=' && leftBool === false)))
+                return right;
+        }
+        return null;
+    }
+    failureConditionLowLevelCall(condition) {
+        if (condition?.type === 'UnaryOperation' && condition.operator === '!') {
+            return this.asLowLevelCall(condition.subExpression);
+        }
+        if (condition?.type === 'BinaryOperation' && (condition.operator === '==' || condition.operator === '!=')) {
+            const left = this.asLowLevelCall(condition.left);
+            const right = this.asLowLevelCall(condition.right);
+            const leftBool = this.booleanLiteralValue(condition.left);
+            const rightBool = this.booleanLiteralValue(condition.right);
+            if (left && ((condition.operator === '==' && rightBool === false) || (condition.operator === '!=' && rightBool === true)))
+                return left;
+            if (right && ((condition.operator === '==' && leftBool === false) || (condition.operator === '!=' && leftBool === true)))
+                return right;
+        }
+        return null;
+    }
+    collectStatementValidations(node, validations) {
+        if (!node || typeof node !== 'object')
+            return;
+        if (node.type === 'FunctionCall') {
+            const directName = this.directCallName(node.expression);
+            if (directName === 'require' || directName === 'assert') {
+                this.collectCheckedIdentifiers(node.arguments?.[0], validations);
+            }
+            if (directName === 'verifyCallResult' && node.arguments?.[0]) {
+                const checked = this.checkedIdentifier(node.arguments[0]);
+                if (checked)
+                    validations.add(checked);
+            }
+            else if ((directName === 'verify' ||
+                directName === 'verifyCallResultFromTarget' ||
+                directName === '_revert') &&
+                node.arguments?.[1]) {
+                const checked = this.checkedIdentifier(node.arguments[1]);
+                if (checked)
+                    validations.add(checked);
+            }
+        }
+        for (const child of this.childNodes(node)) {
+            this.collectStatementValidations(child, validations);
+        }
+    }
+    revertingFailureCheck(node) {
+        const condition = node.condition;
+        const checked = this.checkedFailureCondition(condition);
+        if (!checked)
+            return null;
+        return this.containsRevert(node.trueBody) ? checked : null;
+    }
+    returningFailureCheck(node) {
+        const condition = node.condition;
+        const checked = this.checkedFailureCondition(condition);
+        if (!checked)
+            return null;
+        return this.containsReturn(node.trueBody) ? checked : null;
+    }
+    revertingSuccessCheck(node) {
+        const checked = this.checkedSuccessCondition(node.condition);
+        if (!checked)
+            return null;
+        return node.falseBody && this.containsRevert(node.falseBody) ? checked : null;
+    }
+    returningSuccessCheck(node) {
+        const checked = this.checkedSuccessCondition(node.condition);
+        if (!checked)
+            return null;
+        return node.falseBody && this.containsReturn(node.falseBody) ? checked : null;
+    }
+    checkedSuccessCondition(condition) {
+        const direct = this.identifierName(condition);
+        if (direct)
+            return direct;
+        if (condition?.type === 'BinaryOperation' && condition.operator === '==') {
+            const leftName = this.identifierName(condition.left);
+            const rightName = this.identifierName(condition.right);
+            const leftTrue = condition.left?.type === 'BooleanLiteral' && condition.left.value === true;
+            const rightTrue = condition.right?.type === 'BooleanLiteral' && condition.right.value === true;
+            if (leftTrue && rightName)
+                return rightName;
+            if (rightTrue && leftName)
+                return leftName;
+        }
+        return null;
+    }
+    checkedFailureCondition(condition) {
+        if (condition?.type === 'UnaryOperation' && condition.operator === '!') {
+            return this.identifierName(condition.subExpression);
+        }
+        if (condition?.type === 'BinaryOperation' && condition.operator === '==') {
+            const leftName = this.identifierName(condition.left);
+            const rightName = this.identifierName(condition.right);
+            const leftFalse = condition.left?.type === 'BooleanLiteral' && condition.left.value === false;
+            const rightFalse = condition.right?.type === 'BooleanLiteral' && condition.right.value === false;
+            if (leftFalse && rightName)
+                return rightName;
+            if (rightFalse && leftName)
+                return leftName;
+        }
+        return null;
+    }
+    containsRevert(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'RevertStatement')
+            return true;
+        if (node.type === 'FunctionCall' && this.directCallName(node.expression) === 'revert')
+            return true;
+        return this.childNodes(node).some((child) => this.containsRevert(child));
+    }
+    containsReturn(node) {
+        if (!node || typeof node !== 'object')
+            return false;
+        if (node.type === 'ReturnStatement')
+            return true;
+        return this.childNodes(node).some((child) => this.containsReturn(child));
+    }
+    checkedIdentifier(expr) {
+        const direct = this.identifierName(expr);
+        if (direct)
+            return direct;
+        if (expr?.type === 'UnaryOperation' && expr.operator === '!') {
+            return this.identifierName(expr.subExpression);
+        }
+        if (expr?.type === 'BinaryOperation' && (expr.operator === '==' || expr.operator === '!=')) {
+            return this.identifierName(expr.left) || this.identifierName(expr.right);
+        }
+        return null;
+    }
+    collectCheckedIdentifiers(expr, validations) {
+        const direct = this.checkedIdentifier(expr);
+        if (direct) {
+            validations.add(direct);
+            return;
+        }
+        if (expr?.type === 'BinaryOperation' && expr.operator === '&&') {
+            this.collectCheckedIdentifiers(expr.left, validations);
+            this.collectCheckedIdentifiers(expr.right, validations);
+        }
+    }
+    assignedSuccessName(left, callNode, callName, ast) {
+        if (left?.type === 'TupleExpression') {
+            return this.identifierName(this.tupleComponentByReturnName(left, callNode, ast, ['success', 'ok'], 0));
+        }
+        if (callName === 'send') {
+            return this.identifierName(left);
+        }
+        return null;
+    }
+    firstVariableName(variables) {
+        if (!Array.isArray(variables) || variables.length === 0)
+            return null;
+        const first = variables[0];
+        return first?.name || first?.identifier?.name || null;
+    }
+    successVariableName(callNode, variables, callName, fallback, ast) {
+        if (callName === 'send')
+            return fallback;
+        const returnNames = (0, resolve_return_names_1.resolveReturnNames)(callNode, ast);
+        if (!returnNames)
+            return fallback;
+        const index = returnNames.findIndex(name => name === 'success' || name === 'ok');
+        if (index < 0)
+            return fallback;
+        return variables[index]?.name || variables[index]?.identifier?.name || fallback;
+    }
+    tupleComponentByReturnName(left, callNode, ast, slotNames, fallbackIndex) {
+        const returnNames = (0, resolve_return_names_1.resolveReturnNames)(callNode, ast);
+        if (returnNames) {
+            const index = returnNames.findIndex(name => !!name && slotNames.includes(name.toLowerCase()));
+            if (index >= 0)
+                return left.components?.[index];
+        }
+        return left.components?.[fallbackIndex];
+    }
+    asLowLevelCall(node) {
+        if (!node || node.type !== 'FunctionCall')
+            return null;
+        const callName = this.lowLevelMemberName(node.expression);
+        if (callName === 'send' && !this.isNativeAddressSendCall(node))
+            return null;
+        return callName ? { node, callName } : null;
+    }
+    isNativeAddressSendCall(node) {
+        return (node.expression?.type === 'MemberAccess' &&
+            node.expression.memberName === 'send' &&
+            Array.isArray(node.arguments) &&
+            node.arguments.length === 1 &&
+            node.arguments[0]?.type !== 'NameValueExpression');
+    }
+    lowLevelMemberName(expr) {
+        if (!expr)
+            return null;
+        if (expr.type === 'MemberAccess' && LOW_LEVEL_CALLS.has(expr.memberName)) {
+            return expr.memberName;
+        }
+        if (expr.type === 'NameValueExpression' || expr.type === 'FunctionCallOptions') {
+            return this.lowLevelMemberName(expr.expression);
+        }
+        return null;
+    }
+    directCallName(expr) {
+        return expr?.type === 'Identifier' ? expr.name : null;
+    }
+    identifierName(expr) {
+        return expr?.type === 'Identifier' ? expr.name : null;
+    }
+    booleanLiteralValue(expr) {
+        return expr?.type === 'BooleanLiteral' ? expr.value === true : null;
+    }
+    locOf(node) {
+        const { line, column } = (0, ast_1.assertLoc)(node);
+        return { line, column };
+    }
+    childNodes(node) {
+        const children = [];
+        for (const [key, value] of Object.entries(node)) {
+            if (key === 'loc' || key === 'range')
+                continue;
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (item && typeof item === 'object')
+                        children.push(item);
+                }
+            }
+            else if (value && typeof value === 'object') {
+                children.push(value);
+            }
+        }
+        return children;
+    }
+}
+exports.SolhintUncheckedLowLevelCallDetector = SolhintUncheckedLowLevelCallDetector;
+//# sourceMappingURL=solhint-unchecked-low-level-call.js.map

package/dist/detectors/stablecoin-pair-spot-oracle.d.ts

@@ -0,0 +1,7 @@
+import type { ScanResult } from '../index';
+export declare class StablecoinPairSpotOracleDetector {
+    readonly id = "stablecoin-pair-spot-oracle";
+    readonly patternKey = "stablecoin-pair-spot-oracle";
+    readonly supportedAstKinds: ("parser" | "solc")[];
+    scanAst(ast: any, file: string, sourceText?: string): ScanResult[];
+}